diff --git a/compose.yml b/compose.yml
index 0b4f955..269021a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -87,7 +87,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.6.7+1.27.3-rootless
+        - coop-cloud.${STACK_NAME}.version=3.6.8+28.0.0-rootless
 
 
 networks:
diff --git a/release/3.6.8+28.0.0-rootless b/release/3.6.8+28.0.0-rootless
new file mode 100644
index 0000000..1c44d41
--- /dev/null
+++ b/release/3.6.8+28.0.0-rootless
@@ -0,0 +1 @@
+ git egress has been reworked. ALLOWED_DOMAINS / BLOCKED_DOMAINS / ALLOW_LOCALNETWORKS are deprecated (migrated to [security] ALLOWED_HOST_LIST / BLOCKED_HOST_LIST) Operators who restrict git egress must switch to EGRESS_MODE = strict + explicit CIDRs to keep a deny-by-default policy.
\ No newline at end of file