diff --git a/CHANGELOG.md b/CHANGELOG.md
index f85c96d2e..08589391d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@ Changelog
 
 All notable changes to this project will be documented in this file.
 
-# [4.0.3] - UNRELEASED
+# [4.0.3] - 2023-03-16
 
 ### Added
 
@@ -31,6 +31,11 @@ All notable changes to this project will be documented in this file.
 - Fix incorrect post links in strikes when the account is remote ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/23611))
 - Fix misleading error code when receiving invalid WebAuthn credentials ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/23568))
 
+### Security
+
+- Change user backups to use expiring URLs for download when possible ([Gargron](https://github.com/mastodon/mastodon/pull/24136))
+- Add warning for object storage misconfiguration ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/24137))
+
 ## [4.0.2] - 2022-11-15
 ### Fixed
 
diff --git a/lib/mastodon/version.rb b/lib/mastodon/version.rb
index dc3cbab66..ed4d1defa 100644
--- a/lib/mastodon/version.rb
+++ b/lib/mastodon/version.rb
@@ -13,7 +13,7 @@ module Mastodon
     end
 
     def patch
-      2
+      3
     end
 
     def flags