diff --git a/openldap.spec b/openldap.spec
index 4c201e9..a460306 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -12,9 +12,9 @@ License: OpenLDAP
 URL: http://www.openldap.org/
 Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version}.tgz
 Source1: slapd.service
-Source3: slapd.tmpfiles
-Source4: slapd.ldif
-Source5: ldap.conf
+Source2: slapd.tmpfiles
+Source3: slapd.ldif
+Source4: ldap.conf
 Source10: ltb-project-openldap-ppolicy-check-password-%{check_password_version}.tar.gz
 Source50: libexec-functions
 Source51: libexec-convert-config.sh
@@ -25,17 +25,19 @@ Source55: libexec-generate-server-cert.sh
 
 # patches for 2.4
 Patch0: openldap-manpages.patch
-Patch2: openldap-sql-linking.patch
-Patch3: openldap-reentrant-gethostby.patch
-Patch4: openldap-smbk5pwd-overlay.patch
-Patch9: openldap-man-sasl-nocanon.patch
-Patch10: openldap-ai-addrconfig.patch
+Patch1: openldap-sql-linking.patch
+Patch2: openldap-reentrant-gethostby.patch
+Patch3: openldap-smbk5pwd-overlay.patch
+Patch4: openldap-man-sasl-nocanon.patch
+Patch5: openldap-ai-addrconfig.patch
+# nss patches, unlikely to ever get upstreamed
 Patch11: openldap-nss-update-list-of-ciphers.patch
 Patch12: openldap-tls-no-reuse-of-tls_session.patch
 Patch13: openldap-nss-regex-search-hashed-cacert-dir.patch
 Patch14: openldap-nss-ignore-certdb-type-prefix.patch
 Patch15: openldap-nss-certs-from-certdb-fallback-pem.patch
 Patch16: openldap-nss-pk11-freeslot.patch
+
 # fix back_perl problems with lt_dlopen()
 # might cause crashes because of symbol collisions
 # the proper fix is to link all perl modules against libperl
@@ -133,11 +135,11 @@ ln -s %{_includedir}/nspr4 include/nspr
 AUTOMAKE=%{_bindir}/true autoreconf -fi
 
 %patch0 -p1
+%patch1 -p1
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
-%patch9 -p1
-%patch10 -p1
+%patch5 -p1
 %patch11 -p1
 %patch12 -p1
 %patch13 -p1
@@ -265,11 +267,11 @@ install -m 0755 -d %{buildroot}%{_localstatedir}/run/openldap
 
 # setup autocreation of runtime directories on tmpfs
 mkdir -p %{buildroot}%{_tmpfilesdir}
-install -m 0644 %SOURCE3 %{buildroot}%{_tmpfilesdir}/slapd.conf
+install -m 0644 %SOURCE2 %{buildroot}%{_tmpfilesdir}/slapd.conf
 
 # install default ldap.conf (customized)
 rm -f %{buildroot}%{_sysconfdir}/openldap/ldap.conf
-install -m 0644 %SOURCE5 %{buildroot}%{_sysconfdir}/openldap/ldap.conf
+install -m 0644 %SOURCE4 %{buildroot}%{_sysconfdir}/openldap/ldap.conf
 
 # setup maintainance scripts
 mkdir -p %{buildroot}%{_libexecdir}
@@ -318,7 +320,7 @@ chmod 0644 %{buildroot}%{_libdir}/lib*.*a
 # slapd.conf(5) is obsoleted since 2.3, see slapd-config(5)
 mkdir -p %{buildroot}%{_datadir}
 install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers
-install -m 0644 %SOURCE4 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif
+install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif
 install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d
 rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.conf
 rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.ldif
@@ -551,6 +553,7 @@ exit 0
 - remove unneeded configure flags, disable sql backend and aci
 - make mdb default after a new installation
 - remove pid file and args file
+- renumber patches and sources
 
 * Wed Dec 17 2014 Jan Synáček <jsynacek@redhat.com> - 2.4.40-5
 - harden the build