diff --git a/.gitignore b/.gitignore
index 668482d..099ee78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-SOURCES/shim-15.8.tar.bz2
+SOURCES/shim-16.1.tar.bz2
+SOURCES/vendordb.esl
diff --git a/.shim-unsigned-x64.metadata b/.shim-unsigned-x64.metadata
index 89e9ccb..2b5f110 100644
--- a/.shim-unsigned-x64.metadata
+++ b/.shim-unsigned-x64.metadata
@@ -1 +1,2 @@
-cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2
+53a4a52f2cddd7ae880e405b4e3336a5968c5683 SOURCES/shim-16.1.tar.bz2
+3371b3acf8fa4f3be91e90698d5c9ed66ccc19ab SOURCES/vendordb.esl
diff --git a/SOURCES/vendordb.esl b/SOURCES/vendordb.esl
deleted file mode 100644
index 8991b3e..0000000
Binary files a/SOURCES/vendordb.esl and /dev/null differ
diff --git a/SPECS/shim-unsigned-x64.spec b/SPECS/shim-unsigned-x64.spec
index 1bc764c..9cf9443 100644
--- a/SPECS/shim-unsigned-x64.spec
+++ b/SPECS/shim-unsigned-x64.spec
@@ -1,5 +1,6 @@
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 %global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
 %global shimrootdir %{_datadir}/shim/
@@ -19,8 +20,8 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-%{efiarch}
-Version:	15.8
-Release:	2.el9
+Version:	16.1
+Release:	1.el9
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD
@@ -103,7 +104,7 @@ mkdir build-%{efialtarch}
 cp %{SOURCE3} data/
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -125,7 +126,7 @@ make ${MAKEFLAGS} \
 cd ..
 
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -160,6 +161,10 @@ cd ..
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Mon Aug 18 2025 Peter Jones <pjones@redhat.com> - 16.1-1.el9
+- Update to shim-16.1
+  Resolves: RHEL-67333
+
 * Wed Feb 07 2024 Peter Jones <pjones@redhat.com> - 15.8-2.el9
 - Rebuild to fix the commit ident and MAKEFLAGS
   Resolves: RHEL-11262