diff --git a/.gitignore b/.gitignore
index d093787..5f797da 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-release-1.43-c6eb14c.tar.gz
+release-1.43-9fe6fe4.tar.gz
diff --git a/buildah.spec b/buildah.spec
index d954dd9..07aee7a 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -11,7 +11,7 @@
 
 %global import_path github.com/containers/buildah
 %global branch release-1.43
-%global commit0 c6eb14c2b812c3fcca6a2efedac27bbde5ad7af8
+%global commit0 9fe6fe4c0348e3f95875624f33522b4aae67f06e
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 %if %{defined fedora}
@@ -41,7 +41,7 @@ Epoch: 2
 Version: 1.43.1
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
-Release: 2%{?dist}
+Release: 3%{?dist}
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
@@ -50,7 +50,7 @@ ExclusiveArch: aarch64 ppc64le s390x x86_64
 Summary: A command line tool used for creating OCI Images
 URL: https://%{name}.io
 %if 0%{?branch:1}
-Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
+Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/src-git/%{name}/-/archive/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
 %else
 Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
 %endif
@@ -118,7 +118,7 @@ This package contains system tests for %{name}
 
 %prep
 %if 0%{?branch:1}
-%autosetup -Sgit -n containers-%{name}-%{shortcommit0}
+%autosetup -Sgit -n %{name}-%{commit0}
 %else
 %autosetup -Sgit -n %{name}-%{commit0}
 %endif
@@ -207,6 +207,10 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %{_datadir}/%{name}/test
 
 %changelog
+* Tue Jun 30 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-3
+- bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830
+- Resolves: RHEL-186266
+
 * Mon May 04 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-2
 - Rebuild for CVE-2026-25679
 - Resolves: RHEL-158476
diff --git a/sources b/sources
index 033ff63..6930b60 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (release-1.43-c6eb14c.tar.gz) = 39a271ea0179c0ac9479aeb14558d43ddeebe663026c73203dc3bc490f6929889db7b445ac2911df83a91b5708775a100576dd333fc32ed21932a080d220a6a1
+SHA512 (release-1.43-9fe6fe4.tar.gz) = c8330310d2c83e7cd01abc708808d64a47208387a037acdb4353701e56741cd5ce067e0e4b8cbd04db2d6f04e12888a2f75fbf3eee580c403b949d279cd6030d