diff --git a/.gitignore b/.gitignore
index 48ec3ad..fdd8743 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,5 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.8.4-hobbled.tar.xz
 /libgcrypt-1.8.5-hobbled.tar.xz
 /libgcrypt-1.8.6-hobbled.tar.xz
+/libgcrypt-1.8.7-hobbled.tar.xz
+/libgcrypt-1.8.8-hobbled.tar.xz
diff --git a/libgcrypt.spec b/libgcrypt.spec
index c082e02..9147d5b 100644
--- a/libgcrypt.spec
+++ b/libgcrypt.spec
@@ -1,12 +1,15 @@
 Name: libgcrypt
-Version: 1.8.6
-Release: 3%{?dist}
+Version: 1.8.8
+Release: 1%{?dist}
 URL: http://www.gnupg.org/
 Source0: libgcrypt-%{version}-hobbled.tar.xz
 # The original libgcrypt sources now contain potentially patented ECC
 # cipher support. We have to remove it in the tarball we ship with
 # the hobble-libgcrypt script. 
 # (We replace it with RH approved ECC in Source4-5)
+# tar -xf libgcrypt-1.8.7.tar.bz2
+# pushd libgcrypt-1.8.7 && ../hobble-libgcrypt && popd
+# tar -cvJf libgcrypt-1.8.7-hobbled.tar.xz libgcrypt-1.8.7
 #Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2
 #Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2.sig
 Source2: wk@g10code.com
@@ -105,11 +108,14 @@ cp %{SOURCE4} cipher/
 cp %{SOURCE5} %{SOURCE6} tests/
 
 %build
-# configure tests try to compile code containing ASMs to a .o file
-# In an LTO world, that always works as compilation does not happen until
-# link time.  As a result we get the wrong results from configure.
-# Disable LTO.
-%define _lto_cflags %{nil}
+# This package has a configure test which uses ASMs, but does not link the
+# resultant .o files.  As such the ASM test is always successful, even on
+# architectures were the ASM is not valid when compiling with LTO.
+#
+# -ffat-lto-objects is sufficient to address this issue.  It is the default
+# for F33, but is expected to only be enabled for packages that need it in
+# F34, so we use it here explicitly
+%define _lto_cflags -flto=auto -ffat-lto-objects
 
 autoreconf -f
 %configure --disable-static \
@@ -208,6 +214,15 @@ install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf
 %license COPYING
 
 %changelog
+* Mon Jun 14 2021 Jakub Jelen <jjelen@redhat.com> - 1.8.8-1
+- New upstream release fixing CVE-2021-33560 (#1970098)
+
+* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
+- new upstream release (#1891123)
+
+* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
+- Re-enable LTO
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
diff --git a/sources b/sources
index 09310c9..a948c03 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libgcrypt-1.8.6-hobbled.tar.xz) = b59a3c6544e989033acb1f75a526487075b12aac65f18e38264aa9921fe89306485bfee5f4b0dd75d9ed4a35f23851d302359983c75d6f5a0d6f74007a553743
+SHA512 (libgcrypt-1.8.8-hobbled.tar.xz) = b31c277b75d13a9ff4c172be6f00f891eceabfbe5c360b1d0644fe98858f52062b6c733baafc47bbcde81ae42e360703756e1f6e907374375a067d88b246750a