diff --git a/base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der b/base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der
new file mode 100644
index 00000000000..7415958d7d4
Binary files /dev/null and b/base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der differ
diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
index e0fa86020dd..0e70aa2c8cf 100644
--- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
+++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
@@ -1,12 +1,27 @@
 [components.shim-unsigned-aarch64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "67c1d520f9a8080f6b689714099f813f23154c8f" }
+# Pin shim 16.1 to Fedora dist-git commit 4db14e5ed7d3bdb7fda97f62c93e612435f2cce9.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "4db14e5ed7d3bdb7fda97f62c93e612435f2cce9" }
 
 overlays = [
     # Workaround: add dist tag to the release to avoid NEVR conflicts
     # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },
 
     # Workaround: create a compat symlink that does not include the dist tag.
     { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
+
+    # Preserve the Fedora SBAT EVR and append the Azure Linux SBAT EVR.
+    { description = "Use the Fedora 16.1-1.fc44 EVR in the shim.fedora SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '@@VERSION@@-@@RELEASE@@', replacement = '@@UPSTREAM_VERSION_RELEASE@@', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Add the Azure Linux shim SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '\n\z', replacement = "\nshim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues\n", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Define the upstream Fedora shim EVR for SBAT substitution", type = "spec-prepend-lines", lines = ["%global upstream_version_release 16.1-1.fc44", ""], metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Substitute the upstream Fedora shim EVR into SBAT", type = "spec-search-replace", section = "%prep", regex = '''^    -e 's/@@RELEASE@@/%{release}/g' \\$''', replacement = '''    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" },
+    { description = "Create NX-compatible EFI variants", type = "spec-append-lines", section = "%build", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    cp ${efi}.efi ${efi}.nx.efi", "    ./post-process-pe -n -x ${efi}.nx.efi", "done", "pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } },
+    { description = "Install NX-compatible EFI variants", type = "spec-append-lines", section = "%install", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/", "done", "install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } }
 ]
diff --git a/base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der b/base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der
new file mode 100644
index 00000000000..7415958d7d4
Binary files /dev/null and b/base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der differ
diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index be76c19f3c6..d22568bf4d8 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -1,12 +1,37 @@
 [components.shim-unsigned-x64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "bacb81905ea6806b97b968527e5ca9b2e3f0f7b4" }
+# Pin shim 16.1 to Fedora dist-git commit d355c62164bd48c6f47774fe04b0d730d892e006.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "d355c62164bd48c6f47774fe04b0d730d892e006" }
 
 overlays = [
     # Workaround: add dist tag to the release to avoid NEVR conflicts
     # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },
 
