diff --git a/.gitignore b/.gitignore
index ee35485..390dc0c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,5 @@
 /libreswan-3.31.tar.gz
 /libreswan-3.32.tar.gz
 /libreswan-4.0rc1.tar.gz
+/libreswan-4.0.tar.gz
+/libreswan-4.1.tar.gz
diff --git a/libreswan.spec b/libreswan.spec
index 2bd9936..d5245d9 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -31,12 +31,12 @@
     USE_NSS_KDF=true \\\
 %{nil}
 
-%global prever rc1
+#global prever rc1
 
 Name: libreswan
 Summary: IKE implementation for IPsec with IKEv1 and IKEv2 support
 # version is generated in the release script
-Version: 4.0
+Version: 4.1
 Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
@@ -107,7 +107,7 @@ echo "KLIPS is not supported with RHEL8" > README.KLIPS
 sed -i "s/-lfreebl //" mk/config.mk
 
 # enable crypto-policies support
-sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" programs/configs/ipsec.conf.in
+sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
 
 
 %build
@@ -199,11 +199,21 @@ certutil -N -d sql:$tmpdir --empty-password
 %attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
 %attr(0644,root,root) %{_unitdir}/ipsec.service
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
+%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec/nss
 %{_sbindir}/ipsec
 %{_libexecdir}/ipsec
 %attr(0644,root,root) %doc %{_mandir}/*/*
 
 %changelog
+* Mon Oct 26 10:21:57 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-2
+- Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing
+
+* Sun Oct 18 21:49:39 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
+- Updated to 4.1 - interop fix for Cisco
+
+* Thu Oct 15 10:27:14 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-1
+- Resolves: rhbz#1888448 libreswan-4.0 is available
+
 * Wed Sep 30 14:05:58 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.2.rc1
 - Rebuild for libevent 2.1.12 with a soname bump
 
diff --git a/sources b/sources
index 78c1d33..5b6a525 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
+SHA512 (libreswan-4.1.tar.gz) = c98dfdf6bff17eda6f028e35653b822941665989e37974266bcc54fda20e05f71b86c1dfee858a8ba9a544f86e9217e8e08fa2dfe03ab011f6c2d039b4ee05fe
 SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac
 SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467
 SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e
-SHA512 (libreswan-4.0rc1.tar.gz) = 3ae36e477c6891f94b5d82b1a0ecb05a8413eab96125e6ae92289164b797538cf53cf6825dd1d4699bfdd4c49f68cc65097024f5b1ea9464226dae75abc5c669