diff --git a/nextcloud-defaults.inc b/nextcloud-defaults.inc
index c9ceec5..0ed8397 100644
--- a/nextcloud-defaults.inc
+++ b/nextcloud-defaults.inc
@@ -73,4 +73,6 @@ Options -Indexes
     <FilesMatch "\.(css|js)$">
         Header set Cache-Control "max-age=7200, public"
     </FilesMatch>
+    # https://docs.nextcloud.com/server/25/admin_manual/installation/harden_server.html#enable-http-strict-transport-security
+    Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
 </IfModule>
diff --git a/nextcloud-php.ini b/nextcloud-php.ini
new file mode 100644
index 0000000..008bcab
--- /dev/null
+++ b/nextcloud-php.ini
@@ -0,0 +1 @@
+apc.enable_cli=1
diff --git a/nextcloud-systemd-timer.service b/nextcloud-systemd-timer.service
index ccff38f..a7efaae 100644
--- a/nextcloud-systemd-timer.service
+++ b/nextcloud-systemd-timer.service
@@ -2,7 +2,10 @@
 Description=Cron for nextcloud background jobs
 
 [Service]
+# https://docs.nextcloud.com/server/25/admin_manual/configuration_server/background_jobs_configuration.html#systemd
 Type=oneshot
-ExecStart=/usr/bin/php -f /usr/share/nextcloud/cron.php
 User=apache
+KillMode=process
+ExecStart=/usr/bin/php -f /usr/share/nextcloud/cron.php
+
 
diff --git a/nextcloud.spec b/nextcloud.spec
index 980e197..acc4a93 100644
--- a/nextcloud.spec
+++ b/nextcloud.spec
@@ -1,5 +1,5 @@
 Name:           nextcloud
-Version:        28.0.4
+Version:        28.0.5
 Release:        %autorelease
 Summary:        Private file sync and share server
 License:        AGPLv3+ and MIT and BSD and ASL 2.0 and WTFPL and CC-BY-SA and GPLv3+ and Adobe
@@ -24,6 +24,7 @@ Source105:      %{name}-defaults.inc
 Source200:      %{name}-default-nginx.conf
 Source201:      %{name}-conf-nginx.conf
 Source202:      %{name}-php-fpm.conf
+Source203:      %{name}-php.ini
 # packaging notes and doc
 Source300:      %{name}-README.fedora
 Source301:      %{name}-mysql.txt
@@ -377,6 +378,10 @@ install -Dpm 644 %{SOURCE201} \
 install -Dpm 644 %{SOURCE202} \
     %{buildroot}%{_sysconfdir}/php-fpm.d/%{name}.conf
 
+# php.ini config
+install -Dpm 644 %{SOURCE203} \
+    %{buildroot}%{_sysconfdir}/php.d/60-%{name}.ini
+
 # Install the systemd timer
 install -Dpm 644 %{SOURCE2} %{buildroot}%{_unitdir}/nextcloud-cron.service
 install -Dpm 644 %{SOURCE3} %{buildroot}%{_unitdir}/nextcloud-cron.timer
@@ -418,6 +423,7 @@ fi
 %dir %attr(-,apache,apache) %{_sysconfdir}/%{name}
 # contains sensitive data (dbpassword, passwordsalt)
 %config(noreplace) %attr(0600,apache,apache) %{_sysconfdir}/%{name}/config.php
+%config(noreplace) %{_sysconfdir}/php.d/60-%{name}.ini
 # need the symlink in confdir but it's not config
 %{_sysconfdir}/%{name}/ca-bundle.crt
 %{_datadir}/%{name}
diff --git a/sources b/sources
index f8b8b5d..23198fb 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (nextcloud-28.0.4.tar.bz2) = bb26831d9143ab5ea06ffdf9f2c98c5851c26c23002c6124c9443cd2636d7a102e5da053e0fbd0e7ed6da634d292deeaa0219038b6def4bf302e922b48135fb2
+SHA512 (nextcloud-28.0.5.tar.bz2) = a6f25e6ddced8087366537793c28869a6bbda0d165aa4d99858745fdfab7679a717e82cab17f72b73105bbeca917d58ff5a9e19ec820b688b5f85397de76457f