diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6920e2f33e3f8ab371eb04747ee7e8be06111a0..77420db25fa84f382e3924a57fa80e9da6737af2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.3.9
+
+- No changes.
+
 ## 12.3.8
 
 - No changes.
diff --git a/VERSION b/VERSION
index c3c90f17940e1617e2956245babb59b09c82b06e..43fcd738f0530b0f2496802a752b15bc4ffcd3b5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-12.3.8-ee
+12.3.9
diff --git a/app/services/groups/transfer_service.rb b/app/services/groups/transfer_service.rb
index fe7e07ef9f0856646531d6a234ef535bde8c80b2..b73ec5cb7379bb725db19351e61fb881ed0cc0e0 100644
--- a/app/services/groups/transfer_service.rb
+++ b/app/services/groups/transfer_service.rb
@@ -38,9 +38,15 @@ module Groups
         ensure_ownership
       end
 
+      post_update_hooks(@updated_project_ids)
+
       true
     end
 
+    # Overridden in EE
+    def post_update_hooks(updated_project_ids)
+    end
+
     def ensure_allowed_transfer
       raise_transfer_error(:group_is_already_root) if group_is_already_root?
       raise_transfer_error(:same_parent_as_current) if same_parent?
@@ -90,9 +96,16 @@ module Groups
         .where(id: descendants.select(:id))
         .update_all(visibility_level: @new_parent_group.visibility_level)
 
-      @group
+      projects_to_update = @group
         .all_projects
         .where("visibility_level > ?", @new_parent_group.visibility_level)
+
+      # Used in post_update_hooks in EE. Must use pluck (and not select)
+      # here as after we perform the update below we won't be able to find
+      # these records again.
+      @updated_project_ids = projects_to_update.pluck(:id)
+
+      projects_to_update
         .update_all(visibility_level: @new_parent_group.visibility_level)
     end
     # rubocop: enable CodeReuse/ActiveRecord
@@ -109,3 +122,5 @@ module Groups
     end
   end
 end
+
+Groups::TransferService.prepend_if_ee('EE::Groups::TransferService')