diff --git a/.gitignore b/.gitignore
index 5222b94..d6d271b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -64,3 +64,4 @@
 /jdk-updates-jdk11u-jdk-11.0.9+3-4curve.tar.xz
 /jdk-updates-jdk11u-jdk-11.0.9+4-4curve.tar.xz
 /jdk-updates-jdk11u-jdk-11.0.9+5-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.9+6-4curve.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index a320ee5..8a842ce 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -4,7 +4,7 @@
 # Example:
 # When used from local repo set REPO_ROOT pointing to file:// with your repo
 # If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
-# If you want to use a local copy of patch PR3751, set the path to it in the PR3751 variable
+# If you want to use a local copy of patch PR3802, set the path to it in the PR3802 variable
 #
 # In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
 # PROJECT_NAME=jdk
@@ -26,9 +26,9 @@
 # level folder, name is created, based on parameter
 #
 
-if [ ! "x$PR3751" = "x" ] ; then
-  if [ ! -f "$PR3751" ] ; then
-    echo "You have specified PR3751 as $PR3751 but it does not exist. Exiting"
+if [ ! "x$PR3802" = "x" ] ; then
+  if [ ! -f "$PR3802" ] ; then
+    echo "You have specified PR3802 as $PR3802 but it does not exist. Exiting"
     exit 1
   fi
 fi
@@ -48,7 +48,7 @@ if [ "x$1" = "xhelp" ] ; then
     echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
     echo "REPO_ROOT - the location of the Mercurial repository to archive (optional; defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
     echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
-    echo "PR3751 - the path to the PR3751 patch to apply (optional; downloaded if unavailable)"
+    echo "PR3802 - the path to the PR3802 patch to apply (optional; downloaded if unavailable)"
     exit 1;
 fi
 
@@ -126,17 +126,17 @@ pushd "${FILE_NAME_ROOT}"
 	    rm -vf ${CRYPTO_PATH}/ecp_224.c
 
             echo "Syncing EC list with NSS"
-            if [ "x$PR3751" = "x" ] ; then
-                # get pr3751.patch (from http://icedtea.classpath.org/hg/icedtea11) from most correct tag
+            if [ "x$PR3802" = "x" ] ; then
+                # get pr3802.patch (from http://icedtea.classpath.org/hg/icedtea11) from most correct tag
                 # Do not push it or publish it (see http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3751)
-		echo "PR3751 not found. Downloading..."
-		wget http://icedtea.classpath.org/hg/icedtea11/raw-file/tip/patches/pr3751.patch
-	        echo "Applying ${PWD}/pr3751.patch"
-		patch -Np1 < pr3751.patch
-		rm pr3751.patch
+		echo "PR3802 not found. Downloading..."
+		wget http://icedtea.classpath.org/hg/icedtea11/raw-file/tip/patches/pr3802-4curve.patch
+	        echo "Applying ${PWD}/pr3802.patch"
+		patch -Np1 < pr3802.patch
+		rm pr3802.patch
 	    else
-		echo "Applying ${PR3751}"
-		patch -Np1 < $PR3751
+		echo "Applying ${PR3802}"
+		patch -Np1 < $PR3802
             fi;
             find . -name '*.orig' -exec rm -vf '{}' ';'
         popd
diff --git a/java-11-openjdk.spec b/java-11-openjdk.spec
index 82e4935..97b6a55 100644
--- a/java-11-openjdk.spec
+++ b/java-11-openjdk.spec
@@ -258,7 +258,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global minorver        0
-%global buildver        5
+%global buildver        6
 %global rpmrelease      0
 #%%global tagsuffix      ""
 # priority must be 8 digits in total; untill openjdk 1.8 we were using 18..... so when moving to 11 we had to add another digit
@@ -1962,6 +1962,11 @@ require "copy_jdk_configs.lua"
 
 
 %changelog
+* Tue Sep 15 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.6-0.0.ea
+- Update to jdk-11.0.9+6 (EA)
+- Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
+- Resolves: rhbz#1869017
+
 * Tue Sep 08 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.5-0.0.ea
 - Update to jdk-11.0.9+5 (EA)
 
diff --git a/sources b/sources
index e8f530a..a776d0a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-3.15.0.tar.xz) = c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (jdk-updates-jdk11u-jdk-11.0.9+5-4curve.tar.xz) = e3a4f580a3e69724772cd2d5716cae3e714368761aedb8c23d85b25f125bea10c0980d1df3ba03095da72a55490b1b7e9236f72a0381819bcd8107e57f5fe542
+SHA512 (jdk-updates-jdk11u-jdk-11.0.9+6-4curve.tar.xz) = 8eab79248c68b931d2c9eee07e88fe78a1289c37bbb0a315545c1a7fad64886fb7e9c21941edef7f8b84b3633d8f17a9ec1edef3de307cee8fe17222a997834b