diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index 19d8304..fbcc177 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,18 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.2
+
+- Upgrade Gitea from 28.0.0 to 28.1.0. This is a maintenance release fixing
+  regressions from 28.0.0 (Actions pushes to protected branches, npm registry,
+  MySQL/MariaDB/MSSQL transactions, MathML rendering, PR head refs) and several
+  security vulnerabilities (stored XSS via the repository media API, OAuth2
+  refresh token kind check, push mirror `DISABLE_NEW_PUSH` / `IMPORT_LOCAL_PATHS`
+  permission checks, issue attachment access, `FORCE_PRIVATE` bypass, private
+  user/org feed visibility, release deletion via tag route, migration downloader
+  page-size bound). No `app.ini` configuration changes were required; we use
+  PostgreSQL, so the MySQL/MariaDB/MSSQL transaction fixes do not apply.
+
 # 0.3.1
 
 - Upgrade the Gitea Actions runner from 2.0.0 to 4.0.0. No config changes were
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index d05dedf..120f2ac 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "28.0.0"
-node.default["gitea"]["checksum"] = "7f82b522c4a98191e8ace49d85e17a2056a3cedc3054a6367c13c0a813d015a8"
+node.default["gitea"]["version"] = "28.1.0"
+node.default["gitea"]["checksum"] = "ea93cfa4a300564ac457d3903469fea49ec5a4da37d0cebaa435f8e329ea64d0"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index 40b69da..a138679 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.1'
+version '0.3.2'
 chef_version '>= 14.0'
 
 depends "firewall"