diff --git a/pacemaker.spec b/pacemaker.spec
index 97087aa..f519756 100644
--- a/pacemaker.spec
+++ b/pacemaker.spec
@@ -40,11 +40,11 @@
 ## Upstream pacemaker version, and its package version (specversion
 ## can be incremented to build packages reliably considered "newer"
 ## than previously built packages with the same pcmkversion)
-%global pcmkversion 3.0.2
+%global pcmkversion 3.0.3
 %global specversion 1
 
 ## Upstream commit (full commit ID, abbreviated commit ID, or tag) to build
-%global commit 6629f2e0e672280ca765324858f245fdcd85f22d
+%global commit e64afeb692726439b2c8b1df57fc5533cb1634dd
 
 ## Since git v2.11, the extent of abbreviation is autoscaled by default
 ## (used to be constant of 7), so we need to convey it for non-tags, too.
@@ -791,6 +791,17 @@ exit 0
 %{_datadir}/pkgconfig/pacemaker-schemas.pc
 
 %changelog
+* Fri Jul 10 2026 Chris Lumens <clumens@redhat.com> - 3.0.3-1
+- Rebase on upstream 3.0.3-rc1
+- Fix integer overflows in remote message decompression code (CVE-2026-10649)
+- Fix a bug preventing the ClusterMon resource from starting
+- Support UTF-8 characters in the cibsecret tool
+- Allow modifying the status section of the CIB without triggering refresh
+- Resolves: RHEL-181155
+- Resolves: RHEL-184531
+- Resolves: RHEL-178864
+- Resolves: RHEL-70283
+
 * Tue May 12 2026 Chris Lumens <clumens@redhat.com> - 3.0.2-1
 - Rebase on upstream 3.0.2-rc2
 - Don't hang waiting on certain pending monitor actions
diff --git a/sources b/sources
index 9b4a289..6e6f0db 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (pacemaker-6629f2e0e.tar.gz) = 242ad2aefcd4f0f435b39a0806a862b2888ee5b875977a1358338036bb6e7d8180692fb4ece30a69ce63d03d51acefde812f86169a28f06b9c05a1464454b588
+SHA512 (pacemaker-e64afeb69.tar.gz) = 77ad819885163fae2861559edfd23127baac50454279ca0b3bacfb7192375142e61d3f79115d7ba36777af8d4340ec8f988f5be88cbd20c4f924d29fc2597f8e