diff --git a/_service b/_service
index f6dddfb..47c9a1c 100644
--- a/_service
+++ b/_service
@@ -3,8 +3,8 @@
     <param name="url">https://github.com/docker/docker-ce.git</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="versionformat">19.03.2_ce_%h</param>
-    <param name="revision">v19.03.2</param>
+    <param name="versionformat">19.03.3_ce_%h</param>
+    <param name="revision">v19.03.3</param>
     <param name="filename">docker</param>
   </service>
   <service name="recompress" mode="disabled">
diff --git a/docker-19.03.2_ce_6a30dfca0366.tar.xz b/docker-19.03.2_ce_6a30dfca0366.tar.xz
deleted file mode 100644
index c151b62..0000000
--- a/docker-19.03.2_ce_6a30dfca0366.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:6c31df0bc4328d4a3977d1dc30ed3c67a234debcfb5087c9801cb00fe4f25847
-size 9986852
diff --git a/docker-19.03.3_ce_a872fc2f86c0.tar.xz b/docker-19.03.3_ce_a872fc2f86c0.tar.xz
new file mode 100644
index 0000000..95f5402
--- /dev/null
+++ b/docker-19.03.3_ce_a872fc2f86c0.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7ffbec5b3947c9e08b0a5d5889628737e8bc898b4cb8c1e72bcc528bc3eb4ed4
+size 10087728
diff --git a/docker.changes b/docker.changes
index 8d1953a..57a2b66 100644
--- a/docker.changes
+++ b/docker.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Oct  8 21:47:56 UTC 2019 - Aleksa Sarai <asarai@suse.com>
+
+- Drop containerd.service workaround (we've released enough versions without
+  containerd.service -- there's no need to support package upgrades that old).
+- Update to Docker 19.03.3-ce. See upstream changelog in the packaged
+  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1153367
+
 -------------------------------------------------------------------
 Tue Oct  1 23:54:25 UTC 2019 - Aleksa Sarai <asarai@suse.com>
 
diff --git a/docker.spec b/docker.spec
index 4ce4050..020eadd 100644
--- a/docker.spec
+++ b/docker.spec
@@ -42,17 +42,17 @@
 # helpfully injects into our build environment from the changelog). If you want
 # to generate a new git_commit_epoch, use this:
 #  $ date --date="$(git show --format=fuller --date=iso $COMMIT_ID | grep -oP '(?<=^CommitDate: ).*')" '+%s'
-%define git_version 6a30dfca0366
-%define git_commit_epoch 1567053734
+%define git_version a872fc2f86c0
+%define git_commit_epoch 1570493609
 
 # These are the git commits required. We verify them against the source to make
 # sure we didn't miss anything important when doing upgrades.
-%define required_containerd 894b81a4b802e4eb2a91d1ce216b8817763c29fb
-%define required_dockerrunc 425e105d5a03fabd737a126ad93d62a9eeede87f
-%define required_libnetwork fc5a7d91d54cc98f64fc28f9e288b46a0bee756c
+%define required_containerd b34a5c8af56e510852c35414db4c1f4fa6172339
+%define required_dockerrunc 3e425f80a8c931f88e6d94a8c831b9d5aa481657
+%define required_libnetwork 45c710223c5fbf04dc3028b9a90b51892e36ca7f
 
 Name:           %{realname}%{name_suffix}
-Version:        19.03.2_ce
+Version:        19.03.3_ce
 Release:        0
 Summary:        The Moby-project Linux container runtime
 License:        Apache-2.0
@@ -352,7 +352,7 @@ grep 'LIBNETWORK_COMMIT=%{required_libnetwork}' hack/dockerfile/install/proxy.in
 %install
 install -d %{buildroot}%{_bindir}
 install -D -m755 components/cli/build/docker %{buildroot}/%{_bindir}/docker
-install -D -m755 components/engine/bundles/latest/dynbinary-daemon/dockerd %{buildroot}/%{_bindir}/dockerd
+install -D -m755 components/engine/bundles/dynbinary-daemon/dockerd %{buildroot}/%{_bindir}/dockerd
 install -d %{buildroot}/%{_localstatedir}/lib/docker
 install -Dd -m 0755 \
 	%{buildroot}%{_sysconfdir}/init.d \
@@ -432,17 +432,6 @@ grep -q '^dockremap:' /etc/sub{uid,gid} || \
 %service_add_post %{realname}.service
 %{fillup_only -n docker}
 
-# NOTE: This is a pretty hacky way of getting around the fact we've removed
-#       containerd.service and now everything is spawned underneath Docker. In
-#       order to force containerd.service to be stopped on the upgrade we need
-#       to trick the systemd macros into thinking that this is an "uninstall".
-#       Hopefully we can remove this soon.
-(
-	FIRST_ARG=0
-	%service_del_preun containerd.service containerd.socket
-	%service_del_postun containerd.service containerd.socket
-)
-
 %if "%flavour" == "kubic"
 %post kubeadm-criconfig
 %fillup_only -n kubelet