diff --git a/.gitignore b/.gitignore
index 78c0a93..dfb8ab3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,5 @@
 /p11-kit-0.25.5.tar.xz.sig
 /p11-kit-0.25.6.tar.xz
 /p11-kit-0.25.6.tar.xz.sig
+/p11-kit-0.25.8.tar.xz
+/p11-kit-0.25.8.tar.xz.sig
diff --git a/p11-kit-0.25.6-thread-local-var.patch b/p11-kit-0.25.6-thread-local-var.patch
new file mode 100644
index 0000000..77acdbc
--- /dev/null
+++ b/p11-kit-0.25.6-thread-local-var.patch
@@ -0,0 +1,134 @@
+From fd7ad3969f68ea24e54d242a08b089039555f7bb Mon Sep 17 00:00:00 2001
+From: Brecht Sanders <brecht@sanders.org>
+Date: Tue, 31 Dec 2024 16:28:31 +0100
+Subject: [PATCH] avoid using already defined thread_local as variable name
+
+Building p11-kit 0.25.5 with GCC15 on MinGW-w64 failed because `thread_local` is already defined for this platform.
+
+Resolved by changing the variable name from `thread_local` to `threadlocal`.
+---
+ common/library.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/common/library.c b/common/library.c
+index 1581702b62db..723b05f33699 100644
+--- a/common/library.c
++++ b/common/library.c
+@@ -124,7 +124,7 @@ _p11_library_get_thread_local (void)
+ 	return &local;
+ }
+ #else
+-static pthread_key_t thread_local = 0;
++static pthread_key_t threadlocal = 0;
+ 
+ static p11_local *
+ _p11_library_get_thread_local (void)
+@@ -133,10 +133,10 @@ _p11_library_get_thread_local (void)
+ 
+ 	p11_library_init_once ();
+ 
+-	local = pthread_getspecific (thread_local);
++	local = pthread_getspecific (threadlocal);
+ 	if (local == NULL) {
+ 		local = calloc (1, sizeof (p11_local));
+-		pthread_setspecific (thread_local, local);
++		pthread_setspecific (threadlocal, local);
+ 	}
+ 
+ 	return local;
+@@ -158,7 +158,7 @@ p11_library_init_impl (void)
+ 	P11_RECURSIVE_MUTEX_INIT (p11_library_mutex);
+ 	P11_RECURSIVE_MUTEX_INIT (p11_virtual_mutex);
+ #ifndef P11_TLS_KEYWORD
+-	pthread_key_create (&thread_local, free);
++	pthread_key_create (&threadlocal, free);
+ #endif
+ 	p11_message_storage = thread_local_message;
+ #ifdef HAVE_STRERROR_L
+@@ -181,8 +181,8 @@ p11_library_uninit (void)
+ 
+ #ifndef P11_TLS_KEYWORD
+ 	/* Some cleanup to pacify valgrind */
+-	free (pthread_getspecific (thread_local));
+-	pthread_setspecific (thread_local, NULL);
++	free (pthread_getspecific (threadlocal));
++	pthread_setspecific (threadlocal, NULL);
+ #endif
+ 
+ #ifdef HAVE_STRERROR_L
+@@ -191,7 +191,7 @@ p11_library_uninit (void)
+ #endif
+ 	p11_message_storage = dont_store_message;
+ #ifndef P11_TLS_KEYWORD
+-	pthread_key_delete (thread_local);
++	pthread_key_delete (threadlocal);
+ #endif
+ 	p11_mutex_uninit (&p11_virtual_mutex);
+ 	p11_mutex_uninit (&p11_library_mutex);
+@@ -205,7 +205,7 @@ p11_library_uninit (void)
+ 
+ #ifdef OS_WIN32
+ 
+-static DWORD thread_local = TLS_OUT_OF_INDEXES;
++static DWORD threadlocal = TLS_OUT_OF_INDEXES;
+ 
+ BOOL WINAPI DllMain (HINSTANCE, DWORD, LPVOID);
+ 
+@@ -214,13 +214,13 @@ _p11_library_get_thread_local (void)
+ {
+ 	LPVOID data;
+ 
+-	if (thread_local == TLS_OUT_OF_INDEXES)
++	if (threadlocal == TLS_OUT_OF_INDEXES)
+ 		return NULL;
+ 
+-	data = TlsGetValue (thread_local);
++	data = TlsGetValue (threadlocal);
+ 	if (data == NULL) {
+ 		data = LocalAlloc (LPTR, sizeof (p11_local));
+-		TlsSetValue (thread_local, data);
++		TlsSetValue (threadlocal, data);
+ 	}
+ 
+ 	return (p11_local *)data;
+@@ -233,8 +233,8 @@ p11_library_init (void)
+ 	p11_debug ("initializing library");
+ 	P11_RECURSIVE_MUTEX_INIT (p11_library_mutex);
+ 	P11_RECURSIVE_MUTEX_INIT (p11_virtual_mutex);
+-	thread_local = TlsAlloc ();
+-	if (thread_local == TLS_OUT_OF_INDEXES)
++	threadlocal = TlsAlloc ();
++	if (threadlocal == TLS_OUT_OF_INDEXES)
+ 		p11_debug ("couldn't setup tls");
+ 	else
+ 		p11_message_storage = thread_local_message;
+@@ -244,9 +244,9 @@ void
+ p11_library_thread_cleanup (void)
+ {
+ 	p11_local *local;
+-	if (thread_local != TLS_OUT_OF_INDEXES) {
++	if (threadlocal != TLS_OUT_OF_INDEXES) {
+ 		p11_debug ("thread stopped, freeing tls");
+-		local = TlsGetValue (thread_local);
++		local = TlsGetValue (threadlocal);
+ 		LocalFree (local);
+ 	}
+ }
+@@ -258,11 +258,11 @@ p11_library_uninit (void)
+ 
+ 	uninit_common ();
+ 
+-	if (thread_local != TLS_OUT_OF_INDEXES) {
++	if (threadlocal != TLS_OUT_OF_INDEXES) {
+ 		p11_message_storage = dont_store_message;
+-		data = TlsGetValue (thread_local);
++		data = TlsGetValue (threadlocal);
+ 		LocalFree (data);
+-		TlsFree (thread_local);
++		TlsFree (threadlocal);
+ 	}
+ 	p11_mutex_uninit (&p11_virtual_mutex);
+ 	p11_mutex_uninit (&p11_library_mutex);
+-- 
+2.49.0
+
diff --git a/p11-kit.spec b/p11-kit.spec
index 1ffa8c4..3dc3568 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -6,7 +6,7 @@
 %endif
 
