diff --git a/.gitignore b/.gitignore
index fab39c7..4033e99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -98,3 +98,4 @@
 /fwupd-1.8.4.tar.xz
 /fwupd-1.8.5.tar.xz
 /fwupd-1.8.6.tar.xz
+/fwupd-1.8.7.tar.xz
diff --git a/fwupd.spec b/fwupd.spec
index a3f7ba1..3d8e15e 100644
--- a/fwupd.spec
+++ b/fwupd.spec
@@ -53,7 +53,7 @@
 
 Summary:   Firmware update daemon
 Name:      fwupd
-Version:   1.8.6
+Version:   1.8.7
 Release:   1%{?dist}
 License:   LGPLv2+
 URL:       https://github.com/fwupd/fwupd
@@ -428,6 +428,19 @@ done
 %endif
 
 %changelog
+* Wed Nov 09 2022 Richard Hughes <richard@hughsie.com> 1.8.7-1
+- New upstream release
+- Add a new HSI check for the leaked Lenovo 'Key Manifest' hashes
+- Allow parsing metadata more than 1MB in size
+- Do not follow symlinks when searching for ESP devices
+- Fix a regression when using fwuptool install-blob with FMAP firmware
+- Measure system integrity when installing UEFI updates
+- Only count the Microsoft hashes when getting the dbx version
+- Only use the IFD when the system is Intel-based
+- Record more host DMI data when submitting a report for dbx failures
+- Support loading CoSWID when only one role has been set
+- Use xz-compressed metadata to reduce bandwidth used by ~25%
+
 * Fri Oct 07 2022 Richard Hughes <richard@hughsie.com> 1.8.6-1
 - New upstream release
 - Allow disabling a DFU device when required
diff --git a/sources b/sources
index 0fcc9de..f16b978 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (fwupd-1.8.6.tar.xz) = c04c9f9e0d46b42c4c4c56738bd9c53a7e17a873defaebe5e262953314f6311937cd0c38db21d4bc9b481760e490024e6c4c059bb73206ed02f24216dd65a74d
+SHA512 (fwupd-1.8.7.tar.xz) = 374339178a1fbf85bc25b47077d0db351b3664a02ec9478c4a5381228125f3bd65ef0be9eb526574bd09ab665aadd6cd9e39f01ebbfebbd338ec191ba24c5a36