diff --git a/.gitignore b/.gitignore
index 4be56c5..5d58fa5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,7 @@
 /undici-5.28.1-nm-prod.tgz
 /undici-5.28.1-nm-dev.tgz
 /undici-5.28.1-bundled-licenses.txt
+/undici-5.28.3-stripped.tar.gz
+/undici-5.28.3-nm-prod.tgz
+/undici-5.28.3-nm-dev.tgz
+/undici-5.28.3-bundled-licenses.txt
diff --git a/0002-chore-refine-esbuild-node-detection.patch b/0002-chore-refine-esbuild-node-detection.patch
new file mode 100644
index 0000000..c72e61c
--- /dev/null
+++ b/0002-chore-refine-esbuild-node-detection.patch
@@ -0,0 +1,58 @@
+From b285b94aa4a9f4a03524a3af71865666b4683e6d Mon Sep 17 00:00:00 2001
+From: Zephyr Lykos <git@mochaa.ws>
+Date: Wed, 31 Jan 2024 15:26:16 +0800
+Subject: [PATCH] chore: refine esbuild & node detection
+
+When using the loader for external builtins, `esbuildDetection` is
+undefined. This commit defines `__UNDICI_IS_NODE__` on `globalThis`
+in the loader and deletes it after loading Undici. `esbuildDetection`
+has also been extracted as a variable at the top level of the module,
+to support deleting `__UNDICI_IS_NODE__` on `globalThis` to avoid
+polluting the global namespace.
+---
+ build/wasm.js      | 2 ++
+ lib/fetch/index.js | 8 ++++++--
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/build/wasm.js b/build/wasm.js
+index 1104cfec..cd227256 100644
+--- a/build/wasm.js
++++ b/build/wasm.js
+@@ -101,6 +101,8 @@ if (EXTERNAL_PATH) {
+   writeFileSync(join(ROOT, 'loader.js'), `
+ 'use strict'
+ 
++globalThis.__UNDICI_IS_NODE__ = true
+ module.exports = require('node:module').createRequire('${EXTERNAL_PATH}/loader.js')('./index-fetch.js')
++delete globalThis.__UNDICI_IS_NODE__
+ `)
+ }
+diff --git a/lib/fetch/index.js b/lib/fetch/index.js
+index dea20696..52129884 100644
+--- a/lib/fetch/index.js
++++ b/lib/fetch/index.js
+@@ -64,6 +64,10 @@ const { webidl } = require('./webidl')
+ const { STATUS_CODES } = require('http')
+ const GET_OR_HEAD = ['GET', 'HEAD']
+ 
++const defaultUserAgent = typeof __UNDICI_IS_NODE__ !== 'undefined' || typeof esbuildDetection !== 'undefined'
++  ? 'node'
++  : 'undici'
++
+ /** @type {import('buffer').resolveObjectURL} */
+ let resolveObjectURL
+ let ReadableStream = globalThis.ReadableStream
+@@ -1352,8 +1356,8 @@ async function httpNetworkOrCacheFetch (
+   //    14. If httpRequest’s header list does not contain `User-Agent`, then
+   //    user agents should append `User-Agent`/default `User-Agent` value to
+   //    httpRequest’s header list.
+-  if (!httpRequest.headersList.contains('user-agent')) {
+-    httpRequest.headersList.append('user-agent', typeof esbuildDetection === 'undefined' ? 'undici' : 'node')
++  if (!httpRequest.headersList.contains('user-agent', true)) {
++    httpRequest.headersList.append('user-agent', defaultUserAgent)
+   }
+ 
+   //    15. If httpRequest’s cache mode is "default" and httpRequest’s header
+-- 
+2.43.0
+
diff --git a/nodejs-undici.spec b/nodejs-undici.spec
index c85504a..e68b77d 100644
--- a/nodejs-undici.spec
+++ b/nodejs-undici.spec
@@ -6,7 +6,7 @@
 
 Name:       nodejs-%{npm_name}
 Summary:    An HTTP/1.1 client, written from scratch for Node.js
-Version:    5.28.1
+Version:    5.28.3
 Release:    %autorelease
 
 License:    MIT
@@ -19,8 +19,9 @@ Source3:    %{npm_name}-%{version}-bundled-licenses.txt
 Source4:    %{npm_name}-sources.sh
 
 # Upstream proposal: https://github.com/nodejs/undici/pull/2403
-Patch:      0001-feat-allow-customization-of-build-environment.patch
-Patch:      0002-Support-building-for-externally-shared-js-builtins-2.patch
+Patch0:     0001-feat-allow-customization-of-build-environment.patch
+Patch1:     0002-Support-building-for-externally-shared-js-builtins-2.patch
+Patch2:     0002-chore-refine-esbuild-node-detection.patch
 
 # Binary artifacts in this package are aimed at the wasm32-wasi "architecture".
 %global     _binaries_in_noarch_packages_terminate_build 0
diff --git a/sources b/sources
index 4fa4912..d8d7149 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-SHA512 (undici-5.28.1-stripped.tar.gz) = 0224b75e48e36afb77ecce11ab7522a9694840fb44623262a7cc0bc4a44f7599f754495fc60ea3e999fc8919219c10828441967cc71e1baa4ff26a635ae44f44
-SHA512 (undici-5.28.1-nm-prod.tgz) = cb830d0be6a43b7949c069766edeefde6d7b181e5016274dc726bc77e065e265fe0d72fe05da697ea00b311658cbfd2186ab134bdf114086abd045d5cb32e966
-SHA512 (undici-5.28.1-nm-dev.tgz) = be64fb863f21befdbe82723ba37f058161987044b731c8fa1568282e0ccb1856c879522a2b45337fe8b26dfca513c1337cacb8fb93092ec463614533abb0748d
-SHA512 (undici-5.28.1-bundled-licenses.txt) = 3e591adb16e09b1c6fb75eb97a6ac51cd06e0aeae2bd5950a15902346e2c9626cb50203bfd0e15c7e8c98af8f24b81c1ce6617c359e7c0e7d0a6366457c844ba
+SHA512 (undici-5.28.3-stripped.tar.gz) = 8ac2c4737694760d6ef42f807ffa6ea84970bfd45a352f88b04b2d4453aca63060d01b8fd07bc34dcf6ec57979be5e499bb1d874f1f5b7de22bf01f518d273d2
+SHA512 (undici-5.28.3-nm-prod.tgz) = 2cf834e47f9a30b961ba736c9db687d5840659af04521dca9e07ede8233ab6b2383180b175549aca5ce060e4f7d0fb57fe9ada010a65f0ce1c67eae0c6fe5ccc
+SHA512 (undici-5.28.3-nm-dev.tgz) = fb00684428f0a71b5cd4350baec98425cf48b78b6ca26b89ecf29b5c9313a119612adb10b06845be898484e4ec0515c791f189af4986e61a276e3ad9cf27ab2b
+SHA512 (undici-5.28.3-bundled-licenses.txt) = 3e591adb16e09b1c6fb75eb97a6ac51cd06e0aeae2bd5950a15902346e2c9626cb50203bfd0e15c7e8c98af8f24b81c1ce6617c359e7c0e7d0a6366457c844ba