diff --git a/.gitignore b/.gitignore
index 711f967..cf3ed31 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/ipp-usb-0.9.27.tar.gz
+ipp-usb-0.9.27.tar.gz
diff --git a/.golang-github-openprinting-ipp-usb.metadata b/.golang-github-openprinting-ipp-usb.metadata
deleted file mode 100644
index 3cfad5b..0000000
--- a/.golang-github-openprinting-ipp-usb.metadata
+++ /dev/null
@@ -1 +0,0 @@
-1cc4522eb2f9c3e33a8ad7702b1d50127376ba44 SOURCES/ipp-usb-0.9.27.tar.gz
diff --git a/SPECS/golang-github-openprinting-ipp-usb.spec b/golang-github-openprinting-ipp-usb.spec
similarity index 98%
rename from SPECS/golang-github-openprinting-ipp-usb.spec
rename to golang-github-openprinting-ipp-usb.spec
index 450de77..b56cae8 100644
--- a/SPECS/golang-github-openprinting-ipp-usb.spec
+++ b/golang-github-openprinting-ipp-usb.spec
@@ -24,7 +24,7 @@ Requires:  pkgconfig(libusb-1.0) >= 1.0
 }
 
 Name:           %{goname}
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        HTTP reverse proxy, backed by IPP-over-USB connection to device
 
 # Upstream license specification: BSD-2-Clause
@@ -114,6 +114,9 @@ install -m 0644 -vp ipp-usb-quirks/* %{buildroot}%{_datadir}/ipp-usb/quirks
 %gopkgfiles
 
 %changelog
+* Fri Jan 23 2026 Zdenek Dohnal <zdohnal@redhat.com> - 0.9.27-4
+- rebuild to fix CVE-2025-61729
+
 * Mon Jun 09 2025 Zdenek Dohnal <zdohnal@redhat.com> - 0.9.27-3
 - rebuild to fix CVE-2025-22871
 
diff --git a/sources b/sources
new file mode 100644
index 0000000..03dc755
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+SHA512 (ipp-usb-0.9.27.tar.gz) = 6c56c7f3cc0ff57810de71356103bc1e37db17f555b7bcae8054d66c79e27654728c373baea06dd6cb5810bc6574f22df6acdd05290afae7b10b6e9ba89a1b73