diff --git a/.gitignore b/.gitignore
index 1616d9a..1dcf5ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -152,3 +152,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.19.tar.xz.asc
 /bind-9.16.20.tar.xz
 /bind-9.16.20.tar.xz.asc
+/bind-9.16.23.tar.xz
+/bind-9.16.23.tar.xz.asc
diff --git a/bind.spec b/bind.spec
index 02eea08..4cd2bbe 100644
--- a/bind.spec
+++ b/bind.spec
@@ -50,8 +50,8 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.20
-Release:  5%{?dist}
+Version:  9.16.23
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1135,6 +1135,9 @@ fi;
 %endif
 
 %changelog
+* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
+- Update to 9.16.23 (#2024210)
+
 * Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-5
 - Propagate ephemeral port ranges to chroot (#2013595)
 
diff --git a/sources b/sources
index b49745d..38a7720 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.20.tar.xz) = bd4ffcc2589ca8f1ac228576ec11e86f317d5a78d7964a0a7ae70b2fa38831d5bd65c2e8c35d8190502de7139f85d8b080b3b8ee968811a8df78e5761781525d
-SHA512 (bind-9.16.20.tar.xz.asc) = ae4fdcd0ab40ac4adce6154ef3b251a552a7cd42dc8ebfd1c38dfd0a6ead5d6e74e67cb1f4247c4a3fb25a9580043635cc946e536f2a7ec8bc9e654dde2d58bf
+SHA512 (bind-9.16.23.tar.xz) = 9dd1c5241f15bf6c3c1e1564564c7e91cba0dfc7f1262d53b4b54f4f7230ed651a148e95efa25efab1712b65bdeb555dfc0e1b524dcfc2a05ede43dd5b3978cf
+SHA512 (bind-9.16.23.tar.xz.asc) = b17fb7f8e24fd22f12113a5462e654c13660c1f66eeff19bb3e0e2eb63f048c2cac9e4a627e5e2d16b75d69234f5b9618f4d52ba4d9dd7d77fd2baf77322024a