diff --git a/.gitignore b/.gitignore
index db535c0..cacea2e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
-/chrony-3.5.tar.gz
-/chrony-3.5-tar-gz-asc.txt
-/clknetsim-79ffe4.tar.gz
+/chrony-4.0-pre1.tar.gz
+/chrony-4.0-pre1-tar-gz-asc.txt
+/clknetsim-09cbc3.tar.gz
diff --git a/chrony-packettest.patch b/chrony-packettest.patch
deleted file mode 100644
index ff1e207..0000000
--- a/chrony-packettest.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-commit 62d6aed6a64b887c9e3b7f03d9e0db1deaa2696a
-Author: Miroslav Lichvar <mlichvar@redhat.com>
-Date:   Tue Jun 18 15:41:50 2019 +0200
-
-    test: update processing of packet log
-    
-    Two new fields have been added to the packet log, which broke some
-    of the simulation tests.
-
-diff --git a/test/simulation/test.common b/test/simulation/test.common
-index 951a794b..8ed6ad9e 100644
---- a/test/simulation/test.common
-+++ b/test/simulation/test.common
-@@ -391,9 +391,9 @@ check_packet_port() {
- 	for i in $(seq 1 $(get_chronyd_nodes)); do
- 		test_message 3 0 "node $i:"
- 
--		grep -E -q "	$port	[0-9]+\$" tmp/log.packets && \
-+		grep -E -q "^([0-9e.+-]+	){5}$port	" tmp/log.packets && \
- 			! grep -E "^[0-9e.+-]+	$i	" tmp/log.packets | \
--			grep -E -q -v "	$port	[0-9]+\$" && \
-+			grep -E -q -v "^([0-9e.+-]+	){5}$port	" && \
- 			test_ok || test_bad
- 		[ $? -eq 0 ] || ret=1
- 	done
diff --git a/chrony.spec b/chrony.spec
index 6aa30db..d9026f6 100644
--- a/chrony.spec
+++ b/chrony.spec
@@ -1,9 +1,11 @@
 %global _hardened_build 1
-%global clknetsim_ver 79ffe4
+%global prerelease -pre1
+%global clknetsim_ver 09cbc3
 %bcond_without debug
+%bcond_without nts
 
 Name:           chrony
-Version:        3.5
+Version:        4.0
 Release:        8%{?dist}
 Summary:        An NTP client/server
 
@@ -22,14 +24,13 @@ Source10:       https://github.com/mlichvar/clknetsim/archive/%{clknetsim_ver}/c
 
 # add NTP servers from DHCP when starting service
 Patch2:         chrony-service-helper.patch
-# fix test suite to work with newer clknetsim
-Patch3:         chrony-packettest.patch
 
 BuildRequires:  libcap-devel libedit-devel nettle-devel pps-tools-devel
 %ifarch %{ix86} x86_64 %{arm} aarch64 mipsel mips64el ppc64 ppc64le s390 s390x
 BuildRequires:  libseccomp-devel
 %endif
 BuildRequires:  gcc gcc-c++ bison systemd gnupg2 net-tools
+%{?with_nts:BuildRequires: gnutls-devel gnutls-utils}
 
 Requires(pre):  shadow-utils
 %{?systemd_requires}
@@ -59,7 +60,6 @@ service to other computers in the network.
 %setup -q -n %{name}-%{version}%{?prerelease} -a 10
 %{?gitpatch:%patch0 -p1}
 %patch2 -p1 -b .service-helper
-%patch3 -p1 -b .packettest
 
 %{?gitpatch: echo %{version}-%{gitpatch} > version.txt}
 
@@ -97,6 +97,7 @@ mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
 %{?with_debug: --enable-debug} \
         --enable-ntp-signd \
         --enable-scfilter \
+%{!?with_nts: --disable-nts} \
         --docdir=%{_docdir} \
         --with-ntp-era=$(date -d '1970-01-01 00:00:00+00:00' +'%s') \
         --with-user=chrony \
diff --git a/sources b/sources
index 4cc2cf2..3856e6a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (chrony-3.5.tar.gz) = c4f6376a44d71b6ac2b6d86e3d6fb4348642faeef7f3f3a4d6431627b5645efcc868b005cc398c8292bc3b63a1161fbd1a042c6ac2a0595843f908fe32eed90c
-SHA512 (chrony-3.5-tar-gz-asc.txt) = b66ccc22fb7ae2f0597b5e20705a71f0d7fabad396d6efc427f49247361a09e3b13e2af31460123451268268d663a181361769795758c4ee96ade2b24e31ba48
-SHA512 (clknetsim-79ffe4.tar.gz) = ae118c0e5fbb26d57489eba941b57593454bd41b714e305ed76f78b2eb469b59b6c14cd1781e8eda42895199294bb577ca3b6895a7d120d6b8dd6db4e08c1396
+SHA512 (chrony-4.0-pre1.tar.gz) = 0b850d57fded23ac3cfe5907edb2a2b8441397a37575ce3b4af54f3b8f28ae7ae74f92926f619e4907a24d9bc10bb6b416bfe3ccc9d567720e3511d7f9513c59
+SHA512 (chrony-4.0-pre1-tar-gz-asc.txt) = 882ad890b500a4cfb2a33bd0804ccbe6548d415cad1ec21930957d55d2eec6a56647f909e928eba78da47d2227bfeeb9a6db1bb52dccbae24470a76a99b92cc5
+SHA512 (clknetsim-09cbc3.tar.gz) = 6910121e77bc4976b5b684d49cc376990f95275a27e73ecc1f7c50000f160a9e4f4a2faf6c6e2abfe566c557719a39a2dc1a4fffc5483024fe8d5dc2c4277d37