diff --git a/.gitignore b/.gitignore
index 07394a2..81dde88 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,7 @@
 /blazesym-0.2.6^20260722gitae290f6-vendor.tar.gz
 /wprof-demangle-0.5-vendor.tar.gz
 /wprof-wpb-0.5-vendor.tar.gz
+/wprof-0.6.tar.gz
+/wprof-demangle-0.6-vendor.tar.gz
+/wprof-wpb-0.6-vendor.tar.gz
+/vmlinux.h-0.0.0^20260817git6f2f900.tar.gz
diff --git a/get-commit-data.sh b/get-commit-data.sh
new file mode 100755
index 0000000..3787680
--- /dev/null
+++ b/get-commit-data.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+WPROF_CHECKOUT=$1
+
+pushd $1 >/dev/null
+
+git submodule status --cached
+
+echo if you see a '+',
+echo first do a \`git submodule update --init --recursive\`
+read
+
+WPROF_COMMIT=$(git rev-parse HEAD)
+echo %global wprof_commit ${WPROF_COMMIT}
+
+for d in blazesym bpftool libbpf strobelight-libs usdt vmlinux.h; do
+  PREFIX=$(echo $d | sed -e 's|-|_|g' | sed -e 's|\.|_|g')
+  COMMIT=$(git -C $d rev-parse HEAD)
+  DATE=$(git -C $d show --no-patch --format=%cd --date=format:%Y%m%d)
+  echo %global ${PREFIX}_commit ${COMMIT}
+  echo %global ${PREFIX}_date ${DATE}
+done
+
+popd >/dev/null
diff --git a/sources b/sources
index 61c5e6b..aca8994 100644
--- a/sources
+++ b/sources
@@ -4,7 +4,7 @@ SHA512 (bpftool-7.8.0~^20260727gitc231921.tar.gz) = 60096b5fb79f08096513757a13a4
 SHA512 (libbpf-1.8~^20260630git34e3ebf.tar.gz) = ef8cdaa61b7b98d8e638ed39a166fcadf4ff57f91673f13a88949cc1a2d7f8a3341ae5ac4860f804179fa2a7d3b78553514369523132c102edce7f9f68649d8d
 SHA512 (strobelight-libs-0.0.0^20260717git8793294.tar.gz) = 9ce2e9451e0c308d4929d52bb8f3ea8f6bc070fc09058188f028c35ee23e24370ce10e499aa0d6e0d485fca59e72a971cd2196bddb70ebbd08156232e1afd474
 SHA512 (usdt-0.0.0^20260506gitb0144b0.tar.gz) = 8d9f44949a0cca88adcc4e6d9b0a27ee425c8b48e20187a9281663d8346b0291e90aae6187f15814a45dbf260504a3e21f19094a4ec9c200d377c35bd552091b
-SHA512 (vmlinux.h-0.0.0^20260223git5c36ac2.tar.gz) = edfb22676dfe5c812e673cd9e207de778649f72c04ec9de74b5566854da3b7d857657b3a02664a68cd6150001e313041ec2d067d544783b9c113f664b43f57ce
-SHA512 (wprof-0.5.tar.gz) = b8c25cea39aed2171f70b4d9150faabc7bbb08376943ab7477031e608073e81c02757efa578bb626f2e8d21287907d724c400e1d65511d89bf720322cc6a9555
-SHA512 (wprof-demangle-0.5-vendor.tar.gz) = 5f391b9349ba0f2eae749e3ced787a9ae223266c63c4bbfb17759ddb4063661f40fbcf5854013ca30ad2f487938291a534381e6bed09e2b28e2158869e1c2377
-SHA512 (wprof-wpb-0.5-vendor.tar.gz) = 53d4552eb445b1e64a9c2cee58630bdc10a281e279dba74b474e4cba2a894db937e0bffb02f8d068afbc055570239dd3c504a09c77b1c79578a10f0138a1d796
+SHA512 (vmlinux.h-0.0.0^20260817git6f2f900.tar.gz) = 14aa0925326a0d9a09004b03b2450d6e6ddd0a8fb81aa1a40cb4f7f9aec969e66c697e4ffb33b50d94dc13b0d81dd681e8ac2c08e36c4bc3a0ab37c5212bdaf5
+SHA512 (wprof-0.6.tar.gz) = d271186e557f02d830f164f6718a812abefb43572530eefb10b214fa81e92fb82fa93442937f8d11cb4921f41a86fa24a855a3eb992027c07a78650b4c29ca48
+SHA512 (wprof-demangle-0.6-vendor.tar.gz) = 12f9f38bccd537cd1ae8a855ce47b6b8bc1231472530da8624dc798b92fab1dc2a538a967f06054fa9783373b291b53ce261be9781349622a3f2eae225664d59
+SHA512 (wprof-wpb-0.6-vendor.tar.gz) = 0bbe1fa77d15d2a9a1ae2f429dee4c42b4ceeb16cba08fed8d079ceeceb3678e2a6cd9eaf847aa7e8b2c792c92c41b454ecaa3da5e8af4c8ee7906a5eacdefcb
diff --git a/wprof-0.5-apply-CFLAGS-to-bpftool.patch b/wprof-0.5-apply-CFLAGS-to-bpftool.patch
deleted file mode 100644
index 9d79e9e..0000000
--- a/wprof-0.5-apply-CFLAGS-to-bpftool.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 8afda12cf9f1ba751006fdcd7db96e620ff5f45f Mon Sep 17 00:00:00 2001