 
-Version:        0.25.6
+Version:        0.25.8
 Release:        %{?autorelease}%{!?autorelease:1%{?dist}}
 Name:           p11-kit
 Summary:        Library for loading and sharing PKCS#11 modules
@@ -19,8 +19,6 @@ Source2:        https://p11-glue.github.io/p11-glue/p11-kit/p11-kit-release-keyr
 Source3:        trust-extract-compat
 Source4:        p11-kit-client.service
 
-Patch:          p11-kit-0.25.6-packaging.patch
-
 BuildRequires:  gcc
 BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
@@ -150,7 +148,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 %meson_build
 
 %if %{with mingw}
-%mingw_meson -Dgtk_doc=false -Dman=false -Dnls=false -Dtrust_paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source
+%mingw_meson -Dgtk_doc=false -Dman=false -Dnls=false -Dtrust_paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source -Dzsh_completion=disabled
 %mingw_ninja
 %endif
 
@@ -204,6 +202,7 @@ fi
 %{_mandir}/man8/p11-kit.8.gz
 %{_mandir}/man5/pkcs11.conf.5.gz
 %{_datadir}/bash-completion/completions/p11-kit
+%{_datadir}/zsh/site-functions/_p11-kit
 
 %files client
 %{_libdir}/pkcs11/p11-kit-client.so
@@ -222,6 +221,7 @@ fi
 %{_datadir}/p11-kit/modules/p11-kit-trust.module
 %{_libexecdir}/p11-kit/trust-extract-compat
 %{_datadir}/bash-completion/completions/trust
+%{_datadir}/zsh/site-functions/_trust
 
 %files server
 %{_libexecdir}/p11-kit/p11-kit-server
diff --git a/sources b/sources
index c7c1c77..418f67a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (p11-kit-0.25.6.tar.xz) = 71b5b83f0f241a28db66dcb940690ee6d23bbeebdd7d3f6772f1f444e2410c3b6e00f6a2530baef639816e4e05fe2189d340dae7c688f0d751c423c51d20ef16
-SHA512 (p11-kit-0.25.6.tar.xz.sig) = 99d06ee64de815bcb4e6bd861f2e11940103896f87b206b9ae221b91f706dc810fef7e7f5341570b8c447093e34defa8918693b1e14c8659aab1cd1d65768fb7
+SHA512 (p11-kit-0.25.8.tar.xz) = 4a3852459a4a5e4ea71eea5d23ef74deeb51c66b28d095be30a263f10d1f47853341f8628eb0c43c88247503059a4c1f67017965a70cd3c7df31d86e458a8162
+SHA512 (p11-kit-0.25.8.tar.xz.sig) = 97f47324cd7578833b751ab1fee55a9a538ba94b52ec4729249a9e5494c60cceef6c60999b495299f2b9ae0d0cda60d5db713d82e0b7991112b7b4b46ad46d1d
 SHA512 (p11-kit-release-keyring.gpg) = 9a832a8ac3a139cbbf1ecb66573f0709847ebfef4975777cf82b4dca09af1ad8e6400f0af0bcdb92860e7ed4fc05082ba1edda0238a21fe24d49555a1069e881