diff --git a/.gitignore b/.gitignore
index 8f70267..f7e323e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -77,3 +77,4 @@
 /fwupd-1.5.6.tar.xz
 /fwupd-1.5.7.tar.xz
 /fwupd-1.5.8.tar.xz
+/fwupd-1.5.9.tar.xz
diff --git a/fwupd.spec b/fwupd.spec
index d5a804c..02e65dc 100644
--- a/fwupd.spec
+++ b/fwupd.spec
@@ -43,7 +43,7 @@
 
 Summary:   Firmware update daemon
 Name:      fwupd
-Version:   1.5.8
+Version:   1.5.9
 Release:   1%{?dist}
 License:   LGPLv2+
 URL:       https://github.com/fwupd/fwupd
@@ -494,6 +494,20 @@ done
 %endif
 
 %changelog
+* Tue Apr 13 2021 Richard Hughes <richard@hughsie.com> 1.5.9-1
+- New upstream release
+- Avoid runtime warning in dfu-tool
+- Detect address overflow when parsing invalid Intel HEX files
+- Do not timeout when bluez fails to start
+- Fix a crash when checking if the dbx update is safe to apply
+- Fix a possible crash if the user set WacomI2cFlashBlockSize manually
+- Fix array access when using fwupmgr verify-update
+- Include crt0 for arm and aarch64 that add a SBAT section
+- Retry the request to fix enumeration failure of Synaptics CXAudio
+- Set device activation requirement correctly in all cases
+- Set dual-bank property on more Lenovo display hardware
+- Tweak the SBAT output for a vendor string
+
 * Wed Mar 24 2021 Richard Hughes <richard@hughsie.com> 1.5.8-1
 - New upstream release
 - Add D501 Baklava device support
diff --git a/sources b/sources
index 2775529..6f5e19f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (fwupd-1.5.8.tar.xz) = 433432da47780d27cd6bbc3a7b4be6db1740dc1b7ac5474cd170fff4f022ec89960d03c34d4a750d117d71fa6303ce456e7d1868b14121ae65f7525e420103e8
+SHA512 (fwupd-1.5.9.tar.xz) = 1d22bb9759bb0fa6a9030c83b3372ffd02f812c34e4d60f83cbacf5793d68dd846b353a3f127eccfb8f2cdcd329ba09320465cd2f0fe422dea13738e5b0b47ed