diff --git a/.gitignore b/.gitignore
index 86a25ac..52494ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 /edk2-*.tar.gz
 /softfloat-20180726-gitb64af41.tar.xz
 /qemu-ovmf-secureboot-20190521-gitf158f12.tar.xz
+/qemu-ovmf-secureboot-20200228-gitc3e16b3.tar.xz
diff --git a/edk2.spec b/edk2.spec
index e0cbf69..1636f63 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -5,7 +5,7 @@
 %global edk2_stable_date 202008
 %global edk2_stable_str  edk2-stable%{edk2_stable_date}
 %global openssl_version  1.1.1g
-%global qosb_version     20190521-gitf158f12
+%global qosb_version     20200228-gitc3e16b3
 %global softfloat_version 20180726-gitb64af41
 
 # Enable this to skip secureboot enrollment, if problems pop up
@@ -46,7 +46,7 @@ Name:           edk2
 # to use YYYMMDD to avoid needing to bump package epoch
 # due to previous 'git' Version:
 Version:        %{edk2_stable_date}01stable
-Release:        2%{dist}
+Release:        3%{dist}
 Summary:        EFI Development Kit II
 
 License:        BSD-2-Clause-Patent
@@ -122,6 +122,7 @@ BuildRequires:  genisoimage
 BuildRequires:  bc
 BuildRequires:  sed
 BuildRequires:  perl
+BuildRequires:  findutils
 
 # These are for QOSB
 BuildRequires:  python3-requests
@@ -281,7 +282,7 @@ CC_FLAGS="$CC_FLAGS --cmd-len=65536 -b DEBUG --hash"
 CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"
 CC_FLAGS="$CC_FLAGS -D NETWORK_TLS_ENABLE"
 CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE"
-CC_FLAGS="$CC_FLAGS -D TPM2_ENABLE"
+CC_FLAGS="$CC_FLAGS -D TPM_ENABLE"
 
 # ovmf features
 OVMF_FLAGS="${CC_FLAGS}"
@@ -390,6 +391,7 @@ dd of="arm/vars-template-pflash.raw" if="/dev/zero" bs=1M count=64
 %if 0%{?build_ovmf_x64:1}
 %if 0%{?qosb_testing}
 %if !%{skip_enroll}
+KERNELPATH="$(find /lib/modules -name vmlinuz | head -1)"
 python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
     --qemu-binary /usr/bin/qemu-system-x86_64 \
     --ovmf-binary ovmf/OVMF_CODE.secboot.fd \
@@ -398,7 +400,8 @@ python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
     --skip-enrollment \
     --print-output \
     --no-download \
-    --kernel-path `rpm -ql kernel-core | grep "\/vmlinuz$" -m 1` \
+    -vv \
+    --kernel-path "$KERNELPATH" \
     ovmf/OVMF_VARS.secboot.fd
 %endif
 %endif
@@ -595,6 +598,9 @@ install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_
 
 
 %changelog
+* Thu Dec 03 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-3
+- Really fix TPM breakage (bz 1897367)
+
 * Tue Nov 24 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-2
 - Fix openssl usage, unbreak TPM (bz 1897367)
 
diff --git a/sources b/sources
index 7fcdcef..60fe829 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
-SHA512 (qemu-ovmf-secureboot-20190521-gitf158f12.tar.xz) = 4dde79864996398cc8cc39cdf859c1ca64ca0d360b0e5e41af9d9f054d36e1c4999e4324c5140a7329bec9b8d131e773ab8ebc28aba8d3f9f63c25517ee9221a
 SHA512 (edk2-stable202008.tar.gz) = c32340104f27b9b85f79e934cc9eeb739d47b01e13975c88f39b053e9bc5a1ecfe579ab3b63fc7747cc328e104b337b53d41deb4470c3f20dbbd5552173a4666
 SHA512 (openssl-1.1.1g-hobbled.tar.xz) = 7cd351d8fd4a028edcdc6804d8b73af7ff5693ab96cafd4f9252534d4e8e9000e22aefa45f51db490da52d89f4e5b41d02452be0b516fbb0fe84e36d5ca54971
+SHA512 (qemu-ovmf-secureboot-20200228-gitc3e16b3.tar.xz) = 123889b9277adda472035f72e4836b6fe8e0cd8e2e87d28400bbc846ea1308378fc7aae413d463e0c1bfda096d85e51be100eb8d7dfb0738707c3412f2855711