diff --git a/.gitignore b/.gitignore
index ef68a90..47df368 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
-cbindgen-vendor.tar.xz
-nspr-4.36.0-2.el8_2.src.rpm
-nss-3.112.0-1.el9_4.src.rpm
-nss-3.112.0-4.el8_2.src.rpm
-thunderbird-140.8.0esr.processed-source.tar.xz
-thunderbird-langpacks-140.8.0esr-20260223.tar.xz
+SOURCES/cbindgen-vendor.tar.xz
+SOURCES/nspr-4.36.0-2.el8_2.src.rpm
+SOURCES/nss-3.112.0-1.el9_4.src.rpm
+SOURCES/nss-3.112.0-4.el8_2.src.rpm
+SOURCES/thunderbird-140.9.0esr.processed-source.tar.xz
+SOURCES/thunderbird-langpacks-140.9.0esr-20260323.tar.xz
diff --git a/.thunderbird.metadata b/.thunderbird.metadata
new file mode 100644
index 0000000..ee9a524
--- /dev/null
+++ b/.thunderbird.metadata
@@ -0,0 +1,6 @@
+bc4adac8f38f5103d8f88564a1545063dd8d6402 SOURCES/cbindgen-vendor.tar.xz
+0d0ddbd2a73340b3cbc977997f57222946b1e775 SOURCES/nspr-4.36.0-2.el8_2.src.rpm
+fd3879b176634d66f8ef64d18fdaeec98e140c23 SOURCES/nss-3.112.0-1.el9_4.src.rpm
+c3f0aaef37972107442e2796efad71be3a98ce3c SOURCES/nss-3.112.0-4.el8_2.src.rpm
+2ae7c10369b0d0148d557655739fac8b0bf3073b SOURCES/thunderbird-140.9.0esr.processed-source.tar.xz
+b819d4304c941d72656c004c4887cc7709185380 SOURCES/thunderbird-langpacks-140.9.0esr-20260323.tar.xz
diff --git a/av1-else-condition-add.patch b/SOURCES/av1-else-condition-add.patch
similarity index 100%
rename from av1-else-condition-add.patch
rename to SOURCES/av1-else-condition-add.patch
diff --git a/build-annobin-fix.patch b/SOURCES/build-annobin-fix.patch
similarity index 100%
rename from build-annobin-fix.patch
rename to SOURCES/build-annobin-fix.patch
diff --git a/build-big-endian-errors.patch b/SOURCES/build-big-endian-errors.patch
similarity index 100%
rename from build-big-endian-errors.patch
rename to SOURCES/build-big-endian-errors.patch
diff --git a/build-cargo-lock-version.patch b/SOURCES/build-cargo-lock-version.patch
similarity index 100%
rename from build-cargo-lock-version.patch
rename to SOURCES/build-cargo-lock-version.patch
diff --git a/build-disable-elfhack.patch b/SOURCES/build-disable-elfhack.patch
similarity index 100%
rename from build-disable-elfhack.patch
rename to SOURCES/build-disable-elfhack.patch
diff --git a/build-libaom.patch b/SOURCES/build-libaom.patch
similarity index 100%
rename from build-libaom.patch
rename to SOURCES/build-libaom.patch
diff --git a/build-min-lexical.patch b/SOURCES/build-min-lexical.patch
similarity index 100%
rename from build-min-lexical.patch
rename to SOURCES/build-min-lexical.patch
diff --git a/build-ppc64-abiv2.patch b/SOURCES/build-ppc64-abiv2.patch
similarity index 100%
rename from build-ppc64-abiv2.patch
rename to SOURCES/build-ppc64-abiv2.patch
diff --git a/build-rhel7-lower-node-min-version.patch b/SOURCES/build-rhel7-lower-node-min-version.patch
similarity index 100%
rename from build-rhel7-lower-node-min-version.patch
rename to SOURCES/build-rhel7-lower-node-min-version.patch
diff --git a/build-rhel7-nasm-dwarf.patch b/SOURCES/build-rhel7-nasm-dwarf.patch
similarity index 100%
rename from build-rhel7-nasm-dwarf.patch
rename to SOURCES/build-rhel7-nasm-dwarf.patch
diff --git a/build-system-nss.patch b/SOURCES/build-system-nss.patch
similarity index 100%
rename from build-system-nss.patch
rename to SOURCES/build-system-nss.patch
diff --git a/build-tb-system-nss.patch b/SOURCES/build-tb-system-nss.patch
similarity index 100%
rename from build-tb-system-nss.patch
rename to SOURCES/build-tb-system-nss.patch
diff --git a/build-workaround-s390x.patch b/SOURCES/build-workaround-s390x.patch
similarity index 100%
rename from build-workaround-s390x.patch
rename to SOURCES/build-workaround-s390x.patch
diff --git a/disable-openpgp-in-thunderbird.patch b/SOURCES/disable-openpgp-in-thunderbird.patch
similarity index 100%
rename from disable-openpgp-in-thunderbird.patch
rename to SOURCES/disable-openpgp-in-thunderbird.patch
diff --git a/firefox-enable-addons.patch b/SOURCES/firefox-enable-addons.patch
similarity index 100%
rename from firefox-enable-addons.patch
rename to SOURCES/firefox-enable-addons.patch
diff --git a/firefox-gcc-build.patch b/SOURCES/firefox-gcc-build.patch
similarity index 100%
rename from firefox-gcc-build.patch
rename to SOURCES/firefox-gcc-build.patch
diff --git a/firefox-nss-addon-hack.patch b/SOURCES/firefox-nss-addon-hack.patch
similarity index 100%
rename from firefox-nss-addon-hack.patch
rename to SOURCES/firefox-nss-addon-hack.patch
diff --git a/google-api-key b/SOURCES/google-api-key
similarity index 100%
rename from google-api-key
rename to SOURCES/google-api-key
diff --git a/google-loc-api-key b/SOURCES/google-loc-api-key
similarity index 100%
rename from google-loc-api-key
rename to SOURCES/google-loc-api-key
diff --git a/mozilla-api-key b/SOURCES/mozilla-api-key
similarity index 100%
rename from mozilla-api-key
rename to SOURCES/mozilla-api-key
diff --git a/mozilla-bmo1170092.patch b/SOURCES/mozilla-bmo1170092.patch
similarity index 100%
rename from mozilla-bmo1170092.patch
rename to SOURCES/mozilla-bmo1170092.patch
diff --git a/mozilla-bmo1504834-part1.patch b/SOURCES/mozilla-bmo1504834-part1.patch
similarity index 100%
rename from mozilla-bmo1504834-part1.patch
rename to SOURCES/mozilla-bmo1504834-part1.patch
diff --git a/mozilla-bmo1504834-part3.patch b/SOURCES/mozilla-bmo1504834-part3.patch
similarity index 100%
rename from mozilla-bmo1504834-part3.patch
rename to SOURCES/mozilla-bmo1504834-part3.patch
diff --git a/mozilla-bmo1670333.patch b/SOURCES/mozilla-bmo1670333.patch
similarity index 100%
rename from mozilla-bmo1670333.patch
rename to SOURCES/mozilla-bmo1670333.patch
diff --git a/mozilla-bmo1716707-svg.patch b/SOURCES/mozilla-bmo1716707-svg.patch
similarity index 100%
rename from mozilla-bmo1716707-svg.patch
rename to SOURCES/mozilla-bmo1716707-svg.patch
diff --git a/mozilla-bmo1716707-swizzle.patch b/SOURCES/mozilla-bmo1716707-swizzle.patch
similarity index 100%
rename from mozilla-bmo1716707-swizzle.patch
rename to SOURCES/mozilla-bmo1716707-swizzle.patch
diff --git a/mozilla-bmo1789216-disable-av1.patch b/SOURCES/mozilla-bmo1789216-disable-av1.patch
similarity index 100%
rename from mozilla-bmo1789216-disable-av1.patch
rename to SOURCES/mozilla-bmo1789216-disable-av1.patch
diff --git a/mozilla-bmo849632.patch b/SOURCES/mozilla-bmo849632.patch
similarity index 100%
rename from mozilla-bmo849632.patch
rename to SOURCES/mozilla-bmo849632.patch
diff --git a/mozilla-bmo998749.patch b/SOURCES/mozilla-bmo998749.patch
similarity index 100%
rename from mozilla-bmo998749.patch
rename to SOURCES/mozilla-bmo998749.patch
diff --git a/node-stdout-nonblocking-wrapper b/SOURCES/node-stdout-nonblocking-wrapper
similarity index 100%
rename from node-stdout-nonblocking-wrapper
rename to SOURCES/node-stdout-nonblocking-wrapper
diff --git a/nss-setup-flags-env.inc b/SOURCES/nss-setup-flags-env.inc
similarity index 100%
rename from nss-setup-flags-env.inc
rename to SOURCES/nss-setup-flags-env.inc
