diff --git a/.gitignore b/.gitignore
index a23ece9..81cedd5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /linux-firmware-20231121.tar.xz
+/linux-firmware-20240111.tar.xz
diff --git a/linux-firmware.spec b/linux-firmware.spec
index 69cd6d4..b05862a 100644
--- a/linux-firmware.spec
+++ b/linux-firmware.spec
@@ -1,12 +1,12 @@
-%global checkout 9552083a
+%global checkout b3132c18
 
-%global firmware_release 120
+%global firmware_release 121
 
 %global _firmwarepath	/usr/lib/firmware
 %define _binaries_in_noarch_packages_terminate_build 0
 
 Name:		linux-firmware
-Version:	20231121
+Version:	20240111
 Release:	%{firmware_release}.git%{checkout}%{?dist}
 Summary:	Firmware files used by the Linux kernel
 License:	GPL+ and GPLv2+ and MIT and Redistributable, no modification permitted
@@ -276,40 +276,8 @@ git am %{patches}
 %install
 mkdir -p $RPM_BUILD_ROOT/%{_firmwarepath}
 mkdir -p $RPM_BUILD_ROOT/%{_firmwarepath}/updates
-# Patch copy-firmware.sh to not use rdfind.
-# "BuildRequires: ... rdfind" is a proper solution, but centos 8 and rhel8 don't have it (yet?)
-patch -p1 <<"EOF"
---- a/copy-firmware.sh	2023-11-21 12:17:51.580616232 +0100
-+++ b/copy-firmware.sh	2023-11-22 02:04:25.210249915 +0100
-@@ -69,11 +69,6 @@
- 	exit 1
- fi
- 
--if ! which rdfind 2>/dev/null >/dev/null; then
--	echo "ERROR: rdfind is not installed"
--	exit 1
--fi
--
- # shellcheck disable=SC2162 # file/folder name can include escaped symbols
- grep -E '^(RawFile|File):' WHENCE | sed -E -e 's/^(RawFile|File): */\1 /;s/"//g' | while read k f; do
-     test -f "$f" || continue
-@@ -87,14 +82,6 @@
-     fi
- done
- 
--$verbose "Finding duplicate files"
--rdfind -makesymlinks true -makeresultsfile false "$destdir" >/dev/null
--find "$destdir" -type l | while read -r l; do
--	target="$(realpath "$l")"
--	$verbose "Correcting path for $l"
--	ln -fs "$(realpath --relative-to="$(dirname "$(realpath -s "$l")")" "$target")" "$l"
--done
--
- # shellcheck disable=SC2162 # file/folder name can include escaped symbols
- grep -E '^Link:' WHENCE | sed -e 's/^Link: *//g;s/-> //g' | while read f d; do
-     if test -L "$f$compext"; then
-EOF
-make DESTDIR=%{buildroot}/ FIRMWAREDIR=%{_firmwarepath} install
+# copy-firmware.sh requires rdfind unless we pass --ignore-duplicates.
+make DESTDIR=%{buildroot}/ FIRMWAREDIR=%{_firmwarepath} COPYOPTS="--ignore-duplicates" install
 
 pushd $RPM_BUILD_ROOT/%{_firmwarepath}
 # Remove firmware shipped in separate packages already
@@ -465,6 +433,11 @@ sed -e 's/^/%%dir /' linux-firmware.dirs >> linux-firmware.files
 %config(noreplace) %{_firmwarepath}/netronome/nic_AMDA*
 
 %changelog
+* Thu Jan 11 2024 Denys Vlasenko <dvlasenk@redhat.com> - 20240111-121.gitb3132c18
+- Pass --ignore-duplicates to copy-firmware.sh
+- AMD Zen3 and Zen4: fix for INVD instruction causing loss of SEV-ES guest machine memory integrity
+Resolves: RHEL-13982
+
 * Wed Nov 22 2023 Denys Vlasenko <dvlasenk@redhat.com> - 20231121-120.git9552083a
 - Work around absense of rdfind during build
 - Add file directives for new iwlwifi files
diff --git a/sources b/sources
index 3ad0488..df479e9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (linux-firmware-20231121.tar.xz) = 84e56e315f89541a63da318f122889847f6cea9a20d9a253a609461b3fdc13557dcc76557f388a929f8097b1dc9d67337e704f4a67d363eeb1b96ae623bc9368
+SHA512 (linux-firmware-20240111.tar.xz) = 3f04598c65d75906dcf12c2ff84c96db6fc41dc71e0967869c79dae9553bf494602e81192e93a776e6155ce02c96d4d04c18ae341daacbfa17f332dd0204d856