diff --git a/.github/workflows/integrate.yaml b/.github/workflows/integrate.yaml
index 90a5150b..bedc9be5 100644
--- a/.github/workflows/integrate.yaml
+++ b/.github/workflows/integrate.yaml
@@ -147,7 +147,7 @@ jobs:
 
     env:
       COMPOSER_NORMALIZE_PHAR: ".build/phar/composer-normalize.phar"
-      COMPOSER_VERSION: "2.3.8"
+      COMPOSER_VERSION: "2.3.9"
 
     steps:
       - name: "Checkout"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1b672554..072f12b2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,7 +24,7 @@ jobs:
     env:
       COMPOSER_NORMALIZE_PHAR: ".build/phar/composer-normalize.phar"
       COMPOSER_NORMALIZE_PHAR_SIGNATURE: ".build/phar/composer-normalize.phar.asc"
-      COMPOSER_VERSION: "2.3.8"
+      COMPOSER_VERSION: "2.3.9"
       GPG_KEYS: ".build/phar/keys.asc"
       GPG_KEYS_ENCRYPTED: "phar/keys.asc.gpg"
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57afda47..b921848b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## Unreleased
 
-For a full diff see [`2.28.2...main`][2.28.2...main].
+For a full diff see [`2.28.3...main`][2.28.3...main].
+
+## [`2.28.3`][2.28.3]
+
+For a full diff see [`2.28.2...2.28.3`][2.28.2...2.28.3].
+
+### Fixed
+
+- Required `composer/composer:2.3.9` for compiling `composer-normalize.phar` ([#942]), by [@localheinz]
 
 ## [`2.28.2`][2.28.2]
 
@@ -781,6 +789,7 @@ For a full diff see [`81bc3a8...0.1.0`][81bc3a8...0.1.0].
 [2.28.0]: https://github.com/ergebnis/composer-normalize/releases/tag/2.28.0
 [2.28.1]: https://github.com/ergebnis/composer-normalize/releases/tag/2.28.1
 [2.28.2]: https://github.com/ergebnis/composer-normalize/releases/tag/2.28.2
+[2.28.3]: https://github.com/ergebnis/composer-normalize/releases/tag/2.28.3
 
 [81bc3a8...0.1.0]: https://github.com/ergebnis/composer-normalize/compare/81bc3a8...0.1.0
 [0.1.0...0.2.0]: https://github.com/ergebnis/composer-normalize/compare/0.1.0...0.2.0
@@ -857,7 +866,8 @@ For a full diff see [`81bc3a8...0.1.0`][81bc3a8...0.1.0].
 [2.27.0...2.28.0]: https://github.com/ergebnis/composer-normalize/compare/2.27.0...2.28.0
 [2.28.0...2.28.1]: https://github.com/ergebnis/composer-normalize/compare/2.28.0...2.28.1
 [2.28.1...2.28.2]: https://github.com/ergebnis/composer-normalize/compare/2.28.1...2.28.2
-[2.28.2...main]: https://github.com/ergebnis/composer-normalize/compare/2.28.2...main
+[2.28.2...2.28.4]: https://github.com/ergebnis/composer-normalize/compare/2.28.2...2.28.3
+[2.28.3...main]: https://github.com/ergebnis/composer-normalize/compare/2.28.3...main
 
 [#1]: https://github.com/ergebnis/composer-normalize/pull/1
 [#2]: https://github.com/ergebnis/composer-normalize/pull/2
@@ -967,6 +977,7 @@ For a full diff see [`81bc3a8...0.1.0`][81bc3a8...0.1.0].
 [#933]: https://github.com/ergebnis/composer-normalize/pull/933
 [#938]: https://github.com/ergebnis/composer-normalize/pull/938
 [#941]: https://github.com/ergebnis/composer-normalize/pull/941
+[#942]: https://github.com/ergebnis/composer-normalize/pull/942
 
 [@core23]: https://github.com/core23
 [@dependabot]: https://github.com/dependabot
diff --git a/Makefile b/Makefile
index 923c73da..29089c43 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-COMPOSER_VERSION:=2.3.8
+COMPOSER_VERSION:=2.3.9
 
 .PHONY: it
 it: coding-standards static-code-analysis tests ## Runs the coding-standards, static-code-analysis, and tests targets
diff --git a/composer.json b/composer.json
index 2990a591..1095ab7a 100644
--- a/composer.json
+++ b/composer.json
@@ -29,7 +29,7 @@
     "localheinz/diff": "^1.1.1"
   },
   "require-dev": {
-    "composer/composer": "^2.3.8",
+    "composer/composer": "^2.3.9",
     "ergebnis/license": "^1.2.0",
     "ergebnis/php-cs-fixer-config": "^4.4.0",
     "fakerphp/faker": "^1.19.0",
diff --git a/composer.lock b/composer.lock
index 0cc35bc6..c8905af2 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "e5e771f9835723d70aec9f67796d8150",
+    "content-hash": "a90806e270124dd557ff3af43068c2bb",
     "packages": [
         {
             "name": "ergebnis/json-normalizer",
@@ -581,16 +581,16 @@
         },
         {
             "name": "composer/composer",
-            "version": "2.3.8",
+            "version": "2.3.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/composer.git",
-                "reference": "f69e63262dadd02b3b6edade339c7badda2939c2"
+                "reference": "015f524c9969255a29cdea8890cbd4fec240ee47"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/composer/zipball/f69e63262dadd02b3b6edade339c7badda2939c2",
-                "reference": "f69e63262dadd02b3b6edade339c7badda2939c2",
+                "url": "https://api.github.com/repos/composer/composer/zipball/015f524c9969255a29cdea8890cbd4fec240ee47",
+                "reference": "015f524c9969255a29cdea8890cbd4fec240ee47",
                 "shasum": ""
             },
             "require": {
@@ -671,7 +671,7 @@
             "support": {
                 "irc": "ircs://irc.libera.chat:6697/composer",
                 "issues": "https://github.com/composer/composer/issues",
-                "source": "https://github.com/composer/composer/tree/2.3.8"
+                "source": "https://github.com/composer/composer/tree/2.3.9"
             },
             "funding": [
                 {
@@ -687,7 +687,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-07-01T10:10:47+00:00"
+            "time": "2022-07-05T14:52:11+00:00"
         },
         {
             "name": "composer/metadata-minifier",