diff --git a/process-official-tarball b/SOURCES/process-official-tarball
similarity index 100%
rename from process-official-tarball
rename to SOURCES/process-official-tarball
diff --git a/rhbz-1173156.patch b/SOURCES/rhbz-1173156.patch
similarity index 100%
rename from rhbz-1173156.patch
rename to SOURCES/rhbz-1173156.patch
diff --git a/rhbz-1354671.patch b/SOURCES/rhbz-1354671.patch
similarity index 100%
rename from rhbz-1354671.patch
rename to SOURCES/rhbz-1354671.patch
diff --git a/rust-file-removal.patch b/SOURCES/rust-file-removal.patch
similarity index 100%
rename from rust-file-removal.patch
rename to SOURCES/rust-file-removal.patch
diff --git a/thunderbird-adapt-ml-dsa-support-to-rhel-nss.patch b/SOURCES/thunderbird-adapt-ml-dsa-support-to-rhel-nss.patch
similarity index 100%
rename from thunderbird-adapt-ml-dsa-support-to-rhel-nss.patch
rename to SOURCES/thunderbird-adapt-ml-dsa-support-to-rhel-nss.patch
diff --git a/thunderbird-add-ml-dsa-certificate-support-to-certviewer.patch b/SOURCES/thunderbird-add-ml-dsa-certificate-support-to-certviewer.patch
similarity index 100%
rename from thunderbird-add-ml-dsa-certificate-support-to-certviewer.patch
rename to SOURCES/thunderbird-add-ml-dsa-certificate-support-to-certviewer.patch
diff --git a/thunderbird-add-mlkem768-secp256r1-support.patch b/SOURCES/thunderbird-add-mlkem768-secp256r1-support.patch
similarity index 100%
rename from thunderbird-add-mlkem768-secp256r1-support.patch
rename to SOURCES/thunderbird-add-mlkem768-secp256r1-support.patch
diff --git a/thunderbird-enable-ml-dsa-in-manager-ssl.patch b/SOURCES/thunderbird-enable-ml-dsa-in-manager-ssl.patch
similarity index 100%
rename from thunderbird-enable-ml-dsa-in-manager-ssl.patch
rename to SOURCES/thunderbird-enable-ml-dsa-in-manager-ssl.patch
diff --git a/thunderbird-enable-ml-dsa-signature-verification-for-certificate-chain-validation.patch b/SOURCES/thunderbird-enable-ml-dsa-signature-verification-for-certificate-chain-validation.patch
similarity index 100%
rename from thunderbird-enable-ml-dsa-signature-verification-for-certificate-chain-validation.patch
rename to SOURCES/thunderbird-enable-ml-dsa-signature-verification-for-certificate-chain-validation.patch
diff --git a/thunderbird-integrate-ml-dsa-signature-verification-for-pkix-certificate-chain-validation.patch b/SOURCES/thunderbird-integrate-ml-dsa-signature-verification-for-pkix-certificate-chain-validation.patch
similarity index 100%
rename from thunderbird-integrate-ml-dsa-signature-verification-for-pkix-certificate-chain-validation.patch
rename to SOURCES/thunderbird-integrate-ml-dsa-signature-verification-for-pkix-certificate-chain-validation.patch
diff --git a/thunderbird-mozconfig b/SOURCES/thunderbird-mozconfig
similarity index 100%
rename from thunderbird-mozconfig
rename to SOURCES/thunderbird-mozconfig
diff --git a/thunderbird-redhat-default-prefs.js b/SOURCES/thunderbird-redhat-default-prefs.js
similarity index 100%
rename from thunderbird-redhat-default-prefs.js
rename to SOURCES/thunderbird-redhat-default-prefs.js
diff --git a/thunderbird-symbolic.svg b/SOURCES/thunderbird-symbolic.svg
similarity index 100%
rename from thunderbird-symbolic.svg
rename to SOURCES/thunderbird-symbolic.svg
diff --git a/thunderbird.appdata.xml.in b/SOURCES/thunderbird.appdata.xml.in
similarity index 100%
rename from thunderbird.appdata.xml.in
rename to SOURCES/thunderbird.appdata.xml.in
diff --git a/thunderbird.desktop b/SOURCES/thunderbird.desktop
similarity index 100%
rename from thunderbird.desktop
rename to SOURCES/thunderbird.desktop
diff --git a/thunderbird.sh.in b/SOURCES/thunderbird.sh.in
similarity index 100%
rename from thunderbird.sh.in
rename to SOURCES/thunderbird.sh.in
diff --git a/thunderbird.spec b/SPECS/thunderbird.spec
similarity index 99%
rename from thunderbird.spec
rename to SPECS/thunderbird.spec
index d62c3d6..6af0299 100644
--- a/thunderbird.spec
+++ b/SPECS/thunderbird.spec
@@ -43,7 +43,7 @@ function dist_to_rhel_minor(str, start)
   end
   match = string.match(str, ".el10")
   if match then
-     return 2
+     return 1
   end
   return -1
 end}
@@ -137,8 +137,8 @@ end}
 
 Summary:        Mozilla Thunderbird mail/newsgroup client
 Name:           thunderbird
-Version:        140.8.0
-Release:        2%{?dist}.alma.1
+Version:        140.9.0
+Release:        1%{?dist}.alma.1
 URL:            http://www.mozilla.org/projects/thunderbird/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
@@ -165,7 +165,7 @@ ExcludeArch:    %{ix86}
 #Source0:        https://archive.mozilla.org/pub/thunderbird/releases/%%{version}%%{?pre_version}/source/thunderbird-%%{version}%%{?pre_version}.processed-source.tar.xz
 Source0:        thunderbird-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        thunderbird-langpacks-%{version}%{?pre_version}-20260223.tar.xz
+Source1:        thunderbird-langpacks-%{version}%{?pre_version}-20260323.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1717,11 +1717,11 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #===============================================================================
 
 %changelog
-* Wed Mar 04 2026 Eduard Abdullin <eabdullin@almalinux.org> - 140.8.0-2.alma.1
+* Tue Mar 31 2026 Eduard Abdullin <eabdullin@almalinux.org> - 140.9.0-1.alma.1
 - AlmaLinux changes
 
-* Wed Mar 04 2026 Eduard Abdullin <eabdullin@almalinux.org> - 140.8.0-2
-- Bump release to match upstream
+* Mon Mar 23 2026 Jan Horak <jhorak@redhat.com> - 140.9.0-1
+- Update to 140.9.0 ESR
 
 * Mon Feb 23 2026 Jan Horak <jhorak@redhat.com> - 140.8.0-1
 - Update to 140.8.0 ESR
@@ -2110,3 +2110,4 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 * Wed Jul 3 2019 Martin Stransky <stransky@redhat.com> - 60.7.2-3
 - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
   with gmail with ssl/tls and OAuth2.
+
diff --git a/sources b/sources
deleted file mode 100644
index daf7659..0000000
--- a/sources
+++ /dev/null
@@ -1,6 +0,0 @@
-SHA512 (cbindgen-vendor.tar.xz) = 2b8db32c0bca2fa27304ee4fd3a5cc38bc43a11500b23842747813d221e55719c51cf4c0e027e41857f58ce1e283ce97b69c2c7d1eae93ecbb08c2f729e2bf55
-SHA512 (nspr-4.36.0-2.el8_2.src.rpm) = fcc720afd2453a5110975fac9dd06f636491234780b62cbfcc235a485b4935e97c4f438292c686d27d9dc86b56f43399c024bee4fffcdff5f27c62d105310645
-SHA512 (nss-3.112.0-1.el9_4.src.rpm) = 6386239e79f8095b05270b3c8b76ac9203b0df196921b64b779f832f0c04fc8c86624a98d85d39372b07e361278c400f52ef653e14ebeab9db49429e69153ff2
-SHA512 (nss-3.112.0-4.el8_2.src.rpm) = 59cca3df7a0ec6a731f4a36f8f560d496d240da0c16650f047ae686e683b883dc2630aedbe46a8b2cb21662c15f03f1efbe99da42055cc3a5418da4839e28da2
-SHA512 (thunderbird-140.8.0esr.processed-source.tar.xz) = 88a4a99a8f9ade31bc2b6badfd6254cbfa8d9febe9503249783389f25357b68c3827444983b0afefc26edba97ab3b1e61a11b57235d2c5b8e20b70219f203524
-SHA512 (thunderbird-langpacks-140.8.0esr-20260223.tar.xz) = cf8ed03feb3d9e0280087c710e19adbb06671d18706e0e699a444868e6476891a577202fda06575cb904004c66db1ade1ea7760906c9efcb71499f99ba93fd62