diff --git a/_service b/_service
index 125eb52..7c9dc84 100644
--- a/_service
+++ b/_service
@@ -4,7 +4,7 @@
     <param name="scm">git</param>
     <param name="submodules">disable</param>
     <param name="exclude">.git</param>
-    <param name="revision">v14.3.0</param>
+    <param name="revision">v14.3.3</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">disable</param>
     <param name="versionrewrite-pattern">v(.*)</param>
diff --git a/teleport-14.3.0.obscpio b/teleport-14.3.0.obscpio
deleted file mode 100644
index 16701ae..0000000
--- a/teleport-14.3.0.obscpio
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:0817fe3200fbf91fe8ff7b9a0560ffdfd9e4ff2f0f22259f476f8ab5ad7d78a3
-size 242148366
diff --git a/teleport-14.3.3.obscpio b/teleport-14.3.3.obscpio
new file mode 100644
index 0000000..0e8ad62
--- /dev/null
+++ b/teleport-14.3.3.obscpio
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d83d1feb7ca3835142dd071f9ba671c61f6659745a769fe8f8d1d5991c569a74
+size 243041294
diff --git a/teleport.changes b/teleport.changes
index fe8cbc8..d71edca 100644
--- a/teleport.changes
+++ b/teleport.changes
@@ -1,3 +1,67 @@
+-------------------------------------------------------------------
+Mon Jan 15 19:15:12 UTC 2024 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- update to 14.3.3:
+  * Fixed routing to nodes by their public addresses. #36624
+  * Enhanced Kubernetes app discovery functionality to provide the
+    ability to disable specific Service imports and configure the
+    TLS Skip Verify option using an annotation. #36611
+  * Added client remote IP address to some administrative audit
+    events. #36567
+
+-------------------------------------------------------------------
+Mon Jan 15 19:09:24 UTC 2024 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- update to 14.3.2:
+  * Fixed routing to nodes by their public address. #36591
+  * Verify MFA device locks during user authentication. #36589
+  * Fixed tctl get access_list and support creating Access Lists
+    without a next audit date. #36572
+
+-------------------------------------------------------------------
+Mon Jan 15 17:06:20 UTC 2024 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- update to 14.3.1:
+  * Added support to select database roles from tsh. #36528
+  * Fixed goroutine leak per ssh session. #36511
+  * Fixed user invites preventing listing tokens. #36492
+  * Updated Go to v1.21.6. #36478
+  * Fixed refresh_identity = true preventing Access Plugins
+    connecting to Teleport using TLS routing with a L7 LB. #36469
+  * Added --callback flag to tsh login. #36468
+  * Added auto-enrolling capabilities to RDS discover flow in the
+    web UI. #36434
+  * Fixed an issue where bad cache state could cause spurious
+    access denied errors during app access. #36432
+  * Resources named . and .. are no longer allowed. Please review
+    the resources in your Teleport instance and rename any
+    resources with these names before upgrading. #36404
+  * Ensured that the login time is populated for app sessions.
+    #36373
+  * Fixed incorrect report of user's IP address in Kubernetes Audit
+    Logs. #36346
+  * Access lists and associated resources are now cached, which
+    should significantly reduce the impact of access list
+    calculation. #36331
+  * Added new certificate extensions and usage reporting flags to
+    explicitly identify Machine ID bots and their cluster activity.
+    #36313
+  * Fixed potential panic after backend watcher failure. #36301
+  * Prevent deleted users from using account reset links created
+    prior to the user being deleted. #36271
+  * Make Unified Resources page in Web UI responsive. #36265
+  * Added "Database Roles" column to tsh db ls -v. #36246
+  * Safeguard against the disruption of cluster access caused by
+    incorrect Kubernetes APIService configurations. #36227
+  * Support running a version server in the proxy for automatic
+    agent upgrades. #36220
+  * The user login state generator now uses the cache, which should
+    reduce the number of calls to the backend. #36196
+  * Added the --insecure-no-resolve-image flag to the
+    teleport-kube-agent-updater to disable image tag resolution if
+    it cannot pull the image. #36097
+  * Added future assume time to access requests. #35726
+
 -------------------------------------------------------------------
 Sun Jan  7 18:18:50 UTC 2024 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
 
diff --git a/teleport.obsinfo b/teleport.obsinfo
index d7a5fee..c973ade 100644
--- a/teleport.obsinfo
+++ b/teleport.obsinfo
@@ -1,4 +1,4 @@
 name: teleport
-version: 14.3.0
-mtime: 1703891334
-commit: 390d33c42bbe52f4bde6302bfbffccfeeb30ff29
+version: 14.3.3
+mtime: 1705078875
+commit: 542fbb04b39d300d9852e5c61dac34124f7ff078
diff --git a/teleport.spec b/teleport.spec
index 0676433..9952a7c 100644
--- a/teleport.spec
+++ b/teleport.spec
@@ -19,7 +19,7 @@
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
 Name:           teleport
-Version:        14.3.0
+Version:        14.3.3
 Release:        0
 Summary:        Identity-aware, multi-protocol access proxy
 License:        Apache-2.0
diff --git a/vendor.tar.gz b/vendor.tar.gz
index 8ef77ee..d968e1d 100644
--- a/vendor.tar.gz
+++ b/vendor.tar.gz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:2e17ddbdbf63d0e8487759cd5334f7bd5715ded26bafd98b91662d503509fbdc
-size 40440309
+oid sha256:e01657727dab41d63de8b00644c37d29b4a4579170eff1b0f1094d1d797bfc6d
+size 42717361