diff --git a/dogtag-pki.spec b/dogtag-pki.spec
index 08de4da..ca68851 100644
--- a/dogtag-pki.spec
+++ b/dogtag-pki.spec
@@ -14,7 +14,7 @@ Name:             dogtag-pki
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
 # - GA/update (supported): <n> where n >= 1
-%global           release_number 2
+%global           release_number 3
 
 # Development phase:
 # - development (unsupported): alpha<n> where n >= 1
@@ -42,7 +42,7 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?phase:-}%{?phase}
 
 Source1: jakarta.activation-api-2.1.2.jar
 Source2: jakarta.annotation-api-1.3.5.jar
-Source3: jakarta.xml.bind-4.0.1.jar
+Source3: jakarta.xml.bind-api-4.0.1.jar
 Source4: jackson-annotations-2.16.1.jar
 Source5: jackson-core-2.16.1.jar
 Source6: jackson-databind-2.16.1.jar
@@ -1344,6 +1344,12 @@ CXX_FLAGS="$CXX_FLAGS -D_FORTIFY_SOURCE=3"
 C_FLAGS="$C_FLAGS -fstack-clash-protection"
 CXX_FLAGS="$CXX_FLAGS -fstack-clash-protection"
 
+%ifarch aarch64
+# https://sourceware.org/annobin/annobin.html/Test-dynamic-tags.html
+C_FLAGS="$C_FLAGS -mbranch-protection=standard"
+CXX_FLAGS="$CXX_FLAGS -mbranch-protection=standard"
+%endif
+
 %endif
 
 pkgs=base\
@@ -2041,6 +2047,9 @@ fi
 
 ################################################################################
 %changelog
+* Thu Aug 22 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.5.4-3
+- Fix JAXB library filename
+
 * Fri Aug 16 2024 Andrew Hughes <gnu.andrew@redhat.com> - 11.5.4-2
 - Rebuilt with java-21-openjdk as default JDK:
   https://issues.redhat.com/browse/RHEL-34597
diff --git a/sources b/sources
index 875e7a9..bd0df69 100644
--- a/sources
+++ b/sources
@@ -7,7 +7,7 @@ SHA512 (jackson-jaxrs-json-provider-2.16.1.jar) = 159858d45522a41573a9e2317376bb
 SHA512 (jackson-module-jaxb-annotations-2.16.1.jar) = ab298afa23a4a99935d960581735d005a83dcea7a516c14263c692717b789ff8445ea7b4144d200fc58853ad705a1b947113f06df141526e194e388b9b3f9420
 SHA512 (jakarta.activation-api-2.1.2.jar) = ad77a91afab8dbbde66861ce71367abf660ac21ceee7a2b0829104ceb2add62bf48c0f688e13aedc3ab8acd1967a215ead7291057b88e26295e5f60cb5694e72
 SHA512 (jakarta.annotation-api-1.3.5.jar) = 989a0d1e993c37d00c9860026a4298c65274547b386b4f8053f914e1d614a1a4beba1d9c0dfe09b151d35b2119fea2d41be55d62551b6373830e255602eb3bfe
-SHA512 (jakarta.xml.bind-4.0.1.jar) = 4730c1129719e166488888f4b14edd0a4f180d67b6772b4f58fc24d747da48f84463b2a01437200f07806525662a77251a3ce83375886b7c83f2b0e34ef21add
+SHA512 (jakarta.xml.bind-api-4.0.1.jar) = 4730c1129719e166488888f4b14edd0a4f180d67b6772b4f58fc24d747da48f84463b2a01437200f07806525662a77251a3ce83375886b7c83f2b0e34ef21add
 SHA512 (jboss-jaxrs-2.0-api-1.0.0.Final.jar) = 39a29f9259e7ceb9018447c49d4a18be31aa88775ed7999eff20b2a8f1d8daa25da520c09d0a1c53bf7f417106a64cb2d4f374038ae44511cb60dac1db714495
 SHA512 (jboss-logging-3.5.3.Final.jar) = 2f604d0318a9f10b5c867dbff4ac7a3a608a41a9383cb3fc2ef6364f28396144ead96a0526ae3dea4336109042ead81b9b9318b13e9964b2c57a26794981f5cb
 SHA512 (resteasy-client-3.0.26.Final.jar) = 9f3ea65f9cb045cc2e6f4c06f9b63f8d1f78b36ae419ca8367ce11cdd82e6fe35a2d5847634d71a306e0f6d8e3a69db5930c179cf635f105a8f064becb14f2a2
diff --git a/sources-download.sh b/sources-download.sh
index f8121bf..240fb39 100755
--- a/sources-download.sh
+++ b/sources-download.sh
@@ -18,9 +18,9 @@ download() {
     FILES=$(ssh "${OPTIONS[@]}" $SOURCE rpm -ql $PKG_NAME | sed -n -e "/^\/usr\/share\/java\/.*\.jar$/p")
     for FILE in $FILES
     do
-        echo Downloading $FILE
         FILENAME=$(basename $FILE)
         NAME=$(echo $FILENAME | sed 's/\.jar$//')
+        echo "Downloading $FILE to $NAME-$VERSION$SUFFIX.jar"
         scp "${OPTIONS[@]}" $SOURCE:$FILE $NAME-$VERSION$SUFFIX.jar
     done
 }