diff --git a/CHANGELOG.md b/CHANGELOG.md
index 898ea5178..7a65a08f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
+# Release 0.20.14
+
+## What's New
+
+* Bug fix: Posture timeouts (i.e. MFA timeouts) would not apply to the first session of an API session
+* Feature: Ziti CLI now supports attribute updates on MFA posture checks
+* Posture queries not support `timeout` and `timeoutRemaining`
+
 # Release 0.20.13
 
 ## What's New
@@ -6,8 +14,7 @@
   * NF-INTERCEPT chain was getting deleted when any intercept was stopped, not when all intercepts were stopped
   * IP address could get re-used across DNS entries. Added DNS cache flush on startup to avoid this
   * IP address cleanup was broken as all services would see last assigned IP
-* Bug fix: Introduce delay when closing xgress peer after receiving unroute if end of session not yet received
-* Bug fix: Posture timeouts (i.e. MFA timeouts) would not apply to the first session of an API session
+  * Bug fix: Introduce delay when closing xgress peer after receiving unroute if end of session not yet received
 * Feature: Can now search relevant entities by role attributes
   * Services, edge routers and identities can be search by role attribute. Ex: `ziti edge list services 'anyOf(roleAttributes) = "one"'`
   * Polices can be searched by roles. Ex: `ziti edge list service-policies 'anyOf(identityRoles) = "#all"'`
diff --git a/go.mod b/go.mod
index 3f2ff3698..2defad985 100644
--- a/go.mod
+++ b/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
 	github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
 	github.com/michaelquigley/pfxlog v0.5.1
-	github.com/openziti/edge v0.19.166
+	github.com/openziti/edge v0.19.168
 	github.com/openziti/fabric v0.16.78
 	github.com/openziti/foundation v0.15.62
 	github.com/openziti/sdk-golang v0.15.66
diff --git a/go.sum b/go.sum
index eda759550..89f655235 100644
--- a/go.sum
+++ b/go.sum
@@ -673,8 +673,8 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5
 github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
 github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
-github.com/openziti/edge v0.19.166 h1:gLBfpSvy7t9vUkWTvcF10q9igAXPioW3IpwfA2Rpj1Q=
-github.com/openziti/edge v0.19.166/go.mod h1:C2k0vPxAXVHdMlfQJ/nCQ0yAsld1hSkqW33ygOKDSaM=
+github.com/openziti/edge v0.19.168 h1:vBtE5puYwteNcQ1RWZaCHqHGBGLHbA7J8QWajHpPV38=
+github.com/openziti/edge v0.19.168/go.mod h1:C2k0vPxAXVHdMlfQJ/nCQ0yAsld1hSkqW33ygOKDSaM=
 github.com/openziti/fabric v0.16.78 h1:x76HTlxHYiCjNqtNJZhkWSF07LAr8N9N+PvbOFRow+0=
 github.com/openziti/fabric v0.16.78/go.mod h1:gXK+lmCt4LmEef+p4ipeJCQ9m+veCi2Psnhf2jvuIsQ=
 github.com/openziti/foundation v0.15.62 h1:xXl/2xNLgFnpKaxhpM3PQVOEff5ONO6Dvhs+/6wUJYk=
diff --git a/ziti/cmd/ziti/cmd/edge_controller/update_posture_check.go b/ziti/cmd/ziti/cmd/edge_controller/update_posture_check.go
index dcc68f964..526357d72 100644
--- a/ziti/cmd/ziti/cmd/edge_controller/update_posture_check.go
+++ b/ziti/cmd/ziti/cmd/edge_controller/update_posture_check.go
@@ -224,6 +224,8 @@ func newUpdatePostureCheckMfaCmd(f cmdutil.Factory, out io.Writer, errOut io.Wri
 
 	cmd.Flags().BoolVarP(&options.ignoreLegacyEndpoints, "ignore-legacy", "i", false, "Ignore prompts and timeout for endpoints that do not support MFA timeout/prompts")
 	cmd.Flags().BoolVarP(&options.ignoreLegacyEndpoints, "no-ignore-legacy", "l", false, "Do not ignore prompts and timeout for endpoints that do not support MFA timeout/prompts")
+
+	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil, "Set role attributes of the posture check. Use --role-attributes '' to set an empty list")
 	return cmd
 }
 
@@ -275,6 +277,11 @@ func runUpdatePostureCheckMfa(o *updatePostureCheckMfaOptions) error {
 		change = true
 	}
 
+	if o.Cmd.Flags().Changed("role-attributes") {
+		setJSONValue(entityData, o.roleAttributes, "roleAttributes")
+		change = true
+	}
+
 	if !change {
 		return errors.New("no change specified. must specify at least one attribute to change")
 	}