diff --git a/AGENTS.md b/AGENTS.md
index 28f9d6b..d42f7a5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,6 +3,7 @@
 Welcome, AI Agent! This file contains essential context and rules for interacting with the Kosmos Chef repository. Read this carefully before planning or executing any changes.
 
 ## 🏢 Project Overview
+
 This repository contains the infrastructure automation code used by Kosmos to provision and configure bare metal servers (KVM hosts) and Ubuntu virtual machines (KVM guests). 
 
 We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management. Nodes run the community **Cinc Client** distribution (the license-free Chef Infra Client) instead of Chef Infra Client, and everything is driven by **Cinc Workstation** (the community fork of Chef Workstation). On-node configuration lives in `/etc/cinc`, and the repo's knife config lives in `.cinc/`.
@@ -27,12 +28,14 @@ We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and
    - Instruct the user to run `berks install` and `berks vendor cookbooks/ --delete` (or run it via the `bash` tool if permitted).
 
 2. **Provisioning (Knife Zero)**
-   - Bootstrapping and converging nodes is done using `knife zero`. 
-   - *Example:* `knife zero converge name:server-name.kosmos.org`
+   - Bootstrapping and converging nodes is done using `knife zero`.
+   - *Example:* `knife zero converge -a knife_zero.host name:gitea-2`
+   - *Example for a VM host/proxy (different port):* `knife zero converge -p2222 name:fornax`
+   - *Example for all machines matching a role:* `knife zero converge -p2222 -a knife_zero.host 'role:openresty_proxy'`
    - To migrate an existing (Chef) node to Cinc Client: `scripts/knife/migrate_node_to_cinc.sh <node>`, then converge as usual.
 
 3. **Code Style & Conventions**
-   - Chef recipes, resources, and roles are written in **Ruby**. 
+   - Chef recipes, resources, and roles are written in **Ruby**.
    - Follow standard Chef and Ruby (RuboCop) idioms. Look at neighboring files in `site-cookbooks/` or `roles/` to match formatting and naming conventions.
 
 ## 🚨 Core Directives for AI Agents
@@ -40,4 +43,4 @@ We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and
 1. **Infrastructure as Code**: Manual server configurations are highly discouraged. All changes must be codified in a cookbook or role.
 2. **Test Safety Nets**: Look for `.kitchen.yml` within specific `site-cookbooks/<name>` to understand if local integration tests are available.
 3. **No Assumptions**: Do not assume standard test commands. Check `README.md` and repository config files first.
-4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`.
\ No newline at end of file
+4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`.
diff --git a/roles/sockethub-testing.rb b/roles/sockethub-testing.rb
new file mode 100644
index 0000000..df084c1
--- /dev/null
+++ b/roles/sockethub-testing.rb
@@ -0,0 +1,21 @@
+name "sockethub-testing"
+
+default_attributes 'kosmos_redis' => {
+  'requirepass' => false
+},
+'sockethub' => {
+  'about' => {
+    'name'        => 'Sockethub Test Instance',
+    'description' => '',
+    'contact'     => 'ops@kosmos.org',
+    'links'       => [],
+    'showVersion' => true,
+    'showUptime'  => true
+  }
+}
+
+run_list %w(
+  kosmos_redis::default
+  sockethub::default
+  sockethub::firewall
+)
diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index 5f8de4f..e5fa75a 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
-# 0.3.5
+# 0.3.6
 
 - Stop pinning job containers to one shared Docker network. `container.network`
   is empty again, so the runner auto-creates an isolated bridge network per job:
@@ -12,6 +12,30 @@ This file is used to list changes made in each version of the kosmos_gitea cookb
   Docker's default address pool (`172.16.0.0/12`).
 - Remove the now-unused `gitea-actions` network on converge (once idle).
 
+# 0.3.5
+
+- Upgrade Gitea from 28.1.0 to 28.3.0, skipping 28.2.0. Both are maintenance
+  releases with no breaking changes and no `app.ini` changes; no configuration
+  updates were required.
+- Security fixes included: token scope enforcement on many API and web routes
+  (public-only tokens could read private data and, for admins, create
+  administrators), OAuth2 `ACCOUNT_LINKING = auto` account takeover, review
+  triggered Actions workflows running with repository secrets, stored XSS via
+  Actions artifact `Content-Encoding`, SSH certificate principal confusion,
+  OpenID association CSRF, and several private-data leaks in feeds, profiles,
+  project boards and issue timelines.
+- Behavior changes to be aware of (no cookbook change): `git maintenance` now
+  defaults to the `gc` strategy; profile pages treat token requests as
+  anonymous and user/org RSS/Atom feeds require `read:user` /
+  `read:organization`; the API rejects changes to issues, labels, milestones
+  and releases of archived repositories; review-triggered workflows run on the
+  pull request head; the `gitea-vscode` OAuth2 application is pre-registered;
+  email address validation is relaxed to what Go's `mail.ParseAddress` accepts.
+- Upgrade the Gitea Actions runner from 5.2.2 to 5.2.4. No `config.yaml`
+  changes were required. 5.2.4 fixes the v4 artifact API in `exec` mode so
+  `upload-artifact` v4 and later work, and 5.2.3 fixes the action header group,
+  dry runs touching the Docker daemon, and damaged shared action cache trees.
+
 # 0.3.4
 
 - Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index dc38e59..337f061 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "28.1.0"
-node.default["gitea"]["checksum"] = "ea93cfa4a300564ac457d3903469fea49ec5a4da37d0cebaa435f8e329ea64d0"
+node.default["gitea"]["version"] = "28.3.0"
+node.default["gitea"]["checksum"] = "5f834e8f04986f3b9206cf14743b5a6e6996ceddc238dac6409866ebda2a0686"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.2"
-node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63"
+node.default["gitea"]["runner"]["version"] = "5.2.4"
+node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index 2b17f77..7d5bf5a 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.5'
+version '0.3.6'
 chef_version '>= 14.0'
 
 depends "firewall"