diff --git a/.gitignore b/.gitignore
index 50734eb..6ddb020 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,3 +70,5 @@
 /dotnet-8.0.125.tar.gz.sig
 /dotnet-8.0.126.tar.gz
 /dotnet-8.0.126.tar.gz.sig
+/dotnet-8.0.127.tar.gz
+/dotnet-8.0.127.tar.gz.sig
diff --git a/dotnet8.0.spec b/dotnet8.0.spec
index 508c7b1..506ed79 100644
--- a/dotnet8.0.spec
+++ b/dotnet8.0.spec
@@ -12,16 +12,16 @@
 # dotnet-host and netstandard-targeting-pack-2.1
 %global is_latest_dotnet 0
 
-%global host_version 8.0.26
-%global runtime_version 8.0.26
-%global aspnetcore_runtime_version %{runtime_version}
-%global sdk_version 8.0.126
+%global host_version 8.0.27
+%global runtime_version 8.0.27
+%global aspnetcore_runtime_version 8.0.27
+%global sdk_version 8.0.127
 %global sdk_feature_band_version %(echo %{sdk_version} | cut -d '-' -f 1 | sed -e 's|[[:digit:]][[:digit:]]$|00|')
 %global templates_version %{runtime_version}
 #%%global templates_version %%(echo %%{runtime_version} | awk 'BEGIN { FS="."; OFS="." } {print $1, $2, $3+1 }')
 
 # upstream can produce releases with a different tag than the SDK or Runtime version
-%global upstream_tag v%{sdk_version}
+%global upstream_tag v8.0.127
 %global upstream_tag_without_v %(echo %{upstream_tag} | sed -e 's|^v||')
 
 %global host_rpm_version %{host_version}
@@ -780,6 +780,10 @@ export COMPlus_LTTng=0
 
 
 %changelog
+* Thu May 28 2026 Omair Majid <omajid@redhat.com> - 8.0.127-2
+- Update to .NET SDK 8.0.127 and Runtime 8.0.27
+- Resolves: RHEL-173922
+
 * Fri Apr 17 2026 Omair Majid <omajid@redhat.com> - 8.0.126-2
 - Update to .NET SDK 8.0.126 and Runtime 8.0.26
 - Resolves: RHEL-163419
diff --git a/release.json b/release.json
index 97e98b9..d871270 100644
--- a/release.json
+++ b/release.json
@@ -1,10 +1,10 @@
 {
-  "release": "8.0.26",
+  "release": "8.0.27",
   "channel": "8.0",
-  "tag": "v8.0.126",
-  "sdkVersion": "8.0.126",
-  "runtimeVersion": "8.0.26",
-  "aspNetCoreVersion": "8.0.26",
+  "tag": "v8.0.127",
+  "sdkVersion": "8.0.127",
+  "runtimeVersion": "8.0.27",
+  "aspNetCoreVersion": "8.0.27",
   "sourceRepository": "https://github.com/dotnet/dotnet",
-  "sourceVersion": "9096b5d74cb74ee028c10649c93e98c8c25ec687"
+  "sourceVersion": "56fc147a7ac76b53fb65b82756da001129b26cc4"
 }
diff --git a/sources b/sources
index 5c5b98a..0d6d17a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (dotnet-8.0.126.tar.gz) = 6f5e6bba3a7a3854ff9e3bec12e1e63557d9273f61c96c49ffca1518c87956cbc79f6ee8faf25df29c846e5e4b1908bc1855d608172bf457c063531349832e0e
-SHA512 (dotnet-8.0.126.tar.gz.sig) = 5472743bd162d67d976c80d01a5736a2ff2fdce3cd7c361d81b035abfb3184cf4dca1966c029a13406becbaf29b47d3ad6c73837cc7a382dbd5e9cd37215b41b
+SHA512 (dotnet-8.0.127.tar.gz) = ba4d00aa416feed87f72fd0474ed4857e33f5ddd8903be139e159ac643fef6016b3f5e502d729db922451d701ce842fd5c33e059a7b98ad31985d58770db78c2
+SHA512 (dotnet-8.0.127.tar.gz.sig) = 5406f055bd8a4733fea8adc0b45ce939a229aa05db5e5ea4e0d528e73cdbd30b79347c3d9ee7f8547a2485494b496106ab563a71cb0a355b1e4fd8fc20bf82b2
diff --git a/update-release b/update-release
index 7da2358..6aeb6cd 100755
--- a/update-release
+++ b/update-release
@@ -1,24 +1,89 @@
 #!/bin/bash
 
