diff --git a/gitea.service b/gitea.service
index 126ea94..40d5a2b 100644
--- a/gitea.service
+++ b/gitea.service
@@ -38,7 +38,7 @@ ProtectKernelLogs=true
 ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectProc=invisible
-ProtectSystem=strict
+#ProtectSystem=strict
 RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
 RestrictNamespaces=true
 RestrictRealtime=true
diff --git a/gitea.spec b/gitea.spec
index 041b15e..fdef10b 100644
--- a/gitea.spec
+++ b/gitea.spec
@@ -1,6 +1,6 @@
 Name:          gitea
 Version:       1.21.3
-Release:       2mamba
+Release:       3mamba
 Summary:       Painless self-hosted Git service, community managed
 Group:         System/Servers
 Vendor:        openmamba
@@ -26,6 +26,7 @@ Painless self-hosted all-in-one software development service, including Git host
 
 %prep
 %setup -q
+
 #-D -T
 #:<< _EOF
 # Workaround for poetry stuck in infinite processes
@@ -40,6 +41,10 @@ export LDFLAGS="-linkmode=external -compressdwarf=false -X \
    -X 'code.gitea.io/gitea/modules/setting.CustomConf=%{_sysconfdir}/gitea/app.ini'"
 export TAGS="bindata sqlite sqlite_unlock_notify pam"
 
+# Replace chroma with custom fork adding RPM Spec support for syntax highlighting
+go mod edit -replace github.com/alecthomas/chroma/v2="github.com/mambasoft/chroma/v2@v2.0.0-20240102115650-6fed1b9b0d99"
+go mod tidy
+
 %make -j1
 
 %install
@@ -47,8 +52,8 @@ export TAGS="bindata sqlite sqlite_unlock_notify pam"
 #% makeinstall
 install -D -m755 gitea %{buildroot}%{_bindir}/gitea
 install -D -m644 %{SOURCE1} %{buildroot}%{_unitdir}/gitea.service
-install -D -m644 %{SOURCE3} %{buildroot}%{_tmpfilesdir}/gitea.conf
 install -D -m644 %{SOURCE2} %{buildroot}%{_sysusersdir}/gitea.conf
+install -D -m644 %{SOURCE3} %{buildroot}%{_tmpfilesdir}/gitea.conf
 install -D -m644 custom/conf/app.example.ini %{buildroot}%{_sysconfdir}/gitea/app.ini
 
 %clean
@@ -81,6 +86,10 @@ install -D -m644 custom/conf/app.example.ini %{buildroot}%{_sysconfdir}/gitea/ap
 %doc LICENSE
 
 %changelog
+* Tue Jan 02 2024 Silvan Calarco <silvan.calarco@mambasoft.it> 1.21.3-3mamba
+- use custom chroma repository for rpm spec support
+- gitea.service: don't set ProtectSystem=strict to fix usage of sendmail
+
 * Thu Dec 28 2023 Silvan Calarco <silvan.calarco@mambasoft.it> 1.21.3-2mamba
 - fixed service file name