diff --git a/centossecureboot801.cer b/centossecureboot801.cer
new file mode 100644
index 0000000..c18f616
Binary files /dev/null and b/centossecureboot801.cer differ
diff --git a/centossecurebootca8.cer b/centossecurebootca8.cer
new file mode 100644
index 0000000..32d84ef
Binary files /dev/null and b/centossecurebootca8.cer differ
diff --git a/shim.rpmmacros b/shim.rpmmacros
index 29bdf0a..fa37e9c 100644
--- a/shim.rpmmacros
+++ b/shim.rpmmacros
@@ -115,7 +115,7 @@ version signed by the UEFI signing service.				\
 	else									\
 		cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi	\
 	fi									\
-	%{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n centossecureboot201 -a %{SOURCE2} -c %{SOURCE1} } \
+	%{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n centossecureboot801 -a %{SOURCE2} -c %{SOURCE1} } \
 	%{nil}
 
 # -a <efiarch>
diff --git a/shim.spec b/shim.spec
index 0559aff..8f0f1c8 100644
--- a/shim.spec
+++ b/shim.spec
@@ -1,6 +1,6 @@
 Name:		shim
-Version:	15.8
-Release:	2%{?dist}
+Version:	16.1
+Release:	1%{?dist}
 Summary:	First-stage UEFI bootloader
 License:	BSD
 URL:		https://github.com/rhboot/shim/
@@ -12,8 +12,8 @@ ExclusiveArch:	%{efi}
 ExcludeArch:	%{arm} %{ix86}
 
 Source0:	shim.rpmmacros
-Source1:	centossecureboot201.cer
-Source2:	centossecurebootca2.cer
+Source1:	centossecureboot801.cer
+Source2:	centossecurebootca8.cer
 
 # keep these two lists of sources synched up arch-wise.  That is 0 and 10
 # match, 1 and 11 match, ...
@@ -104,6 +104,9 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi
 %endif
 
 %changelog
+* Wed May 27 2026 Nicolas Frayer <nfrayer@redhat.com> - 16.1-1
+- signature/cert: Dual MSFT signature and CentOS 8 series cert
+
 * Thu Aug 14 2025 Nicolas Frayer <nfrayer@redhat.com> - 15.8-2
 - First build for CentOS Stream 9
 - Resolves: #RHEL-109442
diff --git a/sources b/sources
index 1d7e731..fa24efd 100644
--- a/sources
+++ b/sources
@@ -2,7 +2,7 @@ SHA512 (fbx64.efi) = 6c40a378c807a1379fd3326f2218d70c3b7340b549a94c81fee40097c51
 SHA512 (mmx64.efi) = dc95aaa77a4b31cad35631448076c9746300b8a80e5b8de863f320a087aacca8ed954148052a75f4537a5723989aed7eb8515d1fa6ba069cfad4e75d5e724a42
 SHA512 (fbaa64.efi) = f1b4c3278c88142958ccbc45f7198c7b7645734ed00b8279b6905a6e5b46dceba22dae7541fad8a478f429d37500aef37241bbcf16e56b1f6fcc9e2de087bda4
 SHA512 (mmaa64.efi) = c94d97f99211eb82c4b3688b36b89cf522f7595fcfea83ee9e0492a3e1fcf4e11614e20c85b83aa890bb713c5a5c2c381237891e5e4741cf6a776f97ee4eef21
-SHA512 (shimx64.efi) = b4dc7ff94feec631d63e496b72d9ea333179204407ba91399d7c5e2c762172a3ab91001604727641ac5b0eaf79fa350d981b05c101c523897987e12b494b03cd
+SHA512 (shimx64.efi) = 16eb94c22026fcd7c0a7a449f82d568a1df5e047493a3921c774442ed222e04c70dfbf96b97670a2060eda4507ecbf66800a1f8e8c2a17030e0ef4edd7d1d1ad
 SHA512 (shimaa64.efi) = 66ff2d1a7ee2588ae8f1b41ed472f81bdfd4791e8c646d51f9607592cca6d76e0ad05c98390e97191d9989b390f85cb50b107b2f545cde3cb4f07c1eeee7fc45
 SHA512 (BOOTX64.CSV) = 16936301ec1b098022aac2428d31a4849a585e047493a64916427a235287b8d81bc285b0371a270e77ed476b71c741b8d7e7158986b167c3d6bb982705764e16
 SHA512 (BOOTAA64.CSV) = 1c1bac8c2627b704e8b091d2e0c81d55a8bd7420450fe429e20efe8830fa377fdf48c51c2e658e3d0ecee491845bf5cc696ba848669dc26d23687ed5fe5efa76