-# Usage:
-#     ./update-release sdk-version runtime-version [--bug bug-id] [--tarball tarball-name] [--larger-rpm-release]
-
 set -euo pipefail
 IFS=$'\n\t'
 
+# Notes: this only works with 1xx sdks, the versions shipped in Fedora/RHEL/CentOS Stream.
+
 print_usage() {
     echo " Usage:"
-    echo "     ./update-release sdk-version runtime-version [--bug bug-id] [--tarball tarball-name] [--release-json release-json] [--larger-rpm-release]"
+    echo "     ./update-release [VERSION] [--bootstrap] [--bug bug-id] [--tarball tarball-name] [--release-json release-json] [--larger-rpm-release]"
+    echo ""
+    echo "VERSION can be:"
+    echo " - latest-release: latest release for this major.minor version of .NET (default unless --release-json and --tarball are used)"
+    echo " - exact version (SDK or runtime, eg, 9.0.5 or 10.0.124)"
+    echo " - omitted if --release-json and --tarball are used (uses local mode)"
+    echo " - latest-commit: the latest commit for this major.minor version of .NET"
+    echo ""
+    echo "If not specified, 'latest-release' is the default."
+    echo ""
+    echo "When done, it creates the following files:"
+    echo " - release.json"
+    echo " - git-commit-message: commit message to use with the git commit for the update"
+    echo ""
+    echo ""
+    echo "Options:"
+    echo "   --bootstrap                   Build binary bootstrap artifacts for this release."
+    echo "   --bug bug-id                  Add the named bug/issue identifier to the changelog and commit message."
+    echo "   --tarball tarball-name        Use the supplied tarball. Use with --release-json."
+    echo "   --release-json release-json   Use the supplied release.json. Use with --tarball."
+    echo "   --larger-rpm-release          Set the release to 2."
+    echo ""
 }
 
+download_release_json() {
+    version=$1
+    if [[ "$version" =~ ^[0-9]+\.[0-9]+$ ]]; then
+        # major.minor format. intentionally filter to major.minor.1xx.
+        cat > query <<'EOF'
+        [ .[] | select(.name | test("\\.NET .*\($v)(\\.1\\d{2}| (Preview|RC) \\d+)")) ]
+        | first
+        | { tag_name: .tag_name,
+            tarball: .tarball_url,
+            signature: .assets[].browser_download_url | select(. | endswith("tar.gz.sig")),
+            release_manifest: .assets[] | select(.name == "release.json") | .browser_download_url }
+EOF
+    elif [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+        # major.minor.patch. Might be the SDK version or Runtime version
+        cat > query <<'EOF'
+        [ .[] | select(.name | test("\\.NET .*\($v)")) ]
+        | first
+        | { tag_name: .tag_name,
+            tarball: .tarball_url,
+            signature: .assets[].browser_download_url | select(. | endswith("tar.gz.sig")),
+            release_manifest: .assets[] | select(.name == "release.json") | .browser_download_url }
+EOF
+    else
+        echo "error: unable to parse $version"
+        exit 1
+    fi
+    curl https://api.github.com/repos/dotnet/dotnet/releases \
+        | jq --arg v "$version" --from-file query > release.metadata.github
+    curl -L "$(jq -r .release_manifest release.metadata.github)" -o release.json
+}
+
+assert_file_exists() {
+    file=$1
+    if [[ ! -f "${file}" ]]; then
+        echo "error: ${file} not found"
+        exit 1
+    fi
+}
+
+
 user_provided_tarball_name=""
 
