diff --git a/.gitignore b/.gitignore
index 3a4f2b3..f5749fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-SOURCES/shim-15.8.tar.bz2r
+SOURCES/redhatsecurebootca8.cer
+SOURCES/shim-16.1.tar.bz2
diff --git a/.shim-unsigned-aarch64.metadata b/.shim-unsigned-aarch64.metadata
index 89e9ccb..df091d6 100644
--- a/.shim-unsigned-aarch64.metadata
+++ b/.shim-unsigned-aarch64.metadata
@@ -1 +1,2 @@
-cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2
+a0ee61374fd590fbcc17aa84abf32d4c5e90887c SOURCES/redhatsecurebootca8.cer
+53a4a52f2cddd7ae880e405b4e3336a5968c5683 SOURCES/shim-16.1.tar.bz2
diff --git a/SOURCES/securebootca.cer b/SOURCES/securebootca.cer
deleted file mode 100644
index b235400..0000000
Binary files a/SOURCES/securebootca.cer and /dev/null differ
diff --git a/SOURCES/shim-15.8.tar.bz2 b/SOURCES/shim-15.8.tar.bz2
deleted file mode 100644
index 4e1f3ad..0000000
Binary files a/SOURCES/shim-15.8.tar.bz2 and /dev/null differ
diff --git a/SPECS/shim-unsigned-aarch64.spec b/SPECS/shim-unsigned-aarch64.spec
index 3011dde..e5a0a66 100644
--- a/SPECS/shim-unsigned-aarch64.spec
+++ b/SPECS/shim-unsigned-aarch64.spec
@@ -1,6 +1,7 @@
 %global pesign_vre 0.106-1
 %global gnuefi_vre 1:3.0.5-6
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 %global debug_package %{nil}
 %global __debug_package 1
@@ -15,14 +16,14 @@
 %global shimdir %{shimversiondir}/%{efiarch}
 
 Name:		shim-unsigned-aarch64
-Version:	15.8
+Version:	16.1
 Release:	2.el9
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
 License:	BSD
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
-Source1:	securebootca.cer
+Source1:	redhatsecurebootca8.cer
 # currently here's what's in our dbx:
 # nothing.
 Source2:	dbx.esl
@@ -80,9 +81,10 @@ BuildArch:	noarch
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
+cp %{SOURCE3} data/
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -100,7 +102,7 @@ make ${MAKEFLAGS} DEFAULT_LOADER='\\\\grub%{efiarch}.efi' all
 cd ..
 
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -133,6 +135,14 @@ cd ..
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Tue Aug 26 2025 Peter Jones <pjones@redhat.com> - 16.1-2.el9
+- Fix the sbat data
+  Related: RHEL-18969
+
+* Mon Aug 18 2025 Peter Jones <pjones@redhat.com> - 16.1-1.el9
+- Update to shim-16.1
+  Resolves: RHEL-18969
+
 * Wed Feb 07 2024 Peter Jones <pjones@redhat.com> - 15.8-2.el9
 - Rebuild to fix the commit ident and MAKEFLAGS
   Resolves: RHEL-11262