diff --git a/.gitignore b/.gitignore
index 6db1df5..dfb8ab3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,7 @@
 /p11-kit-0.25.3.tar.xz.sig
 /p11-kit-0.25.5.tar.xz
 /p11-kit-0.25.5.tar.xz.sig
+/p11-kit-0.25.6.tar.xz
+/p11-kit-0.25.6.tar.xz.sig
+/p11-kit-0.25.8.tar.xz
+/p11-kit-0.25.8.tar.xz.sig
diff --git a/README.packit b/README.packit
index f2be23e..fb341a1 100644
--- a/README.packit
+++ b/README.packit
@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.97.3.post1.dev7+g1954e49a.
+The file was generated using packit 1.11.0.post1.dev7+gfdcdf3a32.
diff --git a/p11-kit-0.25.5-rpc-empty.patch b/p11-kit-0.25.5-rpc-empty.patch
new file mode 100644
index 0000000..63709dc
--- /dev/null
+++ b/p11-kit-0.25.5-rpc-empty.patch
@@ -0,0 +1,62 @@
+From e94c1fb907546faafb3509615943776d1ea37eb8 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Wed, 3 Sep 2025 17:10:21 +0900
+Subject: [PATCH] rpc: Fix empty array attribute handling
+
+When an empty array attribute is exchanged at the RPC level, the
+client previously sent the number of elements (= 0) even if it's
+empty, while the server doesn't expect it. This fixes the client to
+not send it.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ p11-kit/rpc-message.c |  2 +-
+ p11-kit/test-mock.c   | 12 ++++++++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/p11-kit/rpc-message.c b/p11-kit/rpc-message.c
+index 049417f..5eaea61 100644
+--- a/p11-kit/rpc-message.c
++++ b/p11-kit/rpc-message.c
+@@ -266,7 +266,7 @@ p11_rpc_message_write_attribute_buffer_array (p11_rpc_message *msg,
+ 		/* And the attribute buffer length */
+ 		p11_rpc_buffer_add_uint32 (msg->output, attr->pValue ? attr->ulValueLen : 0);
+ 
+-		if (IS_ATTRIBUTE_ARRAY (attr))
++		if (attr->pValue && IS_ATTRIBUTE_ARRAY (attr))
+ 			p11_rpc_message_write_attribute_buffer_array (
+ 				msg, attr->pValue,
+ 				attr->ulValueLen / sizeof (CK_ATTRIBUTE));
+diff --git a/p11-kit/test-mock.c b/p11-kit/test-mock.c
+index b117b92..f174015 100644
+--- a/p11-kit/test-mock.c
++++ b/p11-kit/test-mock.c
+@@ -624,6 +624,12 @@ test_get_wrap_template (void)
+ 		{ CKA_WRAP_TEMPLATE, temp, sizeof (temp) },
+ 	};
+ 	CK_ULONG n_attrs = sizeof (attrs) / sizeof (attrs[0]);
++	CK_OBJECT_CLASS klass = -1ul;
++	CK_ATTRIBUTE attrs_empty_template[] = {
++		{ CKA_WRAP_TEMPLATE, NULL, 0 },
++		{ CKA_UNWRAP_TEMPLATE, NULL, 0 },
++	};
++	CK_ULONG n_attrs_empty_template = sizeof(attrs_empty_template) / sizeof(attrs_empty_template[0]);
+ 
+ 	module = setup_mock_module (&session);
+ 
+@@ -664,6 +670,12 @@ test_get_wrap_template (void)
+ 	assert (verify == CK_TRUE);
+ 	assert (encrypt == CK_TRUE);
+ 
++	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs_empty_template, n_attrs_empty_template);
++	assert (rv == CKR_ATTRIBUTE_TYPE_INVALID);
++	assert_num_eq (attrs_empty_template[0].type, CKA_WRAP_TEMPLATE);
++	assert_ptr_eq (attrs_empty_template[0].pValue, NULL);
++	assert_num_eq (attrs_empty_template[0].ulValueLen, (CK_ULONG)-1);
++
+ 	teardown_mock_module (module);
+ }
+ 
+-- 
+2.50.1
+
diff --git a/p11-kit-0.25.6-packaging.patch b/p11-kit-0.25.6-packaging.patch
new file mode 100644
index 0000000..aee2dd8
--- /dev/null
+++ b/p11-kit-0.25.6-packaging.patch
@@ -0,0 +1,18 @@
+diff --git a/meson.build b/meson.build
+index ab28396..b5829ca 100644
+--- a/meson.build
++++ b/meson.build
+@@ -459,6 +459,7 @@ with_systemd = false
+ systemd = dependency('systemd', required: get_option('systemd'))
+ if systemd.found()
+   systemduserunitdir = systemd.get_variable(pkgconfig : 'systemduserunitdir')
++  with_systemd = true
+ endif
+ 
+ configure_file(output: 'config.h', configuration: conf)
+@@ -488,4 +489,4 @@ if get_option('nls')
+   subdir('po')
+ endif
+ subdir('bash-completion')
+-subdir('zsh-completion')
++# subdir('zsh-completion')
diff --git a/p11-kit.spec b/p11-kit.spec
index f8e566a..3dc3568 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -6,7 +6,7 @@
 %endif
 
