diff --git a/.gitignore b/.gitignore
index 92dcc4f..72db243 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,19 @@
 /aerc-0.13.0.tar.gz
 /aerc-0.14.0.tar.gz
 /aerc-0.15.2.tar.gz
+/aerc-0.16.0.tar.gz
+/aerc-0.16.0-vendor.tar.gz
+/aerc-0.17.0.tar.gz
+/aerc-0.17.0-vendor.tar.gz
+/aerc-0.18.0.tar.gz
+/aerc-0.18.0-vendor.tar.bz2
+/aerc-0.18.2.tar.gz
+/aerc-0.18.2-vendor.tar.bz2
+/aerc-0.19.0.tar.gz
+/aerc-0.19.0-vendor.tar.bz2
+/aerc-0.20.0.tar.gz
+/aerc-0.20.0-vendor.tar.bz2
+/aerc-0.20.1.tar.gz
+/aerc-0.20.1-vendor.tar.bz2
+/aerc-0.21.0.tar.gz
+/aerc-0.21.0-vendor.tar.bz2
diff --git a/aerc.spec b/aerc.spec
index 987d75c..d3ceec8 100644
--- a/aerc.spec
+++ b/aerc.spec
@@ -1,90 +1,108 @@
-# Generated by go2rpm 1.6.0
-%bcond_without check
+# Generated by go2rpm 1.14.0
+%bcond check 1
+
+# We use vendored deps, as aerc has a lot of dependencies and is picky about
+# them. Upstream does a good job at keeping them updated. aerc is prone to
+# crashes with Fedora's dependency versions, many of which are out of date.
 
 # https://git.sr.ht/~rjarry/aerc
 %global goipath         git.sr.ht/~rjarry/aerc
-Version:                0.15.2
-%global topdir          %{name}-%{version}
+%global version0        0.21.0
 
-%gometa
+%gometa -L -f
 
 %global common_description %{expand:
-Aerc is an email client that runs in your terminal. It's highly
+Aerc is an email client that runs in your terminal. It is highly
 efficient and extensible, perfect for the discerning hacker.}
 
-%global golicenses      LICENSE
-%global godocs          doc README.md
-
 Name:           aerc
+Version:        %{forgeversion}
 Release:        %autorelease
 Summary:        Email client for your terminal
 
-License:        MIT
+SourceLicense:  MIT
+# Generated by go-vendor-tools
+License:        MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC
 URL:            %{gourl}
-# The forge macros don't support Sourcehut.
-# https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/209
-Source:         %{gourl}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz
+Source0:        %{gosource}
+# Generated by go-vendor-tools
+Source1:        %{archivename}-vendor.tar.bz2
+Source2:        go-vendor-tools.toml
 
-BuildRequires:  scdoc
 BuildRequires:  desktop-file-utils
+# wrap and colorize filters are written in C
+BuildRequires:  gcc
+BuildRequires:  glibc-all-langpacks
+BuildRequires:  go-vendor-tools
 BuildRequires:  gnupg
 BuildRequires:  notmuch-devel
-BuildRequires:  gcc
+BuildRequires:  scdoc
 
-Requires:       notmuch
+# used in the builtin `html` filter
+Requires:       w3m
+# aerc is mainly targeted at developers using a git+email workflow
+Recommends:     git-email
+# for email signing/verification, encryption/decryption
+Recommends:     gnupg2
+# for network isolation with unshare in the builtin `html` filter
+Recommends:     util-linux
 
-%description
-%{common_description}
+%description %{common_description}
 
 %prep
-%goprep
+%goprep -A
+%setup -q -T -D -a1 %{forgesetupargs}
 %autopatch -p1
 
-# Disable building of aerc that we handle manually in the SPEC and
-# preserve mtimes
-sed -e 's|install: $(DOCS) aerc wrap|install: $(DOCS)|' \
-    -e 's|install -m|install -pm|' \
-    -i Makefile
-
-# From go.mod replace statements:
-# replace golang.org/x/crypto => github.com/ProtonMail/go-crypto v0.0.0-20200420072808-71bec3603bf3
-# replace github.com/zenhack/go.notmuch => github.com/brunnre8/go.notmuch v0.0.0-20201126061756-caa2daf7093c
-sed -i "s|golang.org/x/crypto|github.com/ProtonMail/go-crypto|" $(find . -name "*.go" -type f)
-sed -i "s|github.com/zenhack/go.notmuch|github.com/brunnre8/go.notmuch|" $(find . -name "*.go" -type f)
-
 %generate_buildrequires
-%go_generate_buildrequires
-echo 'golang(github.com/brunnre8/go.notmuch)'
+%go_vendor_license_buildrequires -c %{S:2}
+
 
