diff --git a/package/7zip/7zip.hash b/package/7zip/7zip.hash
index fc936abd..78d66a15 100644
--- a/package/7zip/7zip.hash
+++ b/package/7zip/7zip.hash
@@ -16,7 +16,7 @@
 # without the other -- see the "SAME UPSTREAM TARBALL" comment in 7zip.mk.
 # Verified against:
 #   https://github.com/ip7z/7zip/releases/download/26.02/7z2602-src.tar.xz
-sha256  cf967c98bca02a4b8b16375f441825a8e141362f14be1969bbec8e1ca0bff9dd  7z2602-src.tar.xz
+sha256  9cbde5099c6deb73691b0579063da5827522ccbbcba3f0020fd04e8c8c16c0d4  7z2603-src.tar.xz
 # DOC/License.txt -- unlike lzma-sdk, this package DOES compile the CPP/ code
 # those terms cover (including CPP/7zip/Compress/Rar*, hence the unRAR
 # restriction). See the license comment in 7zip.mk for the per-path chain.
diff --git a/package/7zip/7zip.mk b/package/7zip/7zip.mk
index d6540c01..ae723bdf 100644
--- a/package/7zip/7zip.mk
+++ b/package/7zip/7zip.mk
@@ -34,7 +34,7 @@
 # build disjoint artifacts with no shared ABI). If you bump one, bump the
 # other in the same PR unless you have a reason not to. Note the LICENSE
 # differs between the two for real reasons -- see the license comment below.
-7ZIP_VERSION = 26.02
+7ZIP_VERSION = 26.03
 # 7z$(subst .,,26.02) = 7z2602-src.tar.xz -- the versioning scheme 7-zip.org
 # itself uses for source drops. The GitHub ip7z/7zip release page is the
 # project's own release channel (7-zip.org's download page links there); it
diff --git a/package/lzma-sdk/lzma-sdk.hash b/package/lzma-sdk/lzma-sdk.hash
index bf7a2997..e75c8224 100644
--- a/package/lzma-sdk/lzma-sdk.hash
+++ b/package/lzma-sdk/lzma-sdk.hash
@@ -5,7 +5,7 @@
 #   https://github.com/ip7z/7zip/releases/download/26.02/7z2602-src.tar.xz
 #
 #   sha256sum 7z2602-src.tar.xz
-sha256  cf967c98bca02a4b8b16375f441825a8e141362f14be1969bbec8e1ca0bff9dd  7z2602-src.tar.xz
+sha256  9cbde5099c6deb73691b0579063da5827522ccbbcba3f0020fd04e8c8c16c0d4  7z2603-src.tar.xz
 # DOC/License.txt -- see LZMA_SDK_LICENSE_FILES comment in the .mk; its
 # LGPL/unRAR terms scope only the CPP/ code this package never ships
 sha256  9ac2b4a97ab5d523965534d8b2d5868e511b39096d51fff458ab72c38b80fccc  DOC/License.txt
diff --git a/package/lzma-sdk/lzma-sdk.mk b/package/lzma-sdk/lzma-sdk.mk
index dd78e9a7..786a38df 100644
--- a/package/lzma-sdk/lzma-sdk.mk
+++ b/package/lzma-sdk/lzma-sdk.mk
@@ -26,7 +26,7 @@
 # upstream (host packages have no prompt), so only the Make namespace
 # collides -- silently. Precedent for suffixing our way out of an upstream
 # squat: package/rtl8188eu-aircrack-ng (see its Config.in).
-LZMA_SDK_VERSION = 26.02
+LZMA_SDK_VERSION = 26.03
 # 7z$(subst .,,26.02) = 7z2602-src.tar.xz -- the same versioning scheme
 # 7-zip.org itself uses for source drops. The GitHub ip7z/7zip release page
 # is the project's own release channel (7-zip.org's download page links