diff --git a/.env.sample b/.env.sample
index 3cc1b89..8763e7c 100644
--- a/.env.sample
+++ b/.env.sample
@@ -67,6 +67,11 @@ SECRET_SECRET_KEY_VERSION=v1 # length=64
 # GITEA_ACCOUNT_LINKING=replace-me
 # GITEA_OAUTH2_CLIENT_ENABLED=replace-me
 
+# Lifetime of an OAuth2 refresh token in hours, prolly no need to edit. We
+# were hitting issues with infrequently pushed to repos that were not picked
+# up by drone after a month of inactivity, hence the option.
+# GITEA__oauth2__REFRESH_TOKEN_EXPIRATION_TIME=730
+
 # Indexer (for issue search)
 # GITEA_REPO_INDEXER_ENABLED=false
 # GITEA_ISSUE_INDEXER_TYPE=db
diff --git a/compose.yml b/compose.yml
index 08654cf..123d0c7 100644
--- a/compose.yml
+++ b/compose.yml
@@ -51,6 +51,7 @@ services:
       - GITEA_ALLOWED_USER_VISIBILITY_MODES
       - GITEA_DEFAULT_ORG_VISIBILITY
       - GITEA_REQUIRE_SIGNIN_VIEW
+      - GITEA__oauth2__REFRESH_TOKEN_EXPIRATION_TIME
     volumes:
       - data:/var/lib/gitea
       - config:/etc/gitea
@@ -84,7 +85,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.2.0+1.23.1-rootless
+        - coop-cloud.${STACK_NAME}.version=3.3.0+1.23.1-rootless
 
 
 networks: