diff --git a/tar.spec b/tar.spec
index 7fe2ef5..2afb82e 100644
--- a/tar.spec
+++ b/tar.spec
@@ -5,7 +5,7 @@ Summary: GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.34
-Release: 11%{?dist}
+Release: 12%{?dist}
 License: GPLv3+
 URL: https://www.gnu.org/software/tar/
 
@@ -167,6 +167,12 @@ make check || (
 
 
 %changelog
+* Fri Aug 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-12
+- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
+- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)
+  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).
+- Upstream fix for build with libacl 2.4.0
+
 * Mon Feb 23 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-11
 - Add upstream patch to improve error message for --one-top-level
   with absolute path (unsupported as a result of CVE-2025-45582 fix)