 %build
 %set_build_flags
-make wrap colorize
-export BUILDTAGS=notmuch
-export LDFLAGS="-X main.Version=%{version} \
-                -X main.Prefix=%{_prefix} \
-                -X main.Flags=$(echo -- $(GOFLAGS) | base64 | tr -d '\r\n') \
-                -X git.sr.ht/~rjarry/aerc/config.shareDir=%{_datadir} \
-                -X git.sr.ht/~rjarry/aerc/config.libexecDir=%{_libexecdir}"
-%gobuild -o aerc %{goipath}
+# GO_BUILDTAGS: Enable notmuch explicitly instead of relying on auto-detection
+#               in build script.
+# GO_LDFLAGS: Set to an empty string so the C LDFLAGS set by %%set_build_flags
+#             aren't read instead.
+GO_BUILDTAGS=notmuch GO_LDFLAGS=""
+
+# BUILD_OPTS: Set `go build` flags
+# DATE: Set DATE based on SOURCE_DATE_EPOCH. The Makefile sets it based on the
+#       current time.
+# GOFLAGS: Set to an empty string. We want to clear the definition from the Makefile.
+# GO_EXTRA_LDFLAGS: Set `go build -ldflags` argument
+# Other values should be self-explanatory
+%make_build \
+  BUILD_OPTS=%{gobuild_baseflags_shescaped} \
+  DATE="$(date -d "@${SOURCE_DATE_EPOCH}" +%Y-%m-%d)" \
+  GOFLAGS= \
+  GO_EXTRA_LDFLAGS=%{gobuild_ldflags_shescaped} \
+  PREFIX=%{_prefix} \
+  VERSION=%{version} \
 
 %install
 export PREFIX=%{_prefix}
 %make_install
 desktop-file-validate %{buildroot}/%{_datadir}/applications/aerc.desktop
+%go_vendor_license_install -c %{S:2}
 
-%if %{with check}
 %check
+%go_vendor_license_check -c %{S:2}
+%if %{with check}
+LANG=en_US.UTF-8 ./filters/test.sh
 %gocheck
 %endif
 
-%files
-%license LICENSE
-%doc doc README.md
+%files -f %{go_vendor_license_filelist}
+%license vendor/modules.txt
+%doc README.md CHANGELOG.md
 %{_bindir}/aerc
+%{_bindir}/carddav-query
 %{_datadir}/aerc/
 %{_datadir}/applications/aerc.desktop
 %{_libexecdir}/aerc/
 %{_mandir}/man1/aerc-*.1.*
+%{_mandir}/man1/carddav-query.1*
 %{_mandir}/man1/aerc.1*
 %{_mandir}/man5/aerc-*.5.*
 %{_mandir}/man7/aerc-*.7.*
diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml
new file mode 100644
index 0000000..a04291c
--- /dev/null
+++ b/go-vendor-tools.toml
@@ -0,0 +1,2 @@
+[licensing]
+detector = "trivy"
diff --git a/sources b/sources
index e0a0b5e..12ae86a 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (aerc-0.15.2.tar.gz) = 8744c6c5ea45fc8ad2ab46367e92d3859fab962843db4329c7655b0afe7b72dbea21dae588d44eab314a31da89d15e5b6543224699556aed31e0b3b9c7b0ddbc
+SHA512 (aerc-0.21.0.tar.gz) = b58b3ba9fe36a22b5717d48d7b1caf37303003cb4f32138e79f9775a96dbc5d8b27700091dbfe56f31954be5881467a7c5d8c1895d9161eda19a0d7e5c4750aa
+SHA512 (aerc-0.21.0-vendor.tar.bz2) = 5deb3e85cdeed9d0366e08ba851bbc4382dfafd3e2ecfb561cfc9b0afdd90183d72683a4c055d95a474144a2a5ba816c2946a1ade9acc85119d0e3242ef8af60