diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index e5fa75a..9c3bdb9 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,24 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.7
+
+- Upgrade the Gitea Actions runner from 5.2.4 to 5.4.0. No `config.yaml` changes
+  were required.
+- 5.3.0 scopes cache entries by ref, like GitHub: a job restores from its own
+  ref, then the base branch, then the repository's default branch, and writes
+  only to its own ref. Existing (unscoped) caches therefore start out cold once
+  after this upgrade. 5.3.0 also adds `GITEA_*` aliases for the built-in
+  `GITHUB_*` environment variables and updates dependencies for
+  CVE-2026-78661.
+- 5.4.0 adds Windows and FreeBSD support, `runner.ca_file` for trusting a
+  private CA, and `container.volumes`; it signs release checksums and fixes
+  large cache uploads, concurrent Dockerfile actions, and git-lfs checkouts on
+  git-lfs versions before 3.8.0.
+- This re-establishes 5.4.0 on gitea-2, which had been downgraded back to 5.2.2
+  by a converge from a branch that predated the previous upgrade. Gitea reports
+  the runner version sent on each heartbeat, so the runners update on restart.
+
 # 0.3.6
 
 - Stop pinning job containers to one shared Docker network. `container.network`
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index 337f061..d9fcca5 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.4"
-node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
+node.default["gitea"]["runner"]["version"] = "5.4.0"
+node.default["gitea"]["runner"]["checksum"] = "9c790a1ca58d1f80872146043fecec3a2b03c4739bc87d5cdf9a63e4f8d88abe"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index 7d5bf5a..866dced 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.6'
+version '0.3.7'
 chef_version '>= 14.0'
 
 depends "firewall"