diff --git a/NEWS b/NEWS
index 326e6f8bb788b6572bd86830bc89d9230bc52946..6d06833d31b3fb11c2353ec3a05b7901fcd44f4e 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,16 @@
 * webapps: switch to https if possible
 * mox: i2c-1 on GPIO pinheader is now enabled
 
+4.0.3
+-----
+
+* Merry Christmas!
+🔔🔔🔔
+* kernel: updated to version 4.14.158
+* foris-controller-subordinates-module: limit custom name length
+* tvheadend: ensure the first setup works
+* libvpx: fix CVE-2019-9232, CVE-2019-9325, CVE-2019-9371, CVE-2019-9433
+
 4.0.2
 -----
 
diff --git a/helpers/new_release.sh b/helpers/new_release.sh
index 2b5929dd98fcafbd60e856b739e3bb6a0723cdd2..28e1d5754593a90636729cf06abc696aadf93b41 100755
--- a/helpers/new_release.sh
+++ b/helpers/new_release.sh
@@ -95,9 +95,9 @@ tb_hash() {
 	for board in "${BOARDS[@]}"; do
 		l_hash="$(cat "$GIT_HASH_LISTS-$board")"
 		b_hash="$(git_hash "$board" "turris-build")"
-		[ -n "$p_hash" ] || p_hash="$l_hash" # First board is considered primary and lists are authoritative
-		[ "$p_hash" = "$l_hash" ] || {
-			error "Turris build used to generate lists is not same as for ${BOARDS[0]} board: $board ($l_hash / $p_hash)"
+		[ -n "$p_hash" ] || p_hash="$b_hash" # First board is considered primary and packages are authoritative
+		[ "$p_hash" = "$b_hash" ] || {
+			error "Turris build used to generate packages is not same as for ${BOARDS[0]} board: $board ($b_hash / $p_hash)"
 			ec=1
 		}
 		[ "$b_hash" = "$l_hash" ] || {
@@ -105,7 +105,7 @@ tb_hash() {
 			ec=1
 		}
 	done
-	echo "$l_hash"
+	echo "$p_hash"
 	return $ec
 }