diff --git a/.gitignore b/.gitignore
index e46cd63..07695aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -146,3 +146,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.13.tar.xz.asc
 /bind-9.16.15.tar.xz
 /bind-9.16.15.tar.xz.asc
+/bind-9.16.16.tar.xz
+/bind-9.16.16.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 72a8317..85ece30 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 8f232dac49cbb143a30a5c807f9085f3ef251f0e Mon Sep 17 00:00:00 2001
+From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -247,7 +247,7 @@ index 98125dd..518a75f 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index da99e85..55680ea 100644
+index 032228b..64e3da0 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
@@ -323,19 +323,19 @@ index da99e85..55680ea 100644
 +	lib/ns-pkcs11/include/Makefile
 +	lib/ns-pkcs11/include/ns/Makefile
 +	lib/ns-pkcs11/tests/Makefile
- 	lib/samples/Makefile
- 	lib/samples/Makefile-postinstall
  	make/Makefile
+ 	make/mkdep
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index ffa2d5a..6fbc192 100644
+index 833964e..058ba2f 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
--SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs samples
+-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
++SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
  TARGETS =
  
  @BIND9_MAKE_RULES@
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
index 897691a..807a4a0 100644
--- a/bind-9.11-tests-variants.patch
+++ b/bind-9.11-tests-variants.patch
@@ -1,4 +1,4 @@
-From 2faaad96a86614f2df13e65f3d3a31cc2d4155c0 Mon Sep 17 00:00:00 2001
+From 607cec78382b016aad0fe041f2e1895b6896c647 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 1 Mar 2019 15:48:20 +0100
 Subject: [PATCH] Make alternative named builds testable in system tests
@@ -17,10 +17,10 @@ export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
  1 file changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 5015d5c..331b728 100644
+index d859909..9152f07 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
-@@ -36,17 +36,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
+@@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
  DELV=$TOP/bin/delv/delv
  DIG=$TOP/bin/dig/dig
  DNSTAPREAD=$TOP/bin/tools/dnstap-read
@@ -44,10 +44,10 @@ index 5015d5c..331b728 100644
  NSEC3HASH=$TOP/bin/tools/nsec3hash
  NSLOOKUP=$TOP/bin/dig/nslookup
  NSUPDATE=$TOP/bin/nsupdate/nsupdate
-@@ -55,12 +55,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
+@@ -56,12 +56,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
  PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
  PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- RESOLVE=$TOP/lib/samples/resolve
+ RESOLVE=$TOP/bin/tests/system/resolve
 -REVOKE=$TOP/bin/dnssec/dnssec-revoke
 +REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
  RNDC=$TOP/bin/rndc/rndc
@@ -61,5 +61,5 @@ index 5015d5c..331b728 100644
  VERIFY=$TOP/bin/dnssec/dnssec-verify
  WIRETEST=$TOP/bin/tests/wire_test
 -- 
-2.21.1
+2.26.3
 
diff --git a/bind.spec b/bind.spec
index a16adc2..8c4e836 100644
--- a/bind.spec
+++ b/bind.spec
@@ -61,7 +61,7 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.15
+Version:  9.16.16
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -1138,6 +1138,9 @@ fi;
 %endif
 
 %changelog
+* Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
+- Update to 9.16.16 (#1954827)
+
 * Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-1
 - Update to 9.16.15
 
diff --git a/sources b/sources
index 3dd65a2..2560b1f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.15.tar.xz) = 30dad6e2144b3ac53ef0a2d1ed3c8342120f148fc0eb6409113a6d5ed3444eecb917915fdf39c26fd223396fc1e873410a50da305f0b870864f7fbbdccec8033
-SHA512 (bind-9.16.15.tar.xz.asc) = b845f0527235a5b24c617e4e0975988df3966b05db3eec33c798c242b00560dbfdb3258da991743629eb24017759d7deccbaf58277d215ff4616f6c255a8c0d4
+SHA512 (bind-9.16.16.tar.xz) = 264aa70d0d111ddb2a62c65f57e3eeb7eb93afdebcc523166d236e8f23d61d1e4f91b5a2df8dffa49e6f8e3c7101a2689c38dd6d77ecdedb79e2b163990e6093
+SHA512 (bind-9.16.16.tar.xz.asc) = 60cd60267553a2cff2055c431d69d3d6a72bf31ee123ef1af82c000ed6732e34a8f552c5b0f15cf74294dea17e9a251684820a3889ecd8eaf51c77ddd8411203