diff --git a/_service b/_service
index 72e4f07..acec261 100644
--- a/_service
+++ b/_service
@@ -4,7 +4,7 @@
     <param name="scm">git</param>
     <param name="submodules">disable</param>
     <param name="exclude">.git</param>
-    <param name="revision">v12.3.2</param>
+    <param name="revision">v12.3.3</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>
     <param name="versionrewrite-pattern">v(.*)</param>
diff --git a/_servicedata b/_servicedata
index 2c72fb8..32630fb 100644
--- a/_servicedata
+++ b/_servicedata
@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/gravitational/teleport</param>
-              <param name="changesrevision">86e7d3484078d4387d1ef9d3b574942763e50448</param></service></servicedata>
\ No newline at end of file
+              <param name="changesrevision">78eb115cc3d62d9b51d225bb8727c80e443bb9c1</param></service></servicedata>
\ No newline at end of file
diff --git a/teleport-12.3.2.obscpio b/teleport-12.3.2.obscpio
deleted file mode 100644
index 8c646b8..0000000
--- a/teleport-12.3.2.obscpio
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:ffc4c189ea33a6bd700318b13be14a08433a77cbfe119e903ff395c65f40d4ac
-size 255759374
diff --git a/teleport-12.3.3.obscpio b/teleport-12.3.3.obscpio
new file mode 100644
index 0000000..6d3ce31
--- /dev/null
+++ b/teleport-12.3.3.obscpio
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8dc164f05cd5b8babc43a1ae0da12ca59457ab923a9babff7c0dea25bdc34938
+size 254922766
diff --git a/teleport.changes b/teleport.changes
index ba3acfd..3d25480 100644
--- a/teleport.changes
+++ b/teleport.changes
@@ -1,3 +1,53 @@
+-------------------------------------------------------------------
+Tue May 09 05:23:00 UTC 2023 - kastl@b1-systems.de
+
+- Update to version 12.3.3:
+  * Release 12.3.3 (#25835)
+  * Fix access to leaf resources (#25694) (#25862)
+  * fix auditlog error (#25843)
+  * [v12] Include teleport-windows-auth in OSS releases (#25846)
+  * make some chatty dynamodb logs trace (#25821)
+  * Update e ref (#25831)
+  * Correct SAML IdP session read permission. (#25798)
+  * Fix Web UI error message when host is offline (#25661)
+  * [v12] Update e ref. (#25812)
+  * [v12] Add `SetFeatures` method to modules (#25653)
+  * add agent config scaling section (#25796)
+  * Update change log to include desktop access fix in 12.3.2
+    (#25793)
+  * [v12] docs: document "and" logic for labels (#25750)
+  * [v12] Log troubleshooting information when InvalidInstanceID
+    errors are found during EC2 discovery (#25641)
+  * [v12] docs: provide instructions on getting enterprise file
+    from new license Teleport Account (#25753)
+  * [v12] WebDiscover: Enroll RDS Databases and Hookup RDS flow
+    (#25604)
+  * Try to fix TestAgentPoolConnectionCount (#24616) (#25695)
+  * Support additional expected instance roles. (#25742)
+  * [v12] Use the GHA base container for Lint (Docs) (#25716)
+  * update eref (#25733)
+  * [v12] Add client compatibility to installation guide (#25685)
+  * [v12] Improve API client connection failure feedback (#25563)
+  * [v12] Refresh the HA guide (#25670)
+  * [v12] docs: fix claims to roles description in access controls
+    reference (#25633)
+  * Ensure useDocumentGateway creates the gateway only on mount
+    (#25626)
+  * [v12] docs: update cloud proxy service architecture language
+    (#25724)
+  * [v12] docs: move docs links from absolute to relative (#25736)
+  * [v12] use "google.golang.org/protobuf" to clone protobuf
+    messages (#25714)
+  * refactor theme in v12 (#25650)
+  * Add UserGroups to RequestableResourceKinds. (#25708)
+  * Don't report usage for KubeServiceV2 keepalives (#25656)
+  * docs: mention Machine ID where tctl auth sign is used (#25610)
+  * [v12] Update e-ref and icomoon library (#25665)
+  * backport missing deps (#25662)
+  * Update role-templates.mdx (#25628)
+  * Reuse auth connection for Okta client (#25622) (#25646)
+  * [v12] WebDiscover: Enroll aws integrations (#25594)
+
 -------------------------------------------------------------------
 Fri May 05 05:09:38 UTC 2023 - kastl@b1-systems.de
 
diff --git a/teleport.obsinfo b/teleport.obsinfo
index 0418935..f31e7f5 100644
--- a/teleport.obsinfo
+++ b/teleport.obsinfo
@@ -1,4 +1,4 @@
 name: teleport
-version: 12.3.2
-mtime: 1683229037
-commit: 86e7d3484078d4387d1ef9d3b574942763e50448
+version: 12.3.3
+mtime: 1683593527
+commit: 78eb115cc3d62d9b51d225bb8727c80e443bb9c1
diff --git a/teleport.spec b/teleport.spec
index a5c8f4a..5f260ad 100644
--- a/teleport.spec
+++ b/teleport.spec
@@ -19,7 +19,7 @@
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
 Name:           teleport
-Version:        12.3.2
+Version:        12.3.3
 Release:        0
 Summary:        Identity-aware, multi-protocol access proxy
 License:        Apache-2.0
diff --git a/vendor.tar.gz b/vendor.tar.gz
index dfe8406..3483fe6 100644
--- a/vendor.tar.gz
+++ b/vendor.tar.gz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f260ecaa9a67a4e5428ffc07c743523bd1e0a600ca35bb633f63047003bc60ef
-size 29208140
+oid sha256:fe9495381a708a50b9d2dfbb33caec315a6ab41168b0e3533d5b0902850b4f7c
+size 29223810