 rpm_release=1
 positional_args=()
 bug_ids=()
+bootstrap=0
 while [[ "$#" -gt 0 ]]; do
     arg="$1"
     case "${arg}" in
+        --bootstrap)
+            bootstrap=1
+            shift;
+            ;;
         --bug)
             bug_ids+=("$2")
             shift;
@@ -30,11 +95,13 @@ while [[ "$#" -gt 0 ]]; do
             ;;
         --release-json)
             release_json="$2"
+            assert_file_exists "${release_json}"
             shift;
             shift;
             ;;
         --tarball)
             user_provided_tarball_name="$2"
+            assert_file_exists "${user_provided_tarball_name}"
             shift;
             shift;
             ;;
@@ -49,49 +116,187 @@ while [[ "$#" -gt 0 ]]; do
     esac
 done
 
-spec_files=( ./*.spec )
-spec_file="${spec_files[0]}"
-
-sdk_version=${positional_args[0]:-}
-if [[ -z ${sdk_version} ]]; then
-    echo "error: missing sdk version"
-    exit 1
-fi
-
-runtime_version=${positional_args[1]:-}
-if [[ -z ${runtime_version} ]]; then
-    echo "error: missing runtime version"
-    exit 1
-fi
-
-host_version="$runtime_version"
-
-tag=v${sdk_version}
-
 set -x
 
-sed -i -E "s|^%global host_version [[:digit:]]\.[[:digit:]]\.[[:digit:]]+|%global host_version ${host_version}|" "$spec_file"
-sed -i -E "s|^%global runtime_version [[:digit:]]\.[[:digit:]]\.[[:digit:]]+|%global runtime_version ${runtime_version}|" "$spec_file"
-sed -i -E "s|^%global sdk_version [[:digit:]]\.[[:digit:]]\.[[:digit:]][[:digit:]][[:digit:]]|%global sdk_version ${sdk_version}|" "$spec_file"
+spec_files=( ./*.spec )
+spec_file="${spec_files[0]}"
+assert_file_exists "$spec_file"
 
+dotnet_major_minor_version=$spec_file
+dotnet_major_minor_version=${dotnet_major_minor_version#./dotnet}
+dotnet_major_minor_version=${dotnet_major_minor_version%.spec}
+if ! [[ "$dotnet_major_minor_version" =~ ^[0-9]+\.[0-9]+$ ]]; then
+    echo "error: Unable to guess the current .NET major.minor version. Expected to get a two-digit .NET version, but got $dotnet_major_minor_version";
+    exit 1
+fi
 
