diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20cf64b1..802eb46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.3.0-dev.0.3
+
+* Cherry-pick 04e1b0d976151cc6aa5dcc80667d568c95495c80 to dev
+
 ## 2.3.0-dev.0.2
 
 * Cherry-pick d8a0d68bd66b388e4c5f6dc38f4fd940a4cb88bc to dev
diff --git a/runtime/bin/main_options.cc b/runtime/bin/main_options.cc
index 42fa0b5..0826fa1 100644
--- a/runtime/bin/main_options.cc
+++ b/runtime/bin/main_options.cc
@@ -192,9 +192,15 @@
 "  enables tracing of library and script loading\n"
 "\n"
 "--enable-vm-service[=<port>[/<bind-address>]]\n"
-"  enables the VM service and listens on specified port for connections\n"
+"  Enables the VM service and listens on specified port for connections\n"
 "  (default port number is 8181, default bind address is localhost).\n"
 "\n"
+"--disable-service-auth-codes\n"
+"  Disables the requirement for an authentication code to communicate with\n"
+"  the VM service. Authentication codes help protect against CSRF attacks,\n"
+"  so it is not recommended to disable them unless behind a firewall on a\n"
+"  secure device.\n"
+"\n"
 "--root-certs-file=<path>\n"
 "  The path to a file containing the trusted root certificates to use for\n"
 "  secure socket connections.\n"
diff --git a/tools/VERSION b/tools/VERSION
index 236864e..21d9222 100644
--- a/tools/VERSION
+++ b/tools/VERSION
@@ -34,6 +34,6 @@
 MINOR 3
 PATCH 0
 PRERELEASE 0
-PRERELEASE_PATCH 2
+PRERELEASE_PATCH 3
 ABI_VERSION 4
 OLDEST_SUPPORTED_ABI_VERSION 1