diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5600ebd4..e390ab0ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2025-04-30
+
+> Mr. President, we must not allow a mine shaft gap!
+
+### Fixed
+ * Removed preemptive "full access to cgroups" warning when calling `runc
+   pause` or `runc unpause` as an unprivileged user without
+   `--systemd-cgroups`. Now the warning is only emitted if an actual permission
+   error was encountered. (#4709)
+ * Several fixes to our CI, mainly related to AlmaLinux and CRIU. (#4670,
+   #4728, #4736)
+
+### Changed
+ * In runc 1.2, we changed our mount behaviour to correctly handle clearing
+   flags. However, the error messages we returned did not provide as much
+   information to users about what clearing flags were conflicting with locked
+   mount flags. We now provide more diagnostic information if there is an error
+   when in the fallback path to handle locked mount flags. (#4734)
+ * Upgrade our CI to use golangci-lint v2.0. (#4692)
+ * `runc version` information is now filled in using `//go:embed` rather than
+   being set through `Makefile`. This allows `go install` or other non-`make`
+   builds to contain the correct version information. Note that `make
+   EXTRA_VERSION=...` still works. (#418)
+ * Remove `exclude` directives from our `go.mod` for broken `cilium/ebpf`
+   versions. `v0.17.3` resolved the issue we had, and `exclude` directives are
+   incompatible with `go install`. (#4748)
+
+## [1.3.0-rc.2] - 2025-04-10
+
+> Eppur si muove.
+
+### Fixed
+ * Use the container's `/etc/passwd` to set the `HOME` env var. After a refactor
+   for 1.3, we were setting it reading the host's `/etc/passwd` file instead.
+   (#4693, #4688)
+ * Override `HOME` env var if it's set to the empty string. This fixes a
+   regression after the same refactor for 1.3 and aligns the behavior with older
+   versions of runc. (#4711)
+ * Add time namespace to container config after checkpoint/restore. CRIU since
+   version 3.14 uses a time namespace for checkpoint/restore, however it was not
+   joining the time namespace in runc. (#4705)
+
 ## [1.3.0-rc.1] - 2025-03-04
 
 > No tengo miedo al invierno, con tu recuerdo lleno de sol.
@@ -1083,4 +1125,7 @@ implementation (libcontainer) is *not* covered by this policy.
 [1.2.0-rc.1]: https://github.com/opencontainers/runc/compare/v1.1.0...v1.2.0-rc.1
 
 <!-- 1.3.z patch releases -->
+[Unreleased 1.3.z]: https://github.com/opencontainers/runc/compare/v1.3.0...release-1.3
+[1.3.0]: https://github.com/opencontainers/runc/compare/v1.3.0-rc.2...v1.3.0
+[1.3.0-rc.2]: https://github.com/opencontainers/runc/compare/v1.3.0-rc.1...v1.3.0-rc.2
 [1.3.0-rc.1]: https://github.com/opencontainers/runc/compare/v1.2.0...v1.3.0-rc.1