diff --git a/.gitignore b/.gitignore
index 982368a..6a24eae 100644
--- a/.gitignore
+++ b/.gitignore
@@ -624,3 +624,5 @@ firefox-3.6.4.source.tar.bz2
 /nss-3.90.0-3.el9_0.src.rpm
 /firefox-128.0b5.processed-source.tar.xz
 /firefox-langpacks-128.0b5-20240620.tar.xz
+/firefox-langpacks-128.0esr-20240709.tar.xz
+/firefox-128.0esr.processed-source.tar.xz
diff --git a/firefox.spec b/firefox.spec
index 8b9cc9d..41dbd1c 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -55,7 +55,7 @@ end}
     %global system_nss        0
   %endif
 %endif
-%if 0%{?rhel} == 9
+%if 0%{?rhel} >= 9
   %if %{rhel_minor_version} <= 0
     # FIXME 1
     %global bundle_nss        0
@@ -121,7 +121,7 @@ end}
 %global mozappdir            %{_libdir}/firefox
 %global langpackdir          %{mozappdir}/browser/extensions
 %define bundled_install_path %{mozappdir}/bundled
-%global pre_version          b5
+%global pre_version          esr
 # Workaround the dreaded "upstream source file changed content" rpminspect failure.
 # If set to .b2 or .b3 ... the processed source file needs to be renamed before upload, e.g.
 # firefox-102.8.0esr.b2.processed-source.tar.xz
@@ -141,7 +141,7 @@ Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
-%if 0%{?rhel} == 9
+%if 0%{?rhel} >= 9
 ExcludeArch:    %{ix86}
 %endif
 %if 0%{?rhel} == 8
@@ -167,7 +167,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240620.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240709.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -309,7 +309,7 @@ BuildRequires:  rustfmt >= %{rust_version}
 BuildRequires:  rust >= %{rust_version}
 %endif
 
-%if 0%{?rhel} == 9
+%if 0%{?rhel} >= 9
 BuildRequires:  cargo
 BuildRequires:  clang clang-libs llvm llvm-devel
 BuildRequires:  gcc
@@ -402,12 +402,14 @@ BuildRequires:  xorg-x11-fonts-misc
 BuildRequires:  xorg-x11-server-Xvfb
 %endif
 
-%if 0%{?rhel} == 8 && %{rhel_minor_version} < 6
-  %ifarch aarch64
-BuildRequires: gcc-toolset-13-gcc-plugin-annobin
+%if 0%{?use_dts}
+  %if 0%{?rhel} == 8 && %{rhel_minor_version} < 6
+    %ifarch aarch64
+      BuildRequires: gcc-toolset-13-gcc-plugin-annobin
+    %endif
   %endif
-%endif
 BuildRequires: gcc-toolset-13
+%endif
 
 Requires:       mozilla-filesystem
 Requires:       p11-kit-trust
@@ -1120,7 +1122,7 @@ echo "ac_add_options --with-google-safebrowsing-api-keyfile=`pwd`/google-api-key
 # May result in empty --with-libclang-path= in earlier versions.
 # So far this is needed only for c8s/c9s.
 #if (0%{?rhel} == 8 && %{rhel_minor_version} >= 10) || (0%{?rhel} == 9 && %{rhel_minor_version} >= 4)
-%if (0%{?rhel} == 8) || (0%{?rhel} == 9)
+%if 0%{?rhel} >= 8
 # Clang 17 upstream's detection fails, tell it where to look.
 echo "ac_add_options --with-libclang-path=`llvm-config --libdir`" >> .mozconfig
 %endif
@@ -1222,7 +1224,10 @@ set +e
 source scl_source enable gcc-toolset-12
   %endif
 %endif
+# This is definitely wrong, but I need things going on RHEL 10
+%if 0%{?rhel} < 10
 source scl_source enable gcc-toolset-13
+%endif
 %if 0%{?use_dts}
 source scl_source enable devtoolset-%{dts_version}
 %endif
@@ -1565,7 +1570,7 @@ ln -s %{mozappdir}/defaults/preferences $RPM_BUILD_ROOT/%{mozappdir}/browser/def
 sed -i -e 's|%PREFIX%|%{_prefix}|' %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
 sed -i -e 's|%HOMEPAGE%|%{homepage}|' %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
 # Enable modern crypto for the key export on the RHEL9 only (rhbz#1764205)
-%if 0%{?rhel} == 9
+%if 0%{?rhel} >= 9
   echo 'pref("security.pki.use_modern_crypto_with_pkcs12", true);' >> %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
 %endif
 
@@ -1736,6 +1741,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Wed Jul 10 2024 Tomas Popela <tpopela@redhat.com> - 128.0-1
+- Update to 128.0
+
 * Thu Jun 20 2024 Jan Horak <jhorak@redhat.com> - 128.0b5-1
 - Update to 128.0b5
 
diff --git a/sources b/sources
index 082eecf..d8c472f 100644
--- a/sources
+++ b/sources
@@ -1,7 +1,7 @@
 SHA512 (cbindgen-vendor.tar.xz) = 0c7a40033ccd38dadd30ad064feef390444af4562be07d3dfd0c4cccc55821b01b5228ddee367d0af3bd1b4ef9b1552cdd104506579b020ac1940a7c536b8b68
-SHA512 (firefox-128.0b5.processed-source.tar.xz) = f648bb104fc2dfa54203a5a12f34709388cf43dea320e2c076059fd7fe9886e36ad9d22bdbf90b158535e59547a80fa0cdeebe2e9e3da9d47eb00b8a13766f39
-SHA512 (firefox-langpacks-128.0b5-20240620.tar.xz) = 776f94c91767dd1f30f5fc5a5f123899fed9ac76793f1482d86559f8bf88ba792c11e51f1d76641d47cf003692cdb50d5e086995b9490d0b7dca0231dc7c4e8e
 SHA512 (mochitest-python.tar.gz) = 089b1593068b76f4572af0086eaccf52a6a1299bfffb58593206d19bf021ae381f2380bbfeb4371586cd53706ff6dde3d240238b2caf19b96c57dfc2f4524e36
 SHA512 (nspr-4.35.0-1.el8_1.src.rpm) = 5123a443fcc42602e31104999be339ae899eb7b1f1e2f1ea87ba4f283eb894d08ab568e421dba1df4770f23be91ff88aa6a0748bce7feef31ed88bee5bdecb2c
 SHA512 (nss-3.90.0-3.el8_1.src.rpm) = 81df24bd4eda4935888170e994834f4510c20fa51079631527b195b723d8f536ec4144d4a2e5d45768aeec7c426d50d70d0a294577d18233acc07c49c8af5130
 SHA512 (nss-3.90.0-3.el9_0.src.rpm) = f321b9c1bda0b09eee564e2903023435851a4ff2e55bdd5b03012ca51be7999b18d85061f874065d0b25913721eb574f49746a3111f8f1cdd5b21268dddd8367
+SHA512 (firefox-langpacks-128.0esr-20240709.tar.xz) = 064c09b6dafcae3e5336b04e81b0ca062f59f83cd001da650215e6587947c2127ca1b320c464f32652f1ee3b40879444c78979b9b8744ef517cee70e3dc7ab9c
+SHA512 (firefox-128.0esr.processed-source.tar.xz) = 20558767e5d70ea9bf5d9977cc9996427884538052d2f71af6f75c651c9a6213fa080029c7e3d41e592c0057228026ab039291c4dcff5d70f49c74ee00e7a25d