diff --git a/.gitignore b/.gitignore
index dd7e8d3..780130e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,4 @@
 /jdk-updates-jdk11u-jdk-11.0.15+9-4curve.tar.xz
 /jdk-updates-jdk11u-jdk-11.0.15+10-4curve.tar.xz
 /openjdk-jdk11u-jdk-11.0.16+7-4curve.tar.xz
+/openjdk-jdk11u-jdk-11.0.16+8-4curve.tar.xz
diff --git a/NEWS b/NEWS
index dd72713..b365726 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,15 @@ Live versions of these release notes can be found at:
   * https://bitly.com/openjdk11016
   * https://builds.shipilev.net/backports-monitor/release-notes-11.0.16.txt
 
+* Security fixes
+  - JDK-8277608: Address IP Addressing
+  - JDK-8272243: Improve DER parsing
+  - JDK-8272249: Better properties of loaded Properties
+  - JDK-8281859, CVE-2022-21540: Improve class compilation
+  - JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
+  - JDK-8283190: Improve MIDI processing
+  - JDK-8284370: Improve zlib usage
+  - JDK-8285407, CVE-2022-34169: Improve Xalan supports
 * Other changes
   - JDK-6986863: ProfileDeferralMgr throwing ConcurrentModificationException
   - JDK-7124293: [macosx] VoiceOver reads percentages rather than the actual values for sliders.
@@ -251,7 +260,6 @@ Live versions of these release notes can be found at:
   - JDK-8284620: CodeBuffer may leak _overflow_arena
   - JDK-8284622: Update versions of some Github Actions used in JDK workflow
   - JDK-8284756: [11u] Remove unused isUseContainerSupport in CgroupV1Subsystem
-  - JDK-8284920: Incorrect Token type causes XPath expression to return empty result
   - JDK-8285395: [JVMCI] [11u] Partial backport of JDK-8220623: InstalledCode
   - JDK-8285397: JNI exception pending in CUPSfuncs.c:250
   - JDK-8285445: cannot open file "NUL:"
diff --git a/java-11-openjdk.spec b/java-11-openjdk.spec
index 7fcbc97..aea6fa0 100644
--- a/java-11-openjdk.spec
+++ b/java-11-openjdk.spec
@@ -365,8 +365,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      1
+%global buildver        8
+%global rpmrelease      2
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -394,7 +394,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global ea_designator ""
 %global ea_designator_zip ""
@@ -2592,6 +2592,12 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Fri Jul 22 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-2
+- Update to jdk-11.0.16+8
+- Update release notes to 11.0.16+8
+- Switch to GA mode for release
+- Resolves: rhbz#2106517
+
 * Sat Jul 16 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.7-0.1.ea
 - Update to jdk-11.0.16+7
 - Update release notes to 11.0.16+7
diff --git a/sources b/sources
index 9e50797..7cd8865 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-jdk11u-jdk-11.0.16+7-4curve.tar.xz) = a7cb722c123da2e599f24a6c54b94c9934776cd2a5c3a7b303497e08a51f8e95a71ae9f0d9a0e32c263a5b385b7701c5a9d77229d98552366b5ec34179b7f0bc
+SHA512 (openjdk-jdk11u-jdk-11.0.16+8-4curve.tar.xz) = 5adbf9650406f3bce7cb73b7ad9815b8545246227db8b60e0775a9394014670acb01fa855c942bf15cd8dbffdbf406ed73511cc5c9d0fcfbbaf7e3d3cc85da33