diff --git a/python-virt-firmware.spec b/python-virt-firmware.spec
index 571978f..5d4ced2 100644
--- a/python-virt-firmware.spec
+++ b/python-virt-firmware.spec
@@ -1,4 +1,4 @@
-%global pypi_version 24.11
+%global pypi_version 25.3
 
 Name:           python-virt-firmware
 Version:        %{pypi_version}
@@ -31,6 +31,7 @@ Obsoletes:      python3-virt-firmware-peutils < 23.9
 Requires:       python3dist(cryptography)
 Requires:       python3dist(setuptools)
 Requires:       python3dist(pefile)
+Requires:       virt-sb-certs
 %description -n python3-virt-firmware
 Tools for ovmf / armvirt firmware volumes This is a small collection of tools
 for edk2 firmware images. They support decoding and printing the content of
@@ -54,6 +55,13 @@ Conflicts:      systemd < 254
 kernel-install plugin and systemd unit to manage automatic
 UKI (unified kernel image) updates.
 
+%package -n     virt-sb-certs
+Summary:        secure boot certificate database
+%description -n virt-sb-certs
+secure boot certificates used by microsoft and linux distributions, to
+be used for a more finegrained secure boot configuration for virtual
+machines.
+
 %prep
 %autosetup -n virt_firmware-%{pypi_version}
 
@@ -73,6 +81,15 @@ install -m 755 -d  %{buildroot}%{_unitdir}
 install -m 755 -d  %{buildroot}%{_libdir}/kernel/install.d
 install -m 644 systemd/kernel-bootcfg-boot-successful.service %{buildroot}%{_unitdir}
 install -m 755 systemd/99-uki-uefi-setup.install %{buildroot}%{_libdir}/kernel/install.d
+# virt-sb-certs
+install -m 755 -d %{buildroot}%{_datadir}/virt-sb-certs
+dirs=$(cd %{buildroot}%{python3_sitelib}/virt/firmware/certs; echo *)
+mv -v %{buildroot}%{python3_sitelib}/virt/firmware/certs/* \
+   %{buildroot}%{_datadir}/virt-sb-certs
+for dir in $dirs; do
+    ln -vs ../../../../../../..%{_datadir}/virt-sb-certs/$dir \
+       %{buildroot}%{python3_sitelib}/virt/firmware/certs/$dir
+done
 
 %post -n uki-direct
 %systemd_post kernel-bootcfg-boot-successful.service
@@ -112,5 +129,8 @@ install -m 755 systemd/99-uki-uefi-setup.install %{buildroot}%{_libdir}/kernel/i
 %{_unitdir}/kernel-bootcfg-boot-successful.service
 %{_libdir}/kernel/install.d/99-uki-uefi-setup.install
 
+%files -n virt-sb-certs
+%{_datadir}/virt-sb-certs
+
 %changelog
 %autochangelog
diff --git a/sources b/sources
index e7b9914..8086a9f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (virt_firmware-24.11.tar.gz) = 0c6b4d34d518835b4489404c784b263cd6ac8348834ba654d27ae3741d3d229ea5f6036870399390fa4fa33e01c8113d64faba0c6068e4b2fb5bbdd9429bf72f
+SHA512 (virt_firmware-25.3.tar.gz) = d4b280a936153a9419f667d12d196614f9ad6231387fbe96ceb7a9489b1278b0427346617a1e2db6e758648d9e492aa6294f44117c768093fe13f46dccbad60b