diff --git a/apps/wave-0/gitea.yaml b/apps/wave-0/gitea.yaml
index f9b4a5d..78841ba 100644
--- a/apps/wave-0/gitea.yaml
+++ b/apps/wave-0/gitea.yaml
@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.3
+        image: gitea/gitea:1.27.3
         ports:
         - containerPort: 3000
         env:
diff --git a/catalog/gitea.yaml b/catalog/gitea.yaml
index 834ea99..943c773 100644
--- a/catalog/gitea.yaml
+++ b/catalog/gitea.yaml
@@ -10,7 +10,7 @@
 name: gitea
 kind: container
 source:
-  image: gitea/gitea:1.24.3     # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: gitea/gitea:1.27.3     # pinned recent stable tag (R-UPD-01); update.range governs advancement
 # Headless-install bootstrap (formerly apps/gitea-bootstrap-patch.yaml; now first-class via the
 # ServiceDefinition env/envFrom/lifecycle fields, schema >=1.2.0). Gitea must come up INSTALLED
 # without the interactive web wizard and with a FIXED, persistent SECRET_KEY, so all of this is