diff --git a/dnsmasq.spec b/dnsmasq.spec
index 77f5c6b..6ab856d 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -13,7 +13,7 @@
 
 Name:           dnsmasq
 Version:        2.79
-Release:        36%{?extraversion:.%{extraversion}}%{?dist}
+Release:        37%{?extraversion:.%{extraversion}}%{?dist}
 Summary:        A lightweight DHCP/caching DNS server
 
 License:        GPLv2 or GPLv3
@@ -21,6 +21,8 @@ URL:            http://www.thekelleys.org.uk/dnsmasq/
 Source0:        http://www.thekelleys.org.uk/dnsmasq/%{?extrapath}%{name}-%{version}%{?extraversion}.tar.xz
 Source1:        %{name}.service
 Source2:        dnsmasq-systemd-sysusers.conf
+# https://thekelleys.org.uk/gitweb-noai/?p=dnsmasq.git;a=blob_plain;f=trust-anchors.conf;hb=d6379cd923676dd21bc05ed8bd8fe4fb24337c98
+Source6:        trust-anchors.conf
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1495409
 Patch1:         dnsmasq-2.77-underflow.patch
@@ -241,7 +243,7 @@ install src/dnsmasq $RPM_BUILD_ROOT%{_sbindir}/dnsmasq
 install dnsmasq.conf.example $RPM_BUILD_ROOT%{_sysconfdir}/dnsmasq.conf
 install dbus/dnsmasq.conf $RPM_BUILD_ROOT%{_sysconfdir}/dbus-1/system.d/
 install -m 644 man/dnsmasq.8 $RPM_BUILD_ROOT%{_mandir}/man8/
-install -D trust-anchors.conf $RPM_BUILD_ROOT%{_datadir}/%{name}/trust-anchors.conf
+install -D %{SOURCE6} $RPM_BUILD_ROOT%{_datadir}/%{name}/trust-anchors.conf
 
 # utils sub package
 mkdir -p $RPM_BUILD_ROOT%{_bindir} \
@@ -297,6 +299,9 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/dnsmasq.conf
 %{_mandir}/man1/dhcp_*
 
 %changelog
+* Wed Aug 26 2026 Petr Menšík <pemensik@redhat.com> - 2.79-37
+- Update DNSSEC trust anchors with 2024 key (38696) (RHEL-131886)
+
 * Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.79-36
 - Prevent overflow in extract_name function (CVE-2026-2291)
 - Prevent DoS in DNSSEC validation (CVE-2026-4890)
diff --git a/trust-anchors.conf b/trust-anchors.conf
new file mode 100644
index 0000000..2fa5479
--- /dev/null
+++ b/trust-anchors.conf
@@ -0,0 +1,10 @@
+# The root DNSSEC trust anchor, valid as at 18/07/2024
+
+# Note that this is a DS record (i.e. a hash of the root Zone Signing Key) 
+# It was downloaded from https://data.iana.org/root-anchors/root-anchors.xml
+
+trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
+trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
+
+
+