diff --git a/.gitignore b/.gitignore
index 6030d6d..123a511 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,4 @@
 /openjdk-21.0.3+9.tar.xz
 /openjdk-21.0.4+1-ea.tar.xz
 /openjdk-21.0.4+5-ea.tar.xz
+/openjdk-21.0.4+7.tar.xz
diff --git a/NEWS b/NEWS
index a44c716..c233994 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,22 @@ New in release OpenJDK 21.0.4 (2024-07-16):
 Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2104
 
+* CVEs
+  - CVE-2024-21131
+  - CVE-2024-21138
+  - CVE-2024-21140
+  - CVE-2024-21145
+  - CVE-2024-21147
+* Security fixes
+  - JDK-8314794: Improve UTF8 String supports
+  - JDK-8319859: Better symbol storage
+  - JDK-8320097: Improve Image transformations
+  - JDK-8320548: Improved loop handling
+  - JDK-8323231: Improve array management
+  - JDK-8323390: Enhance mask blit functionality
+  - JDK-8324559: Improve 2D image handling
+  - JDK-8325600: Better symbol storage
+  - JDK-8327413: Enhance compilation efficiency
 * Other changes
   - JDK-7001133: OutOfMemoryError by CustomMediaSizeName implementation
   - JDK-8159927: Add a test to verify JMOD files created in the images do not have debug symbols
@@ -337,6 +353,8 @@ Live versions of these release notes can be found at:
   - JDK-8331639: [21u]: Bump GHA bootstrap JDK to 21.0.3
   - JDK-8331942: On Linux aarch64, CDS archives should be using 64K alignment by default
   - JDK-8332253: Linux arm32 build fails after 8292591
+  - JDK-8334441: Mark tests in jdk_security_infra group as manual
+  - JDK-8335960: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.4
 
 Notes on individual issues:
 ===========================
diff --git a/java-21-openjdk.spec b/java-21-openjdk.spec
index 8b057e3..2906832 100644
--- a/java-21-openjdk.spec
+++ b/java-21-openjdk.spec
@@ -365,7 +365,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        5
+%global buildver        7
 %global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
@@ -389,7 +389,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -2527,6 +2527,13 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
+- Update to jdk-21.0.4+7 (GA)
+- Update release notes to 21.0.4+7
+- Switch to GA mode.
+- ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
+- Resolves: RHEL-47024
+
 * Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
 - Update to jdk-21.0.4+5 (EA)
 - Update release notes to 21.0.4+5
diff --git a/sources b/sources
index 6b4a0ce..901c340 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.4+5-ea.tar.xz) = 8018a97b988a759490276c29852e21a3b767e2e3c4e0285bd4c0ca7e7d9919c4f3ae01e6b2b70740c0e95606cce430cf04953eebc88514638b425e225eeffa46
+SHA512 (openjdk-21.0.4+7.tar.xz) = 339e7e4833b80d43c8e8c6d9c0f4cb48fa23a73756f11863b2cd4b8f1f5c1d00d29ab9f1d7821bcc8020b3ef15b8a2adbe9c30719df8c9cfc07087b250ef643e