diff --git a/.github/workflows/update_ci.yml b/.github/workflows/update_ci.yml
index 17e5edddd..9b53ae33e 100644
--- a/.github/workflows/update_ci.yml
+++ b/.github/workflows/update_ci.yml
@@ -269,7 +269,7 @@ jobs:
         with:
           fetch-depth: 0
           path: "pulp_python"
-          ref: "3.37"
+          ref: "3.38"
 
       - name: "Run update"
         working-directory: "pulp_python"
@@ -278,21 +278,21 @@ jobs:
 
       - name: "Create Pull Request for CI files"
         uses: "peter-evans/create-pull-request@v8"
-        id: "create_pr_3_37"
+        id: "create_pr_3_38"
         with:
           token: "${{ secrets.RELEASE_TOKEN }}"
           path: "pulp_python"
           committer: "pulpbot <pulp-infra@redhat.com>"
           author: "pulpbot <pulp-infra@redhat.com>"
-          title: "Update CI files for branch 3.37"
-          branch: "update-ci/3.37"
-          base: "3.37"
+          title: "Update CI files for branch 3.38"
+          branch: "update-ci/3.38"
+          base: "3.38"
           delete-branch: true
       - name: "Mark PR automerge"
         working-directory: "pulp_python"
         run: |
-          gh pr merge --rebase --auto "${{ steps.create_pr_3_37.outputs.pull-request-number }}"
-        if: "steps.create_pr_3_37.outputs.pull-request-number"
+          gh pr merge --rebase --auto "${{ steps.create_pr_3_38.outputs.pull-request-number }}"
+        if: "steps.create_pr_3_38.outputs.pull-request-number"
         env:
           GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
         continue-on-error: true
diff --git a/CHANGES/+prerelease-range-filters.bugfix b/CHANGES/+prerelease-range-filters.bugfix
deleted file mode 100644
index 3fd240bad..000000000
--- a/CHANGES/+prerelease-range-filters.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Remote include and exclude ranges accept matching prerelease versions without deprecation warnings.
diff --git a/CHANGES/+simple_html_xss.bugfix b/CHANGES/+simple_html_xss.bugfix
deleted file mode 100644
index 2c3dabb25..000000000
--- a/CHANGES/+simple_html_xss.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
diff --git a/CHANGES/1340.feature b/CHANGES/1340.feature
deleted file mode 100644
index da5949006..000000000
--- a/CHANGES/1340.feature
+++ /dev/null
@@ -1 +0,0 @@
-Added custom (non-PEP 740) support for verifying attestations signed with a per-domain public key configured via `ATTESTATION_VERIFICATION_KEYS`.
diff --git a/pulp_python/app/__init__.py b/pulp_python/app/__init__.py
index 3bca50680..4ab9d43ea 100644
--- a/pulp_python/app/__init__.py
+++ b/pulp_python/app/__init__.py
@@ -12,7 +12,7 @@ class PulpPythonPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_python.app"
     label = "python"
-    version = "3.38.0.dev"
+    version = "3.39.0.dev"
     python_package_name = "pulp-python"
     domain_compatible = True
 
diff --git a/pyproject.toml b/pyproject.toml
index 813e73944..6dd0c0d32 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-python"
-version = "3.38.0.dev"
+version = "3.39.0.dev"
 description = "pulp-python plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -78,7 +78,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.38.0.dev"
+current_version = "3.39.0.dev"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"
diff --git a/template_config.yml b/template_config.yml
index 39e49174c..ef109f66b 100644
--- a/template_config.yml
+++ b/template_config.yml
@@ -21,12 +21,12 @@ deploy_to_pypi: true
 disabled_redis_runners: []
 docker_fixtures: false
 extra_files:
-  - origin: "pulp_python/.ci/assets/keys/test-key.pem"
-    destination: "/etc/pki/attestation/test-key.pem"
-  - origin: "pulp_python/.ci/assets/keys/test-key-private.pem"
-    destination: "/etc/pki/attestation/test-key-private.pem"
+  - destination: "/etc/pki/attestation/test-key.pem"
+    origin: "pulp_python/.ci/assets/keys/test-key.pem"
+  - destination: "/etc/pki/attestation/test-key-private.pem"
+    origin: "pulp_python/.ci/assets/keys/test-key-private.pem"
 github_org: "pulp"
-latest_release_branch: "3.37"
+latest_release_branch: "3.38"
 lint_ignore: []
 lint_requirements: true
 os_required_packages: []
@@ -46,9 +46,9 @@ pulp_settings:
   allowed_export_paths: "/tmp"
   allowed_import_paths: "/tmp"
   api_root: "/pulp/"
-  orphan_protection_time: 0
   attestation_verification_keys:
     default: "/etc/pki/attestation/test-key.pem"
+  orphan_protection_time: 0
   pypi_api_hostname: "https://pulp:443"
 pulp_settings_azure:
   MEDIA_ROOT: ""