diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index c6cfb95..3a5f835 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,30 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.5
+
+- Upgrade Gitea from 28.1.0 to 28.3.0, skipping 28.2.0. Both are maintenance
+  releases with no breaking changes and no `app.ini` changes; no configuration
+  updates were required.
+- Security fixes included: token scope enforcement on many API and web routes
+  (public-only tokens could read private data and, for admins, create
+  administrators), OAuth2 `ACCOUNT_LINKING = auto` account takeover, review
+  triggered Actions workflows running with repository secrets, stored XSS via
+  Actions artifact `Content-Encoding`, SSH certificate principal confusion,
+  OpenID association CSRF, and several private-data leaks in feeds, profiles,
+  project boards and issue timelines.
+- Behavior changes to be aware of (no cookbook change): `git maintenance` now
+  defaults to the `gc` strategy; profile pages treat token requests as
+  anonymous and user/org RSS/Atom feeds require `read:user` /
+  `read:organization`; the API rejects changes to issues, labels, milestones
+  and releases of archived repositories; review-triggered workflows run on the
+  pull request head; the `gitea-vscode` OAuth2 application is pre-registered;
+  email address validation is relaxed to what Go's `mail.ParseAddress` accepts.
+- Upgrade the Gitea Actions runner from 5.2.2 to 5.2.4. No `config.yaml`
+  changes were required. 5.2.4 fixes the v4 artifact API in `exec` mode so
+  `upload-artifact` v4 and later work, and 5.2.3 fixes the action header group,
+  dry runs touching the Docker daemon, and damaged shared action cache trees.
+
 # 0.3.4
 
 - Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index f7308b8..96fbcb7 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "28.1.0"
-node.default["gitea"]["checksum"] = "ea93cfa4a300564ac457d3903469fea49ec5a4da37d0cebaa435f8e329ea64d0"
+node.default["gitea"]["version"] = "28.3.0"
+node.default["gitea"]["checksum"] = "5f834e8f04986f3b9206cf14743b5a6e6996ceddc238dac6409866ebda2a0686"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.2"
-node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63"
+node.default["gitea"]["runner"]["version"] = "5.2.4"
+node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index a847057..2b17f77 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.4'
+version '0.3.5'
 chef_version '>= 14.0'
 
 depends "firewall"