     # Workaround: create a compat symlink that does not include the dist tag.
-    { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
+
+    # Azure Linux does not support IA32. Omit its packages and skip its build
+    # and installation paths, which require the unsupported setarch -B call.
+    { description = "Remove the unsupported IA32 shim-unsigned subpackage", type = "spec-remove-subpackage", package = "shim-unsigned-%{efialtarch}" },
+    { description = "Remove the unsupported IA32 shim-unsigned debuginfo subpackage", type = "spec-remove-subpackage", package = "shim-unsigned-%{efialtarch}-debuginfo" },
+    { description = "Do not run the debug-install helper for the IA32 build", type = "spec-search-replace", regex = '^%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}$', replacement = "%global __debug_install_post %{SOURCE100} %{efiarch}" },
+    { description = "Skip creating the unsupported IA32 build directory", type = "spec-search-replace", section = "%prep", regex = '^mkdir build-%{efialtarch}$', replacement = "" },
+    { description = "Skip the unsupported IA32 build commands", type = "spec-search-replace", section = "%build", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
+    { description = "Close the conditional that skips the IA32 build", type = "spec-append-lines", section = "%build", lines = ["%endif"] },
+    { description = "Skip the unsupported IA32 installation commands", type = "spec-search-replace", section = "%install", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
+    { description = "Close the IA32 install conditional and add the compatibility symlink", type = "spec-append-lines", section = "%install", lines = ["%endif", "ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
+
+    # Preserve the Fedora SBAT EVR and append the Azure Linux SBAT EVR.
+    { description = "Use the Fedora 16.1-1.fc43 EVR in the shim.fedora SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '@@VERSION@@-@@RELEASE@@', replacement = '@@UPSTREAM_VERSION_RELEASE@@', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Add the Azure Linux shim SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '\n\z', replacement = "\nshim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues\n", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Define the upstream Fedora shim EVR for SBAT substitution", type = "spec-prepend-lines", lines = ["%global upstream_version_release 16.1-1.fc43", ""], metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Substitute the upstream Fedora shim EVR into SBAT", type = "spec-search-replace", section = "%prep", regex = '''^    -e 's/@@RELEASE@@/%{release}/g' \\$''', replacement = '''    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" },
+    { description = "Create NX-compatible EFI variants", type = "spec-append-lines", section = "%build", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    cp ${efi}.efi ${efi}.nx.efi", "    ./post-process-pe -n -x ${efi}.nx.efi", "done", "pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } },
+    { description = "Install NX-compatible EFI variants", type = "spec-append-lines", section = "%install", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/", "done", "install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } }
 ]
diff --git a/locks/shim-unsigned-aarch64.lock b/locks/shim-unsigned-aarch64.lock
index b0c74d5cbe3..74f8210091d 100644
--- a/locks/shim-unsigned-aarch64.lock
+++ b/locks/shim-unsigned-aarch64.lock
@@ -1,7 +1,7 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
 import-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
-upstream-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
+upstream-commit = '4db14e5ed7d3bdb7fda97f62c93e612435f2cce9'
 manual-bump = 1
-input-fingerprint = 'sha256:92d811b89ae5c9b28746a1b96deecf6d971d413071837f5cbdc17655206a9c7f'
-resolution-input-hash = 'sha256:6db1df0efaeaeb4976389f097ed39c6342b172f973c7a4ae1c93e814c760989b'
+input-fingerprint = 'sha256:5d9c61ed89025802952382f98ef4312d5b12ab3d8d2bbd2e09b8c7567a94d6ea'
+resolution-input-hash = 'sha256:39a1f518415c394ca2aa046131b78bcd040da96a67ceab16974895aaf79e77bf'
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index 3bcbb78ed11..82369c62fad 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -1,7 +1,7 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
-upstream-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
+upstream-commit = 'd355c62164bd48c6f47774fe04b0d730d892e006'
 manual-bump = 1
-input-fingerprint = 'sha256:ed3e699d4749fb506ed795fcfaa4e2b5bb892af8a44434a3c62455f9d9353437'
-resolution-input-hash = 'sha256:0adce686885cc21f043cfebaaeef82b40a1710bbb0bb74b6de645c60e147a54d'
+input-fingerprint = 'sha256:232328f781f65a1e6debb2592acc991dd328d931f8f0d817818f0f88be12271b'
+resolution-input-hash = 'sha256:6a1f2c11ed902ea756be8655161d7eadfb498d8b65a4633f896d278d663f7ed6'
diff --git a/specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der b/specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der
new file mode 100644
index 00000000000..7415958d7d4
Binary files /dev/null and b/specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der differ
diff --git a/specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer b/specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer
deleted file mode 100644
index 29b3ce38991..00000000000
Binary files a/specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer and /dev/null differ
diff --git a/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in b/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in
new file mode 100644
index 00000000000..f5d6925b3b6
--- /dev/null
+++ b/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in
@@ -0,0 +1,4 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.fedora,3,The Fedora Project,shim,@@UPSTREAM_VERSION_RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues
diff --git a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv b/specs/s/shim-unsigned-aarch64/sbat.redhat.csv
deleted file mode 100644
index cfcf0130fc6..00000000000
--- a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
index 6b27b540818..dfdb3795d0f 100644
--- a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
+++ b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
@@ -1,8 +1,11 @@
 # This spec file has been modified by azldev to include build configuration overlays.
 # Do not edit manually; changes may be overwritten.
 
