diff --git a/centos_vendordb.esl b/centos_vendordb.esl
new file mode 100644
index 0000000..bd508b5
Binary files /dev/null and b/centos_vendordb.esl differ
diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec
index 0994e5f..c3fe42b 100644
--- a/shim-unsigned-x64.spec
+++ b/shim-unsigned-x64.spec
@@ -19,14 +19,14 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-%{efiarch}
-Version:	15.8
-Release:	3.el10.centos
+Version:	16.1
+Release:	1.el10.centos
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
-Source1:	vendordb.esl
+Source1:	centos_vendordb.esl
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
@@ -110,8 +110,8 @@ MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
 MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
 MAKEFLAGS+="%{_smp_mflags}"
-if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer"
+if [ -f "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}"
 fi
 %if 0%{?dbxfile}
 if [ -f "%{SOURCE2}" ]; then
@@ -131,8 +131,8 @@ MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
 MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
-if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer"
+if [ -f "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1} "
 fi
 %if 0%{?dbxfile}
 if [ -f "%{SOURCE2}" ]; then
@@ -161,6 +161,11 @@ cd ..
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Mon Apr 13 2026 Nicolas Frayer <nfrayer@redhat.com> - 16.1-1.el10.centos
+- Update shim to 16.1
+- Certs: Add centos_vendor.esl containing both CA2 and CA8 certs
+- Resolves: RHEL-137056
+
 * Mon Nov 18 2024 Brian Stinson <bstinson@redhat.com> - 15.8-3.el10.centos
 - Build shim-unsigned for CentOS Stream 10
   Related: RHEL-4391
diff --git a/sources b/sources
index 5428b75..e96df6e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb