diff --git a/DESCRIPTION b/DESCRIPTION
index e94cbc227f..4fd333ba77 100644
--- a/DESCRIPTION
+++ b/DESCRIPTION
@@ -1,7 +1,7 @@
 Package: knitr
 Type: Package
 Title: A General-Purpose Package for Dynamic Report Generation in R
-Version: 1.33.7
+Version: 1.33.8
 Authors@R: c(
     person("Yihui", "Xie", role = c("aut", "cre"), email = "xie@yihui.name", comment = c(ORCID = "0000-0003-0645-5666")),
     person("Abhraneel", "Sarma", role = "ctb"),
diff --git a/NEWS.md b/NEWS.md
index 5f22248a71..ed08c26400 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -10,6 +10,8 @@
 
 - An error is now thrown when an inline code result is not coercible to character. This has always been the assumed behavior but it happens to be different in certain formats with unknown automatic coercion. This is now enforced to prevent any unexpected output. An inline code expression must evaluate to a character vector or an object coercible by `as.character()` (#2006).
 
+- `write_bib()` only uses the first URL if multiple are found in a package (#2028).
+
 ## MINOR CHANGES
 
 - The attribute `data-external="1"` will be added to `<iframe>`s generated by `include_url()` to prevent Pandoc from embedding the URL as base64 data (thanks, @IndrajeetPatil, https://stackoverflow.com/q/67477667/559676).
diff --git a/R/citation.R b/R/citation.R
index 060c420237..e22f6b2713 100644
--- a/R/citation.R
+++ b/R/citation.R
@@ -99,6 +99,10 @@ write_bib = function(
       b['author'] = sub('Duncan Temple Lang', 'Duncan {Temple Lang}', b['author'])
       # remove the ugly single quotes required by CRAN policy
       b['title'] = gsub("(^|\\W)'([^']+)'(\\W|$)", '\\1\\2\\3', b['title'])
+      # keep the first URL if multiple are provided
+      if (!is.na(b['note'])) b['note'] = gsub(
+        '(^.*?https?://.*?),\\s+https?://.*?(},\\s*)$', '\\1\\2', b['note']
+      )
       if (!('year' %in% names(b))) b['year'] = .this.year
       b
     })