diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec
index 5a109ce..181c082 100644
--- a/shim-unsigned-x64.spec
+++ b/shim-unsigned-x64.spec
@@ -27,8 +27,8 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-%{efiarch}
-Version:	15.5
-Release:	%{?zdpd}1%{?dist}
+Version:	15.6
+Release:	1
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD
@@ -39,9 +39,12 @@ Source1:	fedora-ca-20200709.cer
 Source2:	%{dbxfile}
 %endif
 Source3:	sbat.redhat.csv
+Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
 
+%include %{SOURCE4}
+
 BuildRequires:	gcc make
 BuildRequires:	elfutils-libelf-devel
 BuildRequires:	git openssl-devel openssl
@@ -97,7 +100,7 @@ BuildArch:	noarch
 %debug_desc
 
 %prep
-%autosetup -S git_am -n shim-%{version}%{?tildepre}
+%autosetup -S git_am -n shim-%{version}
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
@@ -188,6 +191,10 @@ cd ..
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Tue Jun 07 2022 Peter Jones <pjones@redhat.com> - 15.6-1
+- Update to shim-15.6
+  Resolves: CVE-2022-28737
+
 * Thu Mar 10 2022 Peter Jones <pjones@redhat.com> - 15.5-1
 - Update to shim 15.5
   - lots of minor fixes
diff --git a/shim.patches b/shim.patches
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/shim.patches
diff --git a/sources b/sources
index fe04942..bcb0302 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (shim-15.5.tar.bz2) = 91fbda1ef0b4ea36538b57179488169f37eb8522d8dbbbf2eeb40708bc013073b4454b4205a957df13e1e15b9151c6013a8292691f9e3ab28ba7d0935fcc4fab
+SHA512 (shim-15.6.tar.bz2) = ddc5d5234851d05ed7124ad748ad3fee2df8a335493948a045653322c873f3f055d34894aeb2ac7495086984ca62183907d341e46e6bdf108856e39c646455fc