diff --git a/.gitignore b/.gitignore
index 3580c28..d989022 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@
 /flatpak-0.6.10.tar.xz
 /flatpak-0.6.11.tar.xz
 /flatpak-0.6.12.tar.xz
+/flatpak-0.6.13.tar.xz
diff --git a/flatpak.spec b/flatpak.spec
index 2b663dc..8eccdc9 100644
--- a/flatpak.spec
+++ b/flatpak.spec
@@ -1,8 +1,9 @@
-%global bubblewrap_version 0.1.2
-%global ostree_version 2016.10
+# Although technically 0.1.2 satisfies configure, 0.1.3 has a security fix.
+%global bubblewrap_version 0.1.3
+%global ostree_version 2016.12
 
 Name:           flatpak
-Version:        0.6.12
+Version:        0.6.13
 Release:        1%{?dist}
 Summary:        Application deployment framework for desktop apps
 
@@ -186,6 +187,9 @@ flatpak remote-list --system
 
 
 %changelog
+* Tue Oct 25 2016 David King <amigadave@amigadave.com> - 0.6.13-1
+- Update to 0.6.13
+
 * Thu Oct 06 2016 David King <amigadave@amigadave.com> - 0.6.12-1
 - Update to 0.6.12
 
diff --git a/sources b/sources
index 22ef3ca..4a8f2ec 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-ac5f82aab67c1b8a13bfc94376f65085  flatpak-0.6.12.tar.xz
+571c2a6c6f5c547dea14b907cfce2d36  flatpak-0.6.13.tar.xz