 
-Version:        0.25.5
+Version:        0.25.8
 Release:        %{?autorelease}%{!?autorelease:1%{?dist}}
 Name:           p11-kit
 Summary:        Library for loading and sharing PKCS#11 modules
@@ -19,9 +19,6 @@ Source2:        https://p11-glue.github.io/p11-glue/p11-kit/p11-kit-release-keyr
 Source3:        trust-extract-compat
 Source4:        p11-kit-client.service
 
-# https://github.com/p11-glue/p11-kit/pull/667
-Patch0:         p11-kit-0.25.6-thread-local-var.patch
-
 BuildRequires:  gcc
 BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
@@ -151,7 +148,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 %meson_build
 
 %if %{with mingw}
-%mingw_meson -Dgtk_doc=false -Dman=false -Dnls=false -Dtrust_paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source
+%mingw_meson -Dgtk_doc=false -Dman=false -Dnls=false -Dtrust_paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source -Dzsh_completion=disabled
 %mingw_ninja
 %endif
 
@@ -205,6 +202,7 @@ fi
 %{_mandir}/man8/p11-kit.8.gz
 %{_mandir}/man5/pkcs11.conf.5.gz
 %{_datadir}/bash-completion/completions/p11-kit
+%{_datadir}/zsh/site-functions/_p11-kit
 
 %files client
 %{_libdir}/pkcs11/p11-kit-client.so
@@ -223,6 +221,7 @@ fi
 %{_datadir}/p11-kit/modules/p11-kit-trust.module
 %{_libexecdir}/p11-kit/trust-extract-compat
 %{_datadir}/bash-completion/completions/trust
+%{_datadir}/zsh/site-functions/_trust
 
 %files server
 %{_libexecdir}/p11-kit/p11-kit-server
diff --git a/sources b/sources
index bed7eca..418f67a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (p11-kit-0.25.5.tar.xz) = 177ec6ff5eb891901078306dce2bf3f5c1a0e5c2a8c493bdf5a08ae1ff1240fdf6952961e973c373f80ac3d1d5a9927e07f4da49e4ff92269d992e744889fc94
-SHA512 (p11-kit-0.25.5.tar.xz.sig) = 2be5aa4ccbb889e32aed88fc1f7926c3ccaadc90cc6b15a187358c812eee4ce1712068d1f271766ac51366112c0619aad46cff345ed2edd009fb2fe7fb804493
+SHA512 (p11-kit-0.25.8.tar.xz) = 4a3852459a4a5e4ea71eea5d23ef74deeb51c66b28d095be30a263f10d1f47853341f8628eb0c43c88247503059a4c1f67017965a70cd3c7df31d86e458a8162
+SHA512 (p11-kit-0.25.8.tar.xz.sig) = 97f47324cd7578833b751ab1fee55a9a538ba94b52ec4729249a9e5494c60cceef6c60999b495299f2b9ae0d0cda60d5db713d82e0b7991112b7b4b46ad46d1d
 SHA512 (p11-kit-release-keyring.gpg) = 9a832a8ac3a139cbbf1ecb66573f0709847ebfef4975777cf82b4dca09af1ad8e6400f0af0bcdb92860e7ed4fc05082ba1edda0238a21fe24d49555a1069e881