diff --git a/skopeo.spec b/skopeo.spec
index f7ef087..599c432 100644
--- a/skopeo.spec
+++ b/skopeo.spec
@@ -10,13 +10,13 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
 
 %global import_path github.com/containers/%{name}
 %global branch release-1.14
-%global commit0 072072bf6e451bbd1e69a40177d047f088eca393
+%global commit0 3a559b2d652abdae5cd63f5093d0d110de524499
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 Epoch: 2
 Name: skopeo
-Version: 1.14.5
-Release: 9%{?dist}
+Version: 1.14.6
+Release: 1%{?dist}
 Summary: Inspect container images and repositories on registries
 License: ASL 2.0
 URL: https://%{import_path}
@@ -122,6 +122,10 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
 %{_datadir}/%{name}/test
 
 %changelog
+* Thu Apr 30 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.14.6-1
+- update to 1.14.6 to fix CVE-2026-34986
+- Resolves: RHEL-164976
+
 * Thu Apr 30 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.14.5-9
 - rebuild for CVE-2026-34986
 - Resolves: RHEL-164976
diff --git a/sources b/sources
index 5c4aea1..0c1843b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (release-1.14-072072b.tar.gz) = 79484809b0942db443fb0627c404f450133e25555d7721874f94230da77c4f72667b10d183f3ec27f6fc8a1e7ac6eb66e42355a58e8caf4eea5c1121689e79cc
+SHA512 (release-1.14-3a559b2.tar.gz) = c724f4f647846a761f408fbed1b2725705befc895510fd810f6ade4b710e06b260805aafe63ae69a038ebc724213ddc72df29f09788e3a8c4e566cf3c7dcd433