-From: Andrii Nakryiko <andrii@kernel.org>
-Date: Thu, 30 Jul 2026 11:48:26 -0700
-Subject: [PATCH] build: apply CFLAGS to bootstrap bpftool
-
-bpftool snapshots its host compiler flags before appending EXTRA_CFLAGS. Passing RPM CFLAGS through EXTRA_CFLAGS therefore leaves the bootstrap objects without PIE compilation while inherited linker flags still request a PIE executable, failing on aarch64 with unresolvable relocations.\n\nPass them through HOST_EXTRACFLAGS so bpftool and its bootstrap libbpf use the same hardening settings as the linker.
-
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
----
- src/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index e11fd1f..8166e93 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -126,7 +126,7 @@ $(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPU
- $(BPFTOOL): | $(BPFTOOL_OUTPUT)
- 	$(call msg,BPFTOOL,$@)
- 	$(Q) [ -d ../bpftool/src ] || git submodule update --init --recursive
--	$(Q)CFLAGS= EXTRA_CFLAGS="$(CFLAGS) -Wno-sign-compare" 					\
-+	$(Q)CFLAGS= HOST_EXTRACFLAGS="$(CFLAGS) -Wno-sign-compare" 				\
- 		$(MAKE) ARCH= CROSS_COMPILE=							\
- 			BPF_DIR=$(LIBBPF_SRC) OUTPUT=$(BPFTOOL_OUTPUT_ABS)/			\
- 			-C $(BPFTOOL_SRC) bootstrap
diff --git a/wprof-0.5-drop-format-security-for-bpftool-bootstrap.patch b/wprof-0.5-drop-format-security-for-bpftool-bootstrap.patch
deleted file mode 100644
index 807d398..0000000
--- a/wprof-0.5-drop-format-security-for-bpftool-bootstrap.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From fa7281859751d26fe7a326f66bbd5197f82ffe0e Mon Sep 17 00:00:00 2001
-From: Michel Lind <salimma@fedoraproject.org>
-Date: Thu, 30 Jul 2026 20:19:34 +0100
-Subject: [PATCH] build: drop -Werror=format-security for bootstrap bpftool
-
-bpftool filters -W, -Wall, -Wextra and -Wformat* out of the flags it hands
-down to its bootstrap libbpf build. -Werror=format-security doesn't match
--Wformat%, so it survives the filter while -Wall does not, and gcc rejects
-the leftover:
-
-  cc1: error: '-Wformat-security' ignored without '-Wformat'
-
-That breaks the build whenever distro hardening flags reach us through
-CFLAGS, e.g. RPM's build flags on CentOS/Fedora. Keep the flag out of
-HOST_EXTRACFLAGS; the bpftool build has its own -Wformat-security anyway.
----
- src/Makefile | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index 8166e93..40badaa 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -122,11 +122,13 @@ $(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPU
- 		    EXTRA_CFLAGS="-g -O$(if $(DEBUG),0,2) -Wno-sign-compare"			\
- 		    install
- 
--# Build bpftool
-+# Build bpftool.
-+# bpftool filters -Wall/-Wformat* (but not -Werror=format-security) out of the flags it
-+# hands to its bootstrap libbpf build, so drop it here: gcc errors out on the leftover.
- $(BPFTOOL): | $(BPFTOOL_OUTPUT)
- 	$(call msg,BPFTOOL,$@)
- 	$(Q) [ -d ../bpftool/src ] || git submodule update --init --recursive
--	$(Q)CFLAGS= HOST_EXTRACFLAGS="$(CFLAGS) -Wno-sign-compare" 				\
-+	$(Q)CFLAGS= HOST_EXTRACFLAGS="$(filter-out -Werror=format-security,$(CFLAGS)) -Wno-sign-compare" \
- 		$(MAKE) ARCH= CROSS_COMPILE=							\
- 			BPF_DIR=$(LIBBPF_SRC) OUTPUT=$(BPFTOOL_OUTPUT_ABS)/			\
- 			-C $(BPFTOOL_SRC) bootstrap
diff --git a/wprof.spec b/wprof.spec
index 0254d0a..8f12570 100644
--- a/wprof.spec
+++ b/wprof.spec
@@ -1,7 +1,18 @@
 %global forgeurl https://github.com/anakryiko/wprof
-Version:        0.5
+Version:        0.6
 %forgemeta
 
