diff --git a/postfix-3.5.2.tar.gz b/postfix-3.5.2.tar.gz
deleted file mode 100644
index 24bec1b..0000000
--- a/postfix-3.5.2.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e3bf2497f5bd841d0da99dd8d58afdbc15ff9a66962a60c973df5e850a49bec3
-size 4611518
diff --git a/postfix-3.5.3.tar.gz b/postfix-3.5.3.tar.gz
new file mode 100644
index 0000000..b058bf3
--- /dev/null
+++ b/postfix-3.5.3.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e381089cf2a03105042835776f23489c0a58600a6a6ebc8cb59f5cb1eb4d8d75
+size 4611925
diff --git a/postfix.changes b/postfix.changes
index ac2cd4b..2673c96 100644
--- a/postfix.changes
+++ b/postfix.changes
@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Mon Jun 15 16:09:57 UTC 2020 - Michael Ströder <michael@stroeder.com>
+
+- Update to 3.5.3:
+  * TLS handshake failure in the Postfix SMTP server during SNI
+    processing, after the server-side TLS engine sent a TLSv1.3
+    HelloRetryRequest (HRR) to a remote SMTP client.
+  * The command "postfix tls deploy-server-cert" did not handle a
+    missing optional argument. This bug was introduced in Postfix
+    3.1.
+
 -------------------------------------------------------------------
 Sun May 17 19:57:57 UTC 2020 - Michael Ströder <michael@stroeder.com>
 
diff --git a/postfix.spec b/postfix.spec
index 488a822..c22fd85 100644
--- a/postfix.spec
+++ b/postfix.spec
@@ -53,7 +53,7 @@
 %bcond_with    libnsl
 %endif
 Name:           postfix
-Version:        3.5.2
+Version:        3.5.3
 Release:        0
 Summary:        A fast, secure, and flexible mailer
 License:        IPL-1.0 OR EPL-2.0