diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0089027e4..d65c6bd99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 2.30.1 / 2021-09-28
+
+* [ENHANCEMENT] Remote Write: Redact remote write URL when used for metric label. #9383
+* [ENHANCEMENT] UI: Redact remote write URL and proxy URL passwords in the `/config` page. #9408
+* [BUGFIX] promtool rules backfill: Prevent creation of data before the start time. #9339
+* [BUGFIX] promtool rules backfill: Do not query after the end time. #9340
+* [BUGFIX] Azure SD: Fix panic when no computername is set. #9387
+
 ## 2.30.0 / 2021-09-14
 
 * [FEATURE] **experimental** TSDB: Snapshot in-memory chunks on shutdown for faster restarts. Behind `--enable-feature=memory-snapshot-on-shutdown` flag. #7229
diff --git a/VERSION b/VERSION
index 6a6900382..bcec02eeb 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.30.0
+2.30.1
diff --git a/cmd/promtool/rules.go b/cmd/promtool/rules.go
index 96e21a9f4..7140d8aa9 100644
--- a/cmd/promtool/rules.go
+++ b/cmd/promtool/rules.go
@@ -81,10 +81,9 @@ func (importer *ruleImporter) importAll(ctx context.Context) (errs []error) {
 	for name, group := range importer.groups {
 		level.Info(importer.logger).Log("backfiller", "processing group", "name", name)
 
-		stimeWithAlignment := group.EvalTimestamp(importer.config.start.UnixNano())
 		for i, r := range group.Rules() {
 			level.Info(importer.logger).Log("backfiller", "processing rule", "id", i, "name", r.Name())
-			if err := importer.importRule(ctx, r.Query().String(), r.Name(), r.Labels(), stimeWithAlignment, importer.config.end, group); err != nil {
+			if err := importer.importRule(ctx, r.Query().String(), r.Name(), r.Labels(), importer.config.start, importer.config.end, group); err != nil {
 				errs = append(errs, err)
 			}
 		}
@@ -106,11 +105,15 @@ func (importer *ruleImporter) importRule(ctx context.Context, ruleExpr, ruleName
 		for startWithAlignment.Unix() < currStart {
 			startWithAlignment = startWithAlignment.Add(grp.Interval())
 		}
+		end := time.Unix(min(endOfBlock/int64(time.Second/time.Millisecond), end.Unix()), 0).UTC()
+		if end.Before(startWithAlignment) {
+			break
+		}
 		val, warnings, err := importer.apiClient.QueryRange(ctx,
 			ruleExpr,
 			v1.Range{
 				Start: startWithAlignment,
-				End:   time.Unix(min(endOfBlock/int64(time.Second/time.Millisecond), end.Unix()), 0).UTC(),
+				End:   end,
 				Step:  grp.Interval(),
 			},
 		)
diff --git a/discovery/azure/azure.go b/discovery/azure/azure.go
index 6de0995ef..b0de0abd8 100644
--- a/discovery/azure/azure.go
+++ b/discovery/azure/azure.go
@@ -464,7 +464,9 @@ func mapFromVM(vm compute.VirtualMachine) virtualMachine {
 		}
 	}
 
-	if vm.VirtualMachineProperties != nil && vm.VirtualMachineProperties.OsProfile != nil {
+	if vm.VirtualMachineProperties != nil &&
+		vm.VirtualMachineProperties.OsProfile != nil &&
+		vm.VirtualMachineProperties.OsProfile.ComputerName != nil {
 		computerName = *(vm.VirtualMachineProperties.OsProfile.ComputerName)
 	}
 
diff --git a/storage/remote/write.go b/storage/remote/write.go
index 2d96f70ae..b3fec364a 100644
--- a/storage/remote/write.go
+++ b/storage/remote/write.go
@@ -158,7 +158,10 @@ func (rws *WriteStorage) ApplyConfig(conf *config.Config) error {
 			continue
 		}
 
-		endpoint := rwConf.URL.String()
+		// Redacted to remove any passwords in the URL (that are
+		// technically accepted but not recommended) since this is
+		// only used for metric labels.
+		endpoint := rwConf.URL.Redacted()
 		newQueues[hash] = NewQueueManager(
 			newQueueManagerMetrics(rws.reg, name, endpoint),
 			rws.watcherMetrics,