diff --git a/gpsd.spec b/gpsd.spec
index 7d2320a..11c897d 100644
--- a/gpsd.spec
+++ b/gpsd.spec
@@ -14,7 +14,7 @@
 
 Name:           gpsd
 Version:        3.26.1
-Release:        3%{?dist}
+Release:        4%{?dist}
 Epoch:          1
 Summary:        Service daemon for mediating access to a GPS
 
@@ -384,6 +384,9 @@ rm -rf %{buildroot}%{_docdir}/gpsd
 %{_mandir}/man1/xgpsspeed.1*
 
 %changelog
+* Mon Aug 10 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-4
+- fix command injection in gpsprof (CVE-2026-58459)
+
 * Mon Jan 19 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3
 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
 - fix integer underflow in handling of Navcom packets (CVE-2025-67269)