diff --git a/.github/workflows/sync-from-upstream.yml b/.github/workflows/sync-from-upstream.yml
index ebb0403c65ae4..fba99dd721aba 100644
--- a/.github/workflows/sync-from-upstream.yml
+++ b/.github/workflows/sync-from-upstream.yml
@@ -11,11 +11,15 @@ jobs:
 
   # Check for the presence of a PROJEN_GITHUB_TOKEN secret.
   #
-  # This is expected to contain a personal access token of someone
-  # who pas permissions to bypass branch protection rules.
+  # This is expected to contain a personal access token of someone who has
+  # permissions to bypass branch protection rules.
   #
-  # If not present, we will use GitHub Actions Token permissions,
-  # but those are bound by branch protection rules.
+  # If not present, we can only use GitHub Actions Token permissions,
+  # but this has the following downsides:
+  #
+  # - Those are bound by branch protection rules (so automated pushing won't work).
+  # - As soon as a workflow file needs to be changed, GitHub will reject the push.
+  #   Only Apps and Users can be allowed to modify workflows.
   check-secret:
     # Don't run on the target repo itself, only forks
     if: github.repository != 'aws/aws-cdk'
@@ -52,7 +56,7 @@ jobs:
       - name: Sync from aws/aws-cdk
         run: |-
           git remote add upstream https://github.com/aws/aws-cdk.git
-          git fetch upstream
+          git fetch upstream $BRANCHES
 
           for branch in $BRANCHES; do
             git push origin --force refs/remotes/upstream/$branch:refs/heads/$branch
diff --git a/CHANGELOG.v2.alpha.md b/CHANGELOG.v2.alpha.md
index 3d74965cbaf16..f1d3b1d8ea4ad 100644
--- a/CHANGELOG.v2.alpha.md
+++ b/CHANGELOG.v2.alpha.md
@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.120.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.119.0-alpha.0...v2.120.0-alpha.0) (2024-01-12)
+
 ## [2.119.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.118.0-alpha.0...v2.119.0-alpha.0) (2024-01-11)
 
 
diff --git a/CHANGELOG.v2.md b/CHANGELOG.v2.md
index a08252957aa42..23ccf83560e1d 100644
--- a/CHANGELOG.v2.md
+++ b/CHANGELOG.v2.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.120.0](https://github.com/aws/aws-cdk/compare/v2.119.0...v2.120.0) (2024-01-12)
+
+
+### Features
+
+* **ecs:** support for capacity provider managed instance draining ([#28672](https://github.com/aws/aws-cdk/issues/28672)) ([cf97f47](https://github.com/aws/aws-cdk/commit/cf97f47d9f9a1a8716a1673eb9b906ab365ee11b))
+
 ## [2.119.0](https://github.com/aws/aws-cdk/compare/v2.118.0...v2.119.0) (2024-01-11)
 
 
diff --git a/packages/aws-cdk/lib/api/cxapp/exec.ts b/packages/aws-cdk/lib/api/cxapp/exec.ts
index 757e03653d0e0..4069d7a660143 100644
--- a/packages/aws-cdk/lib/api/cxapp/exec.ts
+++ b/packages/aws-cdk/lib/api/cxapp/exec.ts
@@ -118,6 +118,7 @@ export async function execProgram(aws: SdkProvider, config: Configuration): Prom
         if (code === 0) {
           return ok();
         } else {
+          debug('failed command:', commandAndArgs);
           return fail(new Error(`Subprocess exited with error ${code}`));
         }
       });
diff --git a/version.v2.json b/version.v2.json
index 3f492327aaa4e..5df3fdd76f89c 100644
--- a/version.v2.json
+++ b/version.v2.json
@@ -1,4 +1,4 @@
 {
-  "version": "2.119.0",
-  "alphaVersion": "2.119.0-alpha.0"
+  "version": "2.120.0",
+  "alphaVersion": "2.120.0-alpha.0"
 }
\ No newline at end of file