diff --git a/.gitignore b/.gitignore
index 1cf82cf..082bfe0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,4 @@ jss-4.2.6.tar.gz
 /jss-5.5.0-alpha3.tar.gz
 /jss-5.5.0.tar.gz
 /jss-5.6.0-alpha1.tar.gz
+/jss-5.6.0.tar.gz
diff --git a/jss.spec b/jss.spec
index 22ac541..b964869 100644
--- a/jss.spec
+++ b/jss.spec
@@ -2,6 +2,7 @@
 Name:           jss
 ################################################################################
 
+# Note: This is required for IdM. Don't remove or merge upstream.
 %global         vendor_id idm
 %global         product_id %{vendor_id}-jss
 
@@ -13,20 +14,20 @@ Name:           jss
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
 # - GA/update (supported): <n> where n >= 1
-%global         release_number 0.1
+%global         release_number 1
 
 # Development phase:
 # - development (unsupported): alpha<n> where n >= 1
 # - stabilization (unsupported): beta<n> where n >= 1
 # - GA/update (supported): <none>
-%global         phase alpha1
+#global         phase
 
 %undefine       timestamp
 %undefine       commit_id
 
 Summary:        Java Security Services (JSS)
 URL:            https://github.com/dogtagpki/jss
-License:        (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0
+License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
 Version:        %{major_version}.%{minor_version}.%{update_version}
 Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
 
@@ -56,19 +57,24 @@ ExcludeArch: i686
 # Java
 ################################################################################
 
+# use Java 17 on Fedora 39 or older and RHEL 9 or older
+# otherwise, use Java 21
+
+# maven-local is a subpackage of javapackages-tools
+
 %if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9
 
-# use Java 17 on Fedora 39 or older and RHEL 9 or older
 %define java_devel java-17-openjdk-devel
 %define java_headless java-17-openjdk-headless
 %define java_home %{_jvmdir}/jre-17-openjdk
+%define maven_local maven-local-openjdk17
 
 %else
 
-# otherwise, use Java 21
 %define java_devel java-21-openjdk-devel
 %define java_headless java-21-openjdk-headless
 %define java_home %{_jvmdir}/jre-21-openjdk
+%define maven_local maven-local
 
 %endif
 
@@ -96,11 +102,11 @@ BuildRequires:  zip
 BuildRequires:  unzip
 
 BuildRequires:  gcc-c++
-BuildRequires:  nss-devel >= 3.66
-BuildRequires:  nss-tools >= 3.66
+BuildRequires:  nss-devel >= 3.97
+BuildRequires:  nss-tools >= 3.97
 
 BuildRequires:  %{java_devel}
-BuildRequires:  maven-local
+BuildRequires:  %{maven_local}
 BuildRequires:  mvn(org.apache.commons:commons-lang3)
 BuildRequires:  mvn(org.slf4j:slf4j-api)
 BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
@@ -116,7 +122,7 @@ This only works with gcj. Other JREs require that JCE providers be signed.
 
 Summary:        Java Security Services (JSS)
 
-Requires:       nss >= 3.66
+Requires:       nss >= 3.97
 
 Requires:       %{java_headless}
 Requires:       mvn(org.apache.commons:commons-lang3)
@@ -157,8 +163,8 @@ Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62
 # This will remove installed Tomcat JSS packages.
 Obsoletes:      tomcatjss <= 8.5
 Conflicts:      tomcatjss <= 8.5
-Obsoletes:      idm-tomcatjss <= 8.5
-Conflicts:      idm-tomcatjss <= 8.5
+Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
+Conflicts:      %{vendor_id}-tomcatjss <= 8.5
 
 %if 0%{?rhel} <= 8
 # PKI Servlet Engine has been replaced with Tomcat.
@@ -388,6 +394,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
 
 ################################################################################
 %changelog
+* Thu Feb 13 2025 Red Hat PKI Team <rhcs-maint@redhat.com> - 5.6.0-1
+- Rebase to JSS 5.6.0
+
 * Wed Dec 04 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 5.6.0-alpha1
 - Rebase to JSS 5.6.0-alpha1
 
diff --git a/sources b/sources
index 8d8bc4b..c6f334a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472
+SHA512 (jss-5.6.0.tar.gz) = 6fc8ec84a26f06ab7ba3a84bf37e1da33bd72d269714707b0e82f54d85e5450e0dba8fe08ecf92274200f737b08d06634b02f6c32d27b2de46ad514d4faa36ae