diff --git a/git.spec b/git.spec
index f12729c..2e013b3 100644
--- a/git.spec
+++ b/git.spec
@@ -80,7 +80,7 @@
 %global _package_note_file  %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
 
 Name:           git
-Version:        2.40.0
+Version:        2.40.1
 Release:        1%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT
@@ -1035,6 +1035,9 @@ rmdir --ignore-fail-on-non-empty "$testdir"
 %{?with_docs:%{_pkgdocdir}/git-svn.html}
 
 %changelog
+* Tue Apr 25 2023 Todd Zullinger <tmz@pobox.com> - 2.40.1-1
+- update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
+
 * Mon Mar 13 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-1
 - update to 2.40.0
 
diff --git a/sources b/sources
index fe20049..0ab8e9c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (git-2.40.0.tar.xz) = a2720f8f9a0258c0bb5e23badcfd68a147682e45a5d039a42c47128296c508109d5039029db89311a35db97a9008585e84ed11b400846502c9be913d67f0fd90
-SHA512 (git-2.40.0.tar.sign) = 30376e2487abb247d32b080b37c008dca59067f94f93769197fc2c096ac6a433598578af852f6b343a18e57587f7ff9eac30899393abae0658d68317a5b2fe65
+SHA512 (git-2.40.1.tar.xz) = 9ab41c64c6e666c314683bc4925535e037d43f947b8d327ff7d0379ac12899f4effcc2fe4e47b1ce652ad7140aa4f01f3b99f9cc0cf854cfeface1a5d3e1893e
+SHA512 (git-2.40.1.tar.sign) = b8becacee3736bf2f5c661da4d3f86042544717556e8924a4f385c4966886ffe7558ef05bf5ce58c38e404c477b299f952fd83ed249802ddaf6bd4bf9f3885f8