diff --git a/.gitignore b/.gitignore
index 55afd28..a26c89e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,4 @@
 /nssadapter-0.1.1.tar.xz
 /openjdk-25.0.3+9.tar.xz
 /openjdk-25.0.4+7.tar.xz
+/openjdk-25.0.4.1+1.tar.xz
diff --git a/NEWS b/NEWS
index 6f683a4..819ef2c 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,24 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
+New in release OpenJDK 25.0.4.1 (2026-08-18):
+=============================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk25041
+
+* CVEs
+  - CVE-2026-60589
+  - CVE-2026-61308
+  - CVE-2026-70906
+  - CVE-2026-70907
+* Changes
+  - JDK-8382471: Improve Resource Resolving
+  - JDK-8384708: Enhance HTTP Connections
+  - JDK-8386205: Enhance TLS server
+  - JDK-8386298: Improve font loading
+  - JDK-8388788: Bump update version for OpenJDK: jdk-25.0.4.1
+  - JDK-8389945: [25u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 25.0.4.1
+
 New in release OpenJDK 25.0.4 (2026-07-21):
 ===========================================
 Live versions of these release notes can be found at:
diff --git a/java-25-openjdk.spec b/java-25-openjdk.spec
index dbc67af..3422e12 100644
--- a/java-25-openjdk.spec
+++ b/java-25-openjdk.spec
@@ -7,9 +7,9 @@
 %global featurever 25
 %global interimver 0
 %global updatever 4
-%global patchver 0
-%global buildver 7
-%global portablerelease 2
+%global patchver 1
+%global buildver 1
+%global portablerelease 1
 %global rpmrelease 1
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
@@ -1867,6 +1867,7 @@ The %{origin_nice} %{featurever} cryptography adapter library.
 
 echo "Preparing %{oj_vendor_version}"
 echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"
+echo "Portable suffix is %{?pkgos}%{!?pkgos:unset}"
 
 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
 %if 0%{?stapinstall:1}
@@ -2595,6 +2596,13 @@ exit 0
 %endif
 
 %changelog
+* Fri Aug 07 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.1.1-1.1
+- Update to jdk-25.0.4.1+1 (GA)
+- Update release notes to 25.0.4.1+1
+- Report pkgos value during build
+- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
+- Resolves: RHEL-235632
+
 * Thu Jul 23 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-2.1
 - Add CVEs to NEWS file
 - Update to tarball with final changeset ID
diff --git a/sources b/sources
index 33c44a9..bdecbd3 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
 SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9
-SHA512 (openjdk-25.0.4+7.tar.xz) = 736949ba57d6e36df1b4f85418b2a27d3e0aec7e4b492ef5d9c006355ede63db3f5f9e0e0ea2d63bea119d9baaa9cf5a92e14dad19e69e9351072ef0955ea2cf
+SHA512 (openjdk-25.0.4.1+1.tar.xz) = e5f0aeec7d52671869ed46fda5c59f041d321c0ad989861a2eb2eb70b513bba9e297e09aa70256f26af6c3ac0269c8aaacc134fe49cbba99b9035e158b90fca0