+%global upstream_version_release 16.1-1.fc44
+
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 # For prereleases, % global prerelease rc2, and downpatch Makefile
 %if %{defined prerelease}
@@ -28,18 +31,18 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-aarch64
-Version:	15.8
-Release: 4%{?dist}
+Version:	16.1
+Release: 7%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
 License:	BSD-2-Clause AND OpenSSL
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2
-Source1:	fedora-ca-20200709.cer
+Source1:	azurelinux-ca-20230216.der
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv
+Source3:	sbat.azurelinux.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -51,6 +54,7 @@ BuildRequires:	elfutils-libelf-devel
 BuildRequires:	git openssl-devel openssl
 BuildRequires:	pesign >= %{pesign_vre}
 BuildRequires:	dos2unix findutils
+BuildRequires:	sed
 
 # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
 # compatible with SysV (there's no red zone under UEFI) and there isn't a
@@ -90,13 +94,17 @@ BuildArch:	noarch
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
-cp %{SOURCE3} data/
+sed -e 's/@@VERSION@@/%{version}/g' \
+    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \
+    < %{SOURCE3} > data/sbat.redhat.csv
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2025021800 "
 MAKEFLAGS+=" %{_smp_mflags} "
 if [ -f "%{SOURCE1}" ]; then
 	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
@@ -113,8 +121,15 @@ make ${MAKEFLAGS} \
 	all
 cd ..
 
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    cp ${efi}.efi ${efi}.nx.efi
+    ./post-process-pe -n -x ${efi}.nx.efi
+done
+pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash
+cd ..
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -136,6 +151,12 @@ install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/"
 cd ..
 
 ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/
+done
+install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/
+cd ..
 %files
 %license COPYRIGHT
 %dir %{shimrootdir}
@@ -151,6 +172,9 @@ ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Wed Sep 03 2025 Peter Jones <pjones@redhat.com> - 16.1-1
+- Update to shim-16.1
+
 * Fri Mar 22 2024 Nicolas Frayer <nfrayer@redhat.com>
 - Migrate to SPDX license
 - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2
diff --git a/specs/s/shim-unsigned-aarch64/sources b/specs/s/shim-unsigned-aarch64/sources
index 5428b758ad0..e96df6e1d7e 100644
--- a/specs/s/shim-unsigned-aarch64/sources
+++ b/specs/s/shim-unsigned-aarch64/sources
@@ -1 +1 @@
-SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb
diff --git a/specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der b/specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der
new file mode 100644
index 00000000000..7415958d7d4
Binary files /dev/null and b/specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der differ
diff --git a/specs/s/shim-unsigned-x64/fedora-ca-20200709.cer b/specs/s/shim-unsigned-x64/fedora-ca-20200709.cer
deleted file mode 100644
index 29b3ce38991..00000000000
Binary files a/specs/s/shim-unsigned-x64/fedora-ca-20200709.cer and /dev/null differ
diff --git a/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in b/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in
new file mode 100644
index 00000000000..65e210eaebb
--- /dev/null
+++ b/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in
@@ -0,0 +1,4 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.fedora,3,The Fedora Project,shim,@@UPSTREAM_VERSION_RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues
diff --git a/specs/s/shim-unsigned-x64/sbat.redhat.csv b/specs/s/shim-unsigned-x64/sbat.redhat.csv
deleted file mode 100644
index cfcf0130fc6..00000000000
--- a/specs/s/shim-unsigned-x64/sbat.redhat.csv
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index b26c1bdc44a..b3352f251fc 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -1,8 +1,11 @@
 # This spec file has been modified by azldev to include build configuration overlays.
 # Do not edit manually; changes may be overwritten.
 
+%global upstream_version_release 16.1-1.fc43
+
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 # For prereleases, % global prerelease rc2, and downpatch Makefile
 %if %{defined prerelease}
@@ -23,25 +26,25 @@
 %global debug_package %{nil}
 %global __debug_package 1
 %global _binaries_in_noarch_packages_terminate_build 0
-%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}
+%global __debug_install_post %{SOURCE100} %{efiarch}
 %undefine _debuginfo_subpackages
 
 # currently here's what's in our dbx: nothing
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-%{efiarch}
-Version:	15.8
-Release: 4%{?dist}
+Version:	16.1
+Release: 8%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD-2-Clause AND OpenSSL
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2
-Source1:	fedora-ca-20200709.cer
+Source1:	azurelinux-ca-20230216.der
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv
+Source3:	sbat.azurelinux.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -53,6 +56,7 @@ BuildRequires:	elfutils-libelf-devel
 BuildRequires:	git openssl-devel openssl
 BuildRequires:	pesign >= %{pesign_vre}
 BuildRequires:	dos2unix findutils
+BuildRequires:	sed
 
 # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
 # compatible with SysV (there's no red zone under UEFI) and there isn't a
@@ -71,13 +75,6 @@ use this package or when debugging this package.
 %description
 %desc
 
-%package -n shim-unsigned-%{efialtarch}
-Summary:	First-stage UEFI bootloader (unsigned data)
-Provides:	bundled(openssl) = %{openssl_vre}
-
-%description -n shim-unsigned-%{efialtarch}
-%desc
-
 %package debuginfo
 Summary:	Debug information for shim-unsigned-%{efiarch}
 AutoReqProv:	0
@@ -86,14 +83,6 @@ BuildArch:	noarch
 %description debuginfo
 %debug_desc
 
-%package -n shim-unsigned-%{efialtarch}-debuginfo
-Summary:	Debug information for shim-unsigned-%{efialtarch}
-AutoReqProv:	0
-BuildArch:	noarch
-
-%description -n shim-unsigned-%{efialtarch}-debuginfo
-%debug_desc
-
 %package debugsource
 Summary:	Debug Source for shim-unsigned
 AutoReqProv:	0
@@ -107,14 +96,18 @@ BuildArch:	noarch
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
-mkdir build-%{efialtarch}
-cp %{SOURCE3} data/
+
+sed -e 's/@@VERSION@@/%{version}/g' \
+    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \
+    < %{SOURCE3} > data/sbat.redhat.csv
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2025021800 "
 MAKEFLAGS+=" %{_smp_mflags} "
 if [ -f "%{SOURCE1}" ]; then
 	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
@@ -131,6 +124,7 @@ make ${MAKEFLAGS} \
 	all
 cd ..
 
+%if 0
 cd build-%{efialtarch}
 setarch linux32 -B make ${MAKEFLAGS} \
 	ARCH=%{efialtarch} \
@@ -138,8 +132,16 @@ setarch linux32 -B make ${MAKEFLAGS} \
 	all
 cd ..
 
+%endif
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    cp ${efi}.efi ${efi}.nx.efi
+    ./post-process-pe -n -x ${efi}.nx.efi
+done
+pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash
+cd ..
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -160,6 +162,7 @@ make ${MAKEFLAGS} \
 install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/"
 cd ..
 
+%if 0
 cd build-%{efialtarch}
 setarch linux32 make ${MAKEFLAGS} \
 	ARCH=%{efialtarch} \
@@ -169,7 +172,14 @@ setarch linux32 make ${MAKEFLAGS} \
 install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimaltdir}/"
 cd ..
 
+%endif
 ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/
+done
+install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/
+cd ..
 %files
 %license COPYRIGHT
 %dir %{shimrootdir}
@@ -180,22 +190,14 @@ ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %{shimdir}/*.CSV
 
 %{_datadir}/shim/%{version}-2
-%files -n shim-unsigned-%{efialtarch}
-%license COPYRIGHT
-%dir %{shimrootdir}
-%dir %{shimversiondir}
-%dir %{shimaltdir}
-%{shimaltdir}/*.efi
-%{shimaltdir}/*.hash
-%{shimaltdir}/*.CSV
-
 %files debuginfo -f build-%{efiarch}/debugfiles.list
 
-%files -n shim-unsigned-%{efialtarch}-debuginfo -f build-%{efialtarch}/debugfiles.list
-
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Wed Sep 03 2025 Peter Jones <pjones@redhat.com> - 16.1-1
+- Update to shim-16.1
+
 * Fri Mar 22 2024 Nicolas Frayer <nfrayer@redhat.com>
 - Migrate to SPDX license
 - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2
diff --git a/specs/s/shim-unsigned-x64/sources b/specs/s/shim-unsigned-x64/sources
index 5428b758ad0..e96df6e1d7e 100644
--- a/specs/s/shim-unsigned-x64/sources
+++ b/specs/s/shim-unsigned-x64/sources
@@ -1 +1 @@
-SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb