diff --git a/.versionbot/CHANGELOG.yml b/.versionbot/CHANGELOG.yml
index fe5494d..69aee91 100644
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
@@ -1,3 +1,58 @@
+- commits:
+    - subject: Update layers/meta-balena to 0232d66721fc127cc14e5078bbc811d50b3cf7a4
+      hash: 75b6fc71a69051483d6341b21690b9df4db80a05
+      body: Update layers/meta-balena
+      footer:
+        Changelog-entry: Update layers/meta-balena to 0232d66721fc127cc14e5078bbc811d50b3cf7a4
+        changelog-entry: Update layers/meta-balena to 0232d66721fc127cc14e5078bbc811d50b3cf7a4
+      author: Self-hosted Renovate Bot
+      nested:
+        - commits:
+            - subject: "docs: Explain TPM ownership and possible TPM fill-up with secure boot"
+              hash: 3770f5898cef8fc5ba70276056bf534e8c197186
+              body: >
+                Explain that balenaOS does not take control of the TPM and that
+                it
+
+                is possible to fill all the key slots with enough provisioning cycles.
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Michal Toman <michalt@balena.io>
+                signed-off-by: Michal Toman <michalt@balena.io>
+              author: Michal Toman
+              nested: []
+            - subject: "docs: Recommend BIOS password and no F-key shortcuts with secure boot"
+              hash: 586a46f447f859ec5866a78abddb85e6a2441451
+              body: >
+                We have seen devices that won't change PCR1 hash when a
+                temporary boot
+
+                order override was applied or secure boot was disabled via BIOS setup.
+
+                The implementation of what PCR1 actually measures is very
+
+                device-specific, but many of the risks can be mitigated by setting up
+
+                a BIOS password and disabling F-key shortcuts for interacting with
+
+                the firmware.
+
+
+                [skip ci]
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Michal Toman <michalt@balena.io>
+                signed-off-by: Michal Toman <michalt@balena.io>
+              author: Michal Toman
+              nested: []
+          version: meta-balena-3.0.1
+          title: ""
+          date: 2023-07-04T20:47:23.997Z
+  version: 3.0.1
+  title: ""
+  date: 2023-07-04T22:48:20.668Z
 - commits:
     - subject: Update layers/meta-balena to 05dfed30f590eb14e1721a471262d64e798dea46
       hash: bfb5abfb35dd3c2797c63a83f3ca25bfeda97d43
diff --git a/CHANGELOG.md b/CHANGELOG.md
index da6db0e..9d113b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,22 @@
 Change log
 -----------
 
+# v3.0.1
+## (2023-07-04)
+
+
+<details>
+<summary> Update layers/meta-balena to 0232d66721fc127cc14e5078bbc811d50b3cf7a4 [Self-hosted Renovate Bot] </summary>
+
+> ## meta-balena-3.0.1
+> ### (2023-07-04)
+> 
+> * docs: Explain TPM ownership and possible TPM fill-up with secure boot [Michal Toman]
+> * docs: Recommend BIOS password and no F-key shortcuts with secure boot [Michal Toman]
+> 
+
+</details>
+
 # v3.0.0
 ## (2023-07-04)
 
diff --git a/VERSION b/VERSION
index 56fea8a..13d683c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.0.0
\ No newline at end of file
+3.0.1
\ No newline at end of file