-if [[ -f "dotnet-${tag}.tar.gz" ]]; then
-    echo "dotnet-${tag}.tar.gz already exists, not rebuilding tarball"
+echo "Updating .NET $dotnet_major_minor_version"
+
+version=${positional_args[0]:-}
+sdk_version=""
+created_release_json=0
+
+if [[ ${version} == "" ]]; then
+    if [[ -n "${release_json:-}" ]] || [[ -n "${user_provided_tarball_name:-}" ]]; then
+        if [[ -n "${release_json:-}" ]] && [[ -n "${user_provided_tarball_name:-}" ]]; then
+            version=local
+        else
+            echo "error: please provide both --release-json and --tarball for local-only mode"
+            exit 1
+        fi
+    else
+        version=latest-release
+    fi
+fi
+
+if [[ ${version} == latest-release ]]; then
+    if [[ -n "${release_json:-}" ]]; then
+        echo "error: don't know how to combine upstream latest release's release.json with the locally supplied one"
+        exit 1
+    fi
+    download_release_json "${dotnet_major_minor_version}"
+elif [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then  # matches x.y.z (and x.y.z-preview.N, etc.)
+    if [[ -n "${release_json:-}" ]] && [[ -n "${user_provided_tarball_name:-}" ]] ; then
+        echo "error: don't know how to combine explicit upstream version with release.json and tarball"
+        exit 1
+    fi
+    download_release_json "${version}"
+elif [[ ${version} == latest-commit ]]; then
+    branch=release/${dotnet_major_minor_version}.1xx
+    if [[ ${dotnet_major_minor_version} == 11.0 ]]; then
+        branch=main
+    fi
+
+    cat > query <<EOF
+    [ .[] | select(.name == "$branch") ]
+    | first
+EOF
+    curl https://api.github.com/repos/dotnet/dotnet/branches \
+        | jq --from-file query > release.metadata.github
+    commit=$(jq -r .commit.sha release.metadata.github)
+    jq >release.json <<EOF
+{
+      "release": "$dotnet_major_minor_version",
+      "channel": "$dotnet_major_minor_version",
+      "tag": "$commit",
+      "sdkVersion": "$dotnet_major_minor_version",
+      "runtimeVersion": "$dotnet_major_minor_version",
+      "aspNetCoreVersion": "$dotnet_major_minor_version",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceVersion": "$commit"
+}
+EOF
+    cat release.json
+    created_release_json=1
+elif [[ "${version}" == local ]]; then
+    cp -a "${release_json}" release.json
+else
+    echo "error: don't know what to do"
+    echo ""
+    print_usage
+    exit 1
+fi
+
+cat release.json
+
+aspnetcore_runtime_version=$(jq -r .aspNetCoreVersion release.json)
+runtime_version=$(jq -r .runtimeVersion release.json)
+sdk_version=$(jq -r .sdkVersion release.json)
+tag=$(jq -r .tag release.json)
+tag_without_v=${tag#v}
+
+echo "Updating .NET $dotnet_major_minor_version to SDK ${sdk_version} and Runtime ${runtime_version}"
+
+if [[ $bootstrap == 0 ]]; then
+    sed -i -E "s|^%bcond_with.*bootstrap$|%bcond_with bootstrap|" "$spec_file"
+else
+    sed -i -E "s|^%bcond_with.*bootstrap$|%bcond_without bootstrap|" "$spec_file"
+fi
+
+sed -i -E "s|^%global upstream_tag .*$|%global upstream_tag ${tag}|" "$spec_file"
+
+if [[ "$dotnet_major_minor_version" == "8.0" ]]; then
+    sed -i -E "s|^%global host_version .*$|%global host_version ${runtime_version}|" "$spec_file"
+    # other major versions set/define host_version as a variable based on runtime_version.
+fi
+sed -i -E "s|^%global runtime_version .*$|%global runtime_version ${runtime_version}|" "$spec_file"
+sed -i -E "s|^%global aspnetcore_runtime_version .*$|%global aspnetcore_runtime_version ${aspnetcore_runtime_version}|" "$spec_file"
+sed -i -E "s|^%global sdk_version .*$|%global sdk_version ${sdk_version}|" "$spec_file"
+
+if [[ $runtime_version = *preview* ]] || [[ $runtime_version = *rc* ]]; then
+    # For Preview/RC releases, convert x.y.z-preview.a.b to x.y.z~preview.a.b (replace - with ~)
+    # https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/#_handling_non_sorting_versions_with_tilde_dot_and_caret
+    runtime_rpm_version=${runtime_version/-/\~}
+    aspnetcore_runtime_rpm_version=${aspnetcore_runtime_version/-/\~}
+    sdk_rpm_version=${sdk_version/-/\~}
+    sed -i -E "s|^(%global runtime_rpm_version) .*$|\1 ${runtime_rpm_version}|" "$spec_file"
+    sed -i -E "s|^(%global aspnetcore_runtime_rpm_version) .*$|\1 ${aspnetcore_runtime_rpm_version}|" "$spec_file"
+    sed -i -E "s|^(%global sdk_rpm_version) .*$|\1 ${sdk_rpm_version}|" "$spec_file"
+else
+    # For GA releases replace rpm versions with rpm macros for the actual version
+    sed -i -E "s|^(%global runtime_rpm_version) .*$|\1 %{runtime_version}|" "$spec_file"
+    sed -i -E "s|^(%global aspnetcore_runtime_rpm_version) .*$|\1 %{aspnetcore_runtime_version}|" "$spec_file"
+    sed -i -E "s|^(%global sdk_rpm_version) .*$|\1 %{sdk_version}|" "$spec_file"
+fi
+
+if [[ -f "dotnet-${tag_without_v}.tar.gz" ]]; then
+    echo "dotnet-${tag_without_v}.tar.gz already exists, not rebuilding tarball"
 elif [[ -n ${user_provided_tarball_name} ]]; then
-    tag_without_v=${tag#v}
-    cp -a "${user_provided_tarball_name}" dotnet-${tag_without_v}.tar.gz
+    cp -a "${user_provided_tarball_name}" "dotnet-${tag_without_v}.tar.gz"
+    # signature file can be located anywhere under the directory tree, so find it.
     signature_name=$(basename "${user_provided_tarball_name}.sig")
     user_tarball_dir=$(dirname "${user_provided_tarball_name}" )
     # intentionally unquoted, since it can be blank
     # shellcheck disable=SC2116,SC2086
     signature_path=$(find $user_tarball_dir -iname "${signature_name}")
+    if [[ "${signature_path}" == "" ]]; then
+        echo "error: unable to find signature file for ${user_provided_tarball_name}"
+        exit 1
+    fi
     cp -a "${signature_path}" "dotnet-${tag_without_v}.tar.gz.sig"
-    cp -a "${release_json}" release.json
-else
-    rm -f release.json
+else # Download the original/pristine bits from upstream
+    if [[ $created_release_json == 0 ]]; then
+        # If we didn't create the release.json, then delete it so spectool -g can download a fresh copy
+        rm -f release.json
+    fi
     spectool -g "$spec_file"
 fi
 
