diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index fb7e99fa9..b799e0ca1 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -7,7 +7,7 @@ on:
       - v*
 
 env:
-  STRUCTOR_VERSION: v1.12.0
+  STRUCTOR_VERSION: v1.13.1
   MIXTUS_VERSION: v0.4.1
 
 jobs:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41e456242..cba002d75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,19 @@
+## [v2.9.9](https://github.com/traefik/traefik/tree/v2.9.9) (2023-03-21)
+[All Commits](https://github.com/traefik/traefik/compare/v2.9.8...v2.9.9)
+
+**Bug fixes:**
+- **[acme]** Update go-acme/lego to v4.10.2 ([#9749](https://github.com/traefik/traefik/pull/9749) by [ldez](https://github.com/ldez))
+- **[http3]** Update quic-go to v0.33.0 ([#9737](https://github.com/traefik/traefik/pull/9737) by [ldez](https://github.com/ldez))
+- **[metrics]** Include user-defined default cert for traefik_tls_certs_not_after metric ([#9742](https://github.com/traefik/traefik/pull/9742) by [rtribotte](https://github.com/rtribotte))
+- **[middleware]** Update vulcand/oxy to a0e9f7ff1040 ([#9750](https://github.com/traefik/traefik/pull/9750) by [ldez](https://github.com/ldez))
+- **[nomad]** Fix default configuration settings for Nomad Provider ([#9758](https://github.com/traefik/traefik/pull/9758) by [aofei](https://github.com/aofei))
+- **[nomad]** Fix Nomad client TLS defaults ([#9795](https://github.com/traefik/traefik/pull/9795) by [rtribotte](https://github.com/rtribotte))
+- **[server]** Remove User-Agent header removal from ReverseProxy director func ([#9752](https://github.com/traefik/traefik/pull/9752) by [rtribotte](https://github.com/rtribotte))
+
+**Documentation:**
+- **[middleware]** Clarify ratelimit middleware ([#9777](https://github.com/traefik/traefik/pull/9777) by [mpl](https://github.com/mpl))
+- **[tcp]** Correcting variable name 'server address' in TCP Router ([#9743](https://github.com/traefik/traefik/pull/9743) by [ralphg6](https://github.com/ralphg6))
+
 ## [v2.9.8](https://github.com/traefik/traefik/tree/v2.9.8) (2023-02-15)
 [All Commits](https://github.com/traefik/traefik/compare/v2.9.7...v2.9.8)
 
diff --git a/pkg/provider/nomad/nomad.go b/pkg/provider/nomad/nomad.go
index 96331a42f..3bb470b54 100644
--- a/pkg/provider/nomad/nomad.go
+++ b/pkg/provider/nomad/nomad.go
@@ -101,13 +101,17 @@ func (c *Configuration) SetDefaults() {
 		Address: defConfig.Address,
 		Region:  defConfig.Region,
 		Token:   defConfig.SecretID,
-		TLS: &types.ClientTLS{
+	}
+
+	if defConfig.TLSConfig != nil && (defConfig.TLSConfig.Insecure || defConfig.TLSConfig.CACert != "" || defConfig.TLSConfig.ClientCert != "" || defConfig.TLSConfig.ClientKey != "") {
+		c.Endpoint.TLS = &types.ClientTLS{
 			CA:                 defConfig.TLSConfig.CACert,
 			Cert:               defConfig.TLSConfig.ClientCert,
 			Key:                defConfig.TLSConfig.ClientKey,
 			InsecureSkipVerify: defConfig.TLSConfig.Insecure,
-		},
+		}
 	}
+
 	c.Prefix = defaultPrefix
 	c.ExposedByDefault = true
 	c.RefreshInterval = ptypes.Duration(15 * time.Second)
@@ -231,19 +235,24 @@ func (p *Provider) loadConfiguration(ctx context.Context, configurationC chan<-
 }
 
 func createClient(namespace string, endpoint *EndpointConfig) (*api.Client, error) {
-	return api.NewClient(&api.Config{
+	config := api.Config{
 		Address:   endpoint.Address,
 		Namespace: namespace,
 		Region:    endpoint.Region,
 		SecretID:  endpoint.Token,
 		WaitTime:  time.Duration(endpoint.EndpointWaitTime),
-		TLSConfig: &api.TLSConfig{
+	}
+
+	if endpoint.TLS != nil {
+		config.TLSConfig = &api.TLSConfig{
 			CACert:     endpoint.TLS.CA,
 			ClientCert: endpoint.TLS.Cert,
 			ClientKey:  endpoint.TLS.Key,
 			Insecure:   endpoint.TLS.InsecureSkipVerify,
-		},
-	})
+		}
+	}
+
+	return api.NewClient(&config)
 }
 
 // configuration contains information from the service's tags that are globals
diff --git a/pkg/provider/nomad/nomad_test.go b/pkg/provider/nomad/nomad_test.go
index d75307231..f3fcd8894 100644
--- a/pkg/provider/nomad/nomad_test.go
+++ b/pkg/provider/nomad/nomad_test.go
@@ -89,7 +89,6 @@ func TestProvider_SetDefaults_Endpoint(t *testing.T) {
 			envs: map[string]string{},
 			expected: &EndpointConfig{
 				Address: "http://127.0.0.1:4646",
-				TLS:     &types.ClientTLS{},
 			},
 		},
 		{
diff --git a/script/code-gen.sh b/script/code-gen.sh
index e15d97622..9fd29e0d8 100755
--- a/script/code-gen.sh
+++ b/script/code-gen.sh
@@ -29,7 +29,7 @@ docker run --rm \
            --go-header-file=/go/src/${PROJECT_MODULE}/script/boilerplate.go.tmpl
 
 echo "Generating DeepCopy code ..."
-cmd=""
+
 docker run --rm \
            -v "${CURRENT_DIR}:/go/src/${PROJECT_MODULE}" \
            -w "/go/src/${PROJECT_MODULE}" \
diff --git a/script/gcg/traefik-bugfix.toml b/script/gcg/traefik-bugfix.toml
index 95128b3e2..189f8c451 100644
--- a/script/gcg/traefik-bugfix.toml
+++ b/script/gcg/traefik-bugfix.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example new bugfix v2.9.8
+# example new bugfix v2.9.9
 CurrentRef = "v2.9"
-PreviousRef = "v2.9.7"
+PreviousRef = "v2.9.8"
 BaseBranch = "v2.9"
-FutureCurrentRefName = "v2.9.8"
+FutureCurrentRefName = "v2.9.9"
 
 ThresholdPreviousRef = 10
 ThresholdCurrentRef = 10