diff --git a/bind-dyndb-ldap-11.8-iscapi-task.patch b/bind-dyndb-ldap-11.8-iscapi-task.patch
new file mode 100644
index 0000000..a1c99b0
--- /dev/null
+++ b/bind-dyndb-ldap-11.8-iscapi-task.patch
@@ -0,0 +1,77 @@
+From 55ea24d66e4120b3c1370e931897028054caa554 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 20 May 2021 13:48:51 +0200
+Subject: [PATCH] Remove ISCAPI_TASK_VALID checks
+
+Recent BIND 9.16.16 has hidden task structure and public checks. It
+still checks task validity in each isc_task_* function, which we use for
+working with tasks. No lesser checking would be done.
+
+isc_mem_t still has them, but they were removed in 9.17. Remove those
+checks as well, work with them just structure undefined pointers. Rely
+on bind9 library to check them.
+---
+ src/ldap_driver.c | 2 +-
+ src/ldap_helper.c | 2 +-
+ src/syncrepl.c    | 4 +---
+ 3 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/src/ldap_driver.c b/src/ldap_driver.c
+index 20aa9f088..e9f1005ee 100644
+--- a/src/ldap_driver.c
++++ b/src/ldap_driver.c
+@@ -1026,7 +1026,7 @@ ldapdb_associate(isc_mem_t *mctx, node_name_t *name, dns_dbtype_t type,
+ 	ldap_instance_t *ldap_inst = driverarg;
+ 	zone_register_t *zr = NULL;
+ 
+-	REQUIRE(ISCAPI_MCTX_VALID(mctx));
++	UNUSED(mctx);
+ 	REQUIRE(type == LDAP_DB_TYPE);
+ 	REQUIRE(rdclass == LDAP_DB_RDATACLASS);
+ 	REQUIRE(argc == 0);
+diff --git a/src/ldap_helper.c b/src/ldap_helper.c
+index 1c89e54ff..2fd2da4d8 100644
+--- a/src/ldap_helper.c
++++ b/src/ldap_helper.c
+@@ -1143,7 +1143,7 @@ publish_zone(isc_task_t *task, ldap_instance_t *inst, dns_zone_t *zone)
+ 	dns_view_t *view_in_zone = NULL;
+ 	isc_result_t lock_state = ISC_R_IGNORE;
+ 
+-	REQUIRE(ISCAPI_TASK_VALID(task));
++	UNUSED(task);
+ 	REQUIRE(inst != NULL);
+ 	REQUIRE(zone != NULL);
+ 
+diff --git a/src/syncrepl.c b/src/syncrepl.c
+index b7a7ab820..a406fff1c 100644
+--- a/src/syncrepl.c
++++ b/src/syncrepl.c
+@@ -131,7 +131,6 @@ finish(isc_task_t *task, isc_event_t *event) {
+ 	sync_barrierev_t *bev = NULL;
+ 	sync_state_t new_state;
+ 
+-	REQUIRE(ISCAPI_TASK_VALID(task));
+ 	REQUIRE(event != NULL);
+ 
+ 	bev = (sync_barrierev_t *)event;
+@@ -206,8 +205,8 @@ barrier_decrement(isc_task_t *task, isc_event_t *event) {
+ 	sync_barrierev_t *bev = NULL;
+ 	uint32_t cnt;
+ 
+-	REQUIRE(ISCAPI_TASK_VALID(task));
+ 	REQUIRE(event != NULL);
++	UNUSED(task);
+ 
+ 	bev = (sync_barrierev_t *)event;
+ #if LIBDNS_VERSION_MAJOR < 1600
+@@ -458,7 +457,6 @@ sync_task_add(sync_ctx_t *sctx, isc_task_t *task) {
+ 	uint32_t cnt;
+ 
+ 	REQUIRE(sctx != NULL);
+-	REQUIRE(ISCAPI_TASK_VALID(task));
+ 
+ 	newel = isc_mem_get(sctx->mctx, sizeof(*(newel)));
+ 	ZERO_PTR(newel);
+-- 
+2.26.3
+
diff --git a/bind-dyndb-ldap.spec b/bind-dyndb-ldap.spec
index 4ef3976..72ae3cb 100644
--- a/bind-dyndb-ldap.spec
+++ b/bind-dyndb-ldap.spec
@@ -1,7 +1,7 @@
 
 %define VERSION %{version}
 
-%define bind_version 32:9.16.15
+%define bind_version 32:9.16.16
 
 %if 0%{?fedora} >= 31 || 0%{?rhel} > 8
     %global openssl_pkcs11_version 0.4.10-6
@@ -12,7 +12,7 @@
 
 Name:           bind-dyndb-ldap
 Version:        11.7
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        LDAP back-end plug-in for BIND
 
 License:        GPLv2+
@@ -22,6 +22,7 @@ Source1:        https://releases.pagure.org/%{name}/%{name}-%{VERSION}.tar.bz2.a
 
 Patch1:         bind-dyndb-ldap-11.6-bind-9.16.13-version.patch
 Patch2:         bind-dyndb-ldap-11.6-bind-9.16.13-rwlock.patch
+Patch3:         bind-dyndb-ldap-11.8-iscapi-task.patch
 
 BuildRequires:  bind-devel >= %{bind_version}, bind-lite-devel >= %{bind_version}
 BuildRequires:  krb5-devel
@@ -117,6 +118,9 @@ sed -i.bak -e "$SEDSCRIPT" /etc/named.conf
 
 
 %changelog
+* Fri May 21 2021 Petr Menšík <pemensik@redhat.com> - 11.7-4
+- Add BIND 9.16.16 support
+
 * Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 11.7-3
 - Rebuilt for BIND 9.16.15