diff --git a/ChangeLog b/ChangeLog
index 5ae0b22..96bca31 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+06/24/2024
+- release 3.5.0; fixes https://github.com/OpenIDC/ngx_oauth2_module/security/advisories/GHSA-pvq3-8rvg-f36q
+
 06/20/2024
 - implement OAuth2Require with liboauth2_nginx >= 1.6.3
 - bump to 3.5.0dev
diff --git a/configure.ac b/configure.ac
index 5e63835..0130437 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([ngx_oauth2_module],[3.5.0dev],[hans.zandbelt@openidc.com])
+AC_INIT([ngx_oauth2_module],[3.5.0],[hans.zandbelt@openidc.com])
 
 AM_INIT_AUTOMAKE([foreign no-define subdir-objects])
 AC_CONFIG_MACRO_DIRS([m4])