diff --git a/app.ini b/app.ini
index ce58fb8..2f90fa3 100644
--- a/app.ini
+++ b/app.ini
@@ -369,8 +369,9 @@ PATH = data/git/lfs
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [webhook]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Allowed hosts for webhooks (CIDR list, empty = allow all)
-;ALLOWED_HOST_LIST = external
+;; Allowed hosts for webhooks: since Gitea 28 configured via [security] EGRESS_MODE and
+;; ALLOWED_HOST_LIST (e.g. loopback, private, 192.168.1.0/24:3000, *.example.com:[80|443]).
+;; The former "external" preset has been removed.
 ;;
 ;; Queue length
 ;QUEUE_LENGTH = 1000
@@ -404,6 +405,16 @@ ENABLE_OPENID_SIGNUP = false
 ;;
 ;; Default platform for action plugins: "github" for https://github.com, "self" for current Gitea instance
 DEFAULT_ACTIONS_URL = github
+;;
+;; Days to keep job logs. 0 = keep forever
+;LOG_RETENTION_DAYS = 365
+;;
+;; Default days to keep artifacts (applies to new uploads only). 0 = keep forever
+;ARTIFACT_RETENTION_DAYS = 90
+;;
+;; Days to keep completed runs and everything under them (Gitea 28+). 0 = keep forever
+;; Cleanup runs via [cron.cleanup_action_runs], enabled by default
+;RUN_RETENTION_DAYS = 400
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [packages]
diff --git a/gitea-db.container b/gitea-db.container
index ba96108..4dadc14 100644
--- a/gitea-db.container
+++ b/gitea-db.container
@@ -2,7 +2,7 @@
 Description=Gitea PostgreSQL Database
 
 [Container]
-Image=docker.io/library/postgres:18.1-trixie
+Image=docker.io/library/postgres:18.6-trixie
 ContainerName=gitea-db
 User=1000:1000
 Volume=/var/lib/gitea/postgresql:/var/lib/postgresql:z
diff --git a/gitea.container b/gitea.container
index a437723..950919f 100644
--- a/gitea.container
+++ b/gitea.container
@@ -2,7 +2,7 @@
 Description=Gitea - Git with a cup of tea
 
 [Container]
-Image=docker.io/gitea/gitea:1.27.3-rootless
+Image=docker.io/gitea/gitea:28.2.0-rootless
 ContainerName=gitea
 Pod=gitea.pod
 Volume=/var/lib/gitea:/var/lib/gitea:z
diff --git a/gitea.spec b/gitea.spec
index d93da72..e1ad0dc 100644
--- a/gitea.spec
+++ b/gitea.spec
@@ -1,5 +1,5 @@
 Name:           gitea
-Version:        1.27.3
+Version:        28.2.0
 Release:        1%{?dist}
 Summary:        Gitea - Git with a cup of tea
 License:        MIT
@@ -211,6 +211,10 @@ fi
 %config(noreplace) %{_sysconfdir}/containers/systemd/gitea-db.container.d/credentials.conf
 
 %changelog
+* Tue Oct 20 2026 Zoran Pericic <zpericic@netst.org> - 28.2.0-1
+- Update to 28.2.0
+- Bump gitea-db PostgreSQL image to 18.6-trixie
+
 * Sun Sep 06 2026 Zoran Pericic <zpericic@netst.org> - 1.27.3-1
 - Update to 1.27.3