diff --git a/pacemaker.spec b/pacemaker.spec
index d0e06e6..3e7df07 100644
--- a/pacemaker.spec
+++ b/pacemaker.spec
@@ -41,10 +41,10 @@
 ## can be incremented to build packages reliably considered "newer"
 ## than previously built packages with the same pcmkversion)
 %global pcmkversion 3.0.0
-%global specversion 2
+%global specversion 3
 
 ## Upstream commit (full commit ID, abbreviated commit ID, or tag) to build
-%global commit 394d77ec985ff289f0661f996a45052b7fbf0f2c
+%global commit 4ae3a303e589ed47634890aab5dd955186b5ec02
 
 ## Since git v2.11, the extent of abbreviation is autoscaled by default
 ## (used to be constant of 7), so we need to convey it for non-tags, too.
@@ -791,6 +791,17 @@ exit 0
 %{_datadir}/pkgconfig/pacemaker-schemas.pc
 
 %changelog
+* Thu Dec 12 2024 Chris Lumens <clumens@redhat.com> - 3.0.0-3
+- Rebase on upstream 3.0.0-rc2
+- Support X.509 certificates for Pacemaker Remote connections and remote
+  CIB administration
+- Fix ability to do rolling upgrades (regression introduced in 3.0.0-rc1)
+- Fix memory leaks in daemons (regressions introduced in 3.0.0-rc1)
+- Ensure ACLs remain valid after CIB upgrades (regression introduced in
+  3.0.0-rc1)
+- Related: RHEL-61383
+- Resolves: RHEL-7600
+
 * Mon Nov 18 2024 Chris Lumens <clumens@redhat.com> - 3.0.0-2
 - Rebase on upstream 3.0.0-rc1
 - Default globally-unique to true when clone-node-max > 1
diff --git a/sources b/sources
index ac9bc49..21c2111 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (pacemaker-394d77ec9.tar.gz) = 4f227cee13046d5eca708008efe86ed745614f9e0e958412094d519e4fc09e5ca2c1d130fd3c055b9ed37c1b6469979fca3c5358f5a839fecccd9ef032f73b08
+SHA512 (pacemaker-4ae3a303e.tar.gz) = 3715efbf45ee4b0b611984ff6e33b77c38362f242e5ae4d65549251f99921fa61b1456e5cfe5cc2f3dd5a6a0907a6e46e16ec35e19ce3a8d1f4db1092a29d619