diff --git a/NEWS b/NEWS
index d8616f5..92c7c51 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,15 @@ Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2112
 
 * CVEs
+  - CVE-2026-46968
+  - CVE-2026-46917
+  - CVE-2026-47010
+  - CVE-2026-47021
+  - CVE-2026-47027
+  - CVE-2026-60147
+  - CVE-2026-47059
+  - CVE-2026-47063
+  - CVE-2026-41254
 * Changes
   - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
   - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
diff --git a/java-21-openjdk.spec b/java-21-openjdk.spec
index 26949ee..c0853bc 100644
--- a/java-21-openjdk.spec
+++ b/java-21-openjdk.spec
@@ -9,8 +9,8 @@
 %global updatever 12
 %global patchver 0
 %global buildver 8
-%global portablerelease 1
-%global rpmrelease 2
+%global portablerelease 2
+%global rpmrelease 1
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
@@ -2567,6 +2567,11 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Wed Jul 29 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-2.1
+- Add CVEs to NEWS file
+- Update to tarball with final changeset ID
+- Related: RHEL-188866
+
 * Sat Jul 18 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.2
 - Bump release for PQC build
 - Related: RHEL-212332
diff --git a/sources b/sources
index 8f16c46..e2c0798 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.12+8.tar.xz) = 514c28f1819b12fb6f5a04c3ebc4358d8694135dc9566314dfe7368485e947f0f03e1835f069d0e989768537e953e4b3cd16f294289f6d4e2fbf74fffe9886d8
+SHA512 (openjdk-21.0.12+8.tar.xz) = 6a17226771bf33c4ccd79a42da5f1e2448d5360806353b9741eb49c5ce024f5993dc5ad851f65e9800984b0aa3f7ff508ede619af444ac39ec73ac187fe1b2c7