diff --git a/CHANGELOG-MOQ.md b/CHANGELOG-MOQ.md
index ac9cc2d0d..8eed2edb6 100644
--- a/CHANGELOG-MOQ.md
+++ b/CHANGELOG-MOQ.md
@@ -6,6 +6,16 @@ covers the parent. Each entry names the parent commit it carries and every
 change the fork carries on top, with its upstream status, so an advisory
 against the parent can be checked against a release.
 
+## 1.3.3
+
+Parent: n0-computer/noq [`1a26a8b0`](https://github.com/n0-computer/noq/commit/1a26a8b064d21e316fe6769f068617975bd8a27b), unchanged since 1.3.0.
+
+- [#26](https://github.com/moq-dev/noq/pull/26) bound the stream and CRYPTO reassembly buffers at 1024 chunks after compaction, closing the connection with `INTERNAL_ERROR` past it ([RUSTSEC-2026-0185](https://rustsec.org/advisories/RUSTSEC-2026-0185.html)). Carries [quinn-rs/quinn#2694](https://github.com/quinn-rs/quinn/pull/2694), [#2789](https://github.com/quinn-rs/quinn/pull/2789), and [#2814](https://github.com/quinn-rs/quinn/pull/2814), matching quinn-proto 0.11.18. Backport of [#25](https://github.com/moq-dev/noq/pull/25). Upstream: [n0-computer/noq#828](https://github.com/n0-computer/noq/pull/828) (open).
+- [#20](https://github.com/moq-dev/noq/pull/20) report a stream reset before its WebTransport header as the reset (`WebTransportError::ReadError`), logged at debug, instead of `UnknownSession` at WARN. `UnknownSession` now means only a session ID mismatch. Backport of [#19](https://github.com/moq-dev/noq/pull/19). Fork-only.
+- [#24](https://github.com/moq-dev/noq/pull/24) keep a `web-transport-moq` session's HTTP/3 control and QPACK streams open until its close capsule is delivered, so browsers see the close code and reason instead of "Connection lost.". Backport of [#23](https://github.com/moq-dev/noq/pull/23). Fork-only.
+
+No API change. A peer that exceeds the reassembly cap is now closed.
+
 ## 1.3.2
 
 Parent: n0-computer/noq [`1a26a8b0`](https://github.com/n0-computer/noq/commit/1a26a8b064d21e316fe6769f068617975bd8a27b), unchanged since 1.3.0.
diff --git a/Cargo.lock b/Cargo.lock
index 53e9d012d..e29a53de8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1876,7 +1876,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq"
-version = "1.3.2"
+version = "1.3.3"
 dependencies = [
  "anyhow",
  "async-executor",
@@ -1919,7 +1919,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq-proto"
-version = "1.3.2"
+version = "1.3.3"
 dependencies = [
  "aes-gcm",
  "arbitrary",
@@ -1959,7 +1959,7 @@ dependencies = [
 
 [[package]]
 name = "moq-noq-udp"
-version = "1.3.2"
+version = "1.3.3"
 dependencies = [
  "cfg_aliases",
  "criterion",
@@ -3531,7 +3531,7 @@ dependencies = [
 
 [[package]]
 name = "web-transport-moq"
-version = "1.3.2"
+version = "1.3.3"
 dependencies = [
  "anyhow",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 83d8390f6..16a594585 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ default-members = ["noq", "noq-proto", "noq-udp", "web-transport-moq", "bench",
 resolver = "2"
 
 [workspace.package]
-version = "1.3.2"
+version = "1.3.3"
 rust-version = "1.88"
 edition = "2024"
 license = "MIT OR Apache-2.0"
diff --git a/noq/Cargo.toml b/noq/Cargo.toml
index c4db3c33c..f3260efd8 100644
--- a/noq/Cargo.toml
+++ b/noq/Cargo.toml
@@ -67,13 +67,13 @@ derive_more = { workspace = true }
 futures-io = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
 pin-project-lite = { workspace = true }
-proto = { package = "moq-noq-proto", path = "../noq-proto", version = "1.3.2", default-features = false }
+proto = { package = "moq-noq-proto", path = "../noq-proto", version = "1.3.3", default-features = false }
 rustls = { workspace = true, optional = true }
 smol = { workspace = true, optional = true }
 thiserror = { workspace = true }
 tracing =  { workspace = true }
 tokio = { workspace = true }
-udp = { package = "moq-noq-udp", path = "../noq-udp", version = "1.3.2", default-features = false, features = ["tracing"] }
+udp = { package = "moq-noq-udp", path = "../noq-udp", version = "1.3.3", default-features = false, features = ["tracing"] }
 
 # Fix minimal dependencies for indirect deps
 async-global-executor = { workspace = true, optional = true }
diff --git a/web-transport-moq/Cargo.toml b/web-transport-moq/Cargo.toml
index d1c5b69bb..4d2e90c88 100644
--- a/web-transport-moq/Cargo.toml
+++ b/web-transport-moq/Cargo.toml
@@ -28,7 +28,7 @@ bytes = "1"
 futures = "0.3"
 http = "1"
 kio = "0.5.4"
-noq = { package = "moq-noq", path = "../noq", version = "1.3.2", default-features = false, features = [
+noq = { package = "moq-noq", path = "../noq", version = "1.3.3", default-features = false, features = [
     "tracing-log",
     "platform-verifier",
     "runtime-tokio",