diff --git a/libreswan-5.2.tar.gz b/libreswan-5.3.tar.gz
similarity index 36%
rename from libreswan-5.2.tar.gz
rename to libreswan-5.3.tar.gz
index f09f809de2584ef1a08606117211aea1ffc13d85..2b4ede0d768661ec5b43d2e2810191c60f72c463 100644
Binary files a/libreswan-5.2.tar.gz and b/libreswan-5.3.tar.gz differ
diff --git a/libreswan.spec b/libreswan.spec
index 3b8ce3ac938e4b2576fe91a616eb7dd7402ca728..bf7d8a890a25f0a829a94e61f92d3f10762e767d 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -26,7 +26,7 @@
 
 Name: libreswan
 Summary: IKE implementation for IPsec with IKEv1 and IKEv2 support
-Version: 5.2
+Version: 5.3
 Release: 1
 License: GPL-2.0-only
 Url: https://libreswan.org/
@@ -193,6 +193,15 @@ certutil -N -d sql:$tmpdir --empty-password
 %attr(0644,root,root) %doc %{_mandir}/*/*
 
 %changelog
+* Thu Sep 25 2025 Ge Wang <wang__ge@126.com> - 5.3-1
+- Update package to version 5.3
+  - moved cURL and LDAP CRL download code out of pluto
+  - replaced CRL thread with libevent
+  - fixed `ipsec checkcrls`
+  - when configured, use cURL to download LDAP CRLs
+  - verify using NSS's IPsec profile aka certificateUsageIPsec
+  - only verify using certificateUsageSSL{Client,Server} when USE_NSS_TLS_SECURITY_PROFILE
+
 * Mon Apr 21 2025 yaoxin <1024769339@qq.com> - 5.2-1
 - Update to 5.2