+# run `fedpkg prep --define 'with_skip_vendored 1'`
+# to skip the vendored tarballs (e.g. so you can update them
+# when prepping a new version)
+%bcond skip_vendored 0
+
+# run ./get-commit-data.sh $WPROF_CHECKOUT_DIR with
+# the version to package checked out, to generate the
+# commit hashes and dates. If they are different from
+# what is currently set, check if you need to update the
+# version by hand
+
 # we need to declare this to show it in the version string
 # since we 'backport' the first two commits after 0.5, just
 # use the commit hash of the latest commit we use
@@ -42,9 +53,9 @@ Version:        0.5
 %global usdt_version 0.0.0^%{usdt_date}git%{usdt_shortcommit}
 
 %global vmlinux_h_url https://github.com/libbpf/vmlinux.h
-%global vmlinux_h_commit 5c36ac2080a8d3c1216470ce97e6502ed50272e5
+%global vmlinux_h_commit 6f2f90028084f1b636ee669e0288e289198506ff
 %global vmlinux_h_shortcommit %(c=%{vmlinux_h_commit}; echo ${c:0:7})
-%global vmlinux_h_date 20260223
+%global vmlinux_h_date 20260817
 # see vmlinux.h/Cargo.toml
 %global vmlinux_h_version 0.0.0^%{vmlinux_h_date}git%{vmlinux_h_shortcommit}
 
@@ -126,8 +137,6 @@ Source101:      wprof-demangle-%{version}-vendor.tar.gz
 # tar cfz ../../wprof-wpb-%%{version}-vendor.tar.gz src/wpb/vendor
 Source102:      wprof-wpb-%{version}-vendor.tar.gz
 
-Patch:          https://github.com/anakryiko/wprof/commit/8afda12cf9f1ba751006fdcd7db96e620ff5f45f.patch#/wprof-0.5-apply-CFLAGS-to-bpftool.patch
-Patch:          https://github.com/anakryiko/wprof/pull/120.patch#/wprof-0.5-drop-format-security-for-bpftool-bootstrap.patch
 # share the bundled vmlinux header, don't try to fetch it again
 Patch:          wprof-blazesym-shared-vmlinux.diff
 
@@ -178,6 +187,7 @@ rmdir usdt
 mv usdt-%{usdt_commit} usdt
 
 %autopatch -p1
+%if %{without skip_vendored}
 tar xf %{SOURCE100}
 tar xf %{SOURCE101}
 tar xf %{SOURCE102}
@@ -194,6 +204,7 @@ popd
 pushd src/wpb
 %cargo_prep -v vendor
 popd
+%endif
 
 
 %build