diff --git a/CHANGELOG b/CHANGELOG
index 2fa1dac3463893a5bd2f59dc1c891deeada10f17..2078e2dc67d112462595097af4fc1384ae359776 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,6 +4,7 @@ v 8.3.0 (unreleased)
   - Add button to automatically merge a merge request when the build succeeds (Zeger-Jan van de Weg)
   - Merge when build succeeds (Zeger-Jan van de Weg)
   - Provide better diagnostic message upon project creation errors (Stan Hu)
+  - Bump devise to 3.5.3 to fix reset token expiring after account creation (Stan Hu)
   - Bump gollum-lib to 4.1.0 (Stan Hu)
   - Fix broken group avatar upload under "New group" (Stan Hu)
   - Update project repositorize size and commit count during import:repos task (Stan Hu)
diff --git a/Gemfile b/Gemfile
index 473770f53e5bc8682e004800e0c024a35b6a37a5..edeab0a9d5da43b239723b560508636d0d9975d9 100644
--- a/Gemfile
+++ b/Gemfile
@@ -18,7 +18,7 @@ gem "mysql2", '~> 0.3.16', group: :mysql
 gem "pg", '~> 0.18.2', group: :postgres
 
 # Authentication libraries
-gem 'devise',                 '~> 3.5.2'
+gem 'devise',                 '~> 3.5.3'
 gem 'devise-async',           '~> 0.9.0'
 gem 'doorkeeper',             '~> 2.2.0'
 gem 'omniauth',               '~> 1.2.2'
diff --git a/Gemfile.lock b/Gemfile.lock
index 37ba22b7ceb394312b5fcdf11d309fbd4ba1848a..c3d7536b6c63e774b52e62f18b4d1316f2bd7b50 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -168,7 +168,7 @@ GEM
       activerecord (>= 3.2.0, < 5.0)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devise (3.5.2)
+    devise (3.5.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 3.2.6, < 5)
@@ -858,7 +858,7 @@ DEPENDENCIES
   d3_rails (~> 3.5.5)
   database_cleaner (~> 1.4.0)
   default_value_for (~> 3.0.0)
-  devise (~> 3.5.2)
+  devise (~> 3.5.3)
   devise-async (~> 0.9.0)
   devise-two-factor (~> 2.0.0)
   diffy (~> 3.0.3)