+# TODO add optional gpg signature verification
+
+if [[ $bootstrap == 1 ]]; then
+    if [[ $dotnet_major_minor_version == 8.0 ]]; then
+        # TODO: create generic bootstrap support for 8.0
+        echo "--bootstrap not implemented for .NET 8.0"
+        exit 1
+    elif [[ $dotnet_major_minor_version == 9.0 ]]; then
+        # For .NET 9, we bootstrap x64 and aarch64 using Microsoft binaries, and ppc64le and s390x using custom binaries
+        ./build-dotnet-bootstrap-tarball "$tag"
+        tar xf "dotnet-$tag-x64-bootstrap.tar.gz" "dotnet-$tag-x64-bootstrap/global.json"
+        bootstrap_sdk_version=$(jq -r .tools.dotnet "dotnet-$tag-x64-bootstrap/global.json")
+        sed -i -E "s|^(%global bootstrap_sdk_version) .*$|\1 ${bootstrap_sdk_version}|" "$spec_file"
+        spectool -g "$spec_file"
+
+        if [ -f re-build-all-bootstrap ]; then
+            ./re-build-all-bootstrap "${tag}"
+        fi
+    else
+        # For .NET 10 and later, defer all bootstrapping to build-dotnet-bootstrap-tarball script
+        tar xf "dotnet-${tag_without_v}.tar.gz" "dotnet-${tag_without_v}/global.json"
+        bootstrap_sdk_version=$(jq -r .tools.dotnet "dotnet-${tag_without_v}/global.json")
+        sed -i -E "s|^(%global bootstrap_sdk_version) .*$|\1 ${bootstrap_sdk_version}|" "$spec_file"
+
+        ./build-dotnet-bootstrap-tarball "${tag_without_v}"
+
+        if [ -f dotnet-prebuilts*ppc64le*tar.gz ]; then
+            file_name=$(ls -1 -t dotnet-prebuilts-*-ppc64le.tar.gz | head -1)
+            bootstrap_sdk_version_ppc64le_s390x=$(basename "$file_name" | sed -E -e 's/dotnet-prebuilts-//' -e 's/-ppc64le.tar.gz//')
+
+            sed -E -i "s|^%global bootstrap_sdk_version_ppc64le_s390x .*$|%global bootstrap_sdk_version_ppc64le_s390x $bootstrap_sdk_version_ppc64le_s390x|" "$spec_file"
+        fi
+    fi
+fi
+
 comment="Update to .NET SDK ${sdk_version} and Runtime ${runtime_version}"
 commit_message="$comment
 "