diff --git a/.gitignore b/.gitignore
index c7a08b9..7cf1549 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/openssl-ibmca-2.4.1.tar.gz
+SOURCES/openssl-ibmca-2.5.0.tar.gz
diff --git a/.openssl-ibmca.metadata b/.openssl-ibmca.metadata
index bbaf4cc..1a5c138 100644
--- a/.openssl-ibmca.metadata
+++ b/.openssl-ibmca.metadata
@@ -1 +1 @@
-8e7fc23ec2253da7d2b6e3181c80843253fcb68c SOURCES/openssl-ibmca-2.4.1.tar.gz
+cf856afc3c70973f0766aa8e107c95d35912f0f3 SOURCES/openssl-ibmca-2.5.0.tar.gz
diff --git a/SPECS/openssl-ibmca.spec b/SPECS/openssl-ibmca.spec
index 6ec8757..e3833cf 100644
--- a/SPECS/openssl-ibmca.spec
+++ b/SPECS/openssl-ibmca.spec
@@ -8,13 +8,15 @@
 
 Summary: OpenSSL engine and provider for IBMCA
 Name: openssl-ibmca
-Version: 2.4.1
+Version: 2.5.0
 Release: 1%{?dist}
 License: ASL 2.0
 URL: https://github.com/opencryptoki
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 # warn the user about engine being deprecated
 Patch1: %{name}-2.3.1-engine-warning.patch
+# post GA fixes
+#Patch2: %%{name}-%%{version}-fixes.patch
 Requires: libica >= 4.0.0
 BuildRequires: make
 BuildRequires: gcc
@@ -77,6 +79,14 @@ make check
 
 
 %changelog
+* Thu Jun 05 2025 Dan Horák <dhorak@redhat.com> - 2.5.0-1
+- rebased to 2.5.0 (RHEL-73354)
+- Resolves: RHEL-73354
+
+* Thu May 23 2024 Dan Horák <dhorak@redhat.com> - 2.4.1-2
+- apply post-2.4.1 fixes (RHEL-23702)
+- Resolves: RHEL-23702
+
 * Fri Oct 27 2023 Dan Horák <dhorak@redhat.com> - 2.4.1-1
 - updated to 2.4.1 (RHEL-11414)
 - Resolves: RHEL-11414