diff --git a/glibc.spec b/glibc.spec
index fb84a86..ef03af8 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,5 +1,5 @@
-%global glibcsrcdir glibc-2.39.9000-411-ga11e15ea0a
-%global glibcversion 2.39.9000
+%global glibcsrcdir glibc-2.40-5-g145b588637
+%global glibcversion 2.40
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
 #
@@ -169,7 +169,7 @@ Version: %{glibcversion}
 # - It allows using the Release number without the %%dist tag in the dependency
 #   generator to make the generated requires interchangeable between Rawhide
 #   and ELN (.elnYY < .fcXX).
-%global baserelease 35
+%global baserelease 1
 Release: %{baserelease}%{?dist}
 
 # Licenses:
@@ -2574,6 +2574,17 @@ update_gconv_modules_cache ()
 %endif
 
 %changelog
+* Fri Jul 26 2024 Florian Weimer <fweimer@redhat.com> - 2.40-1
+- Switch to upstream 2.40 release branch
+- Auto-sync with upstream branch release/2.40/master,
+  commit 145b5886379c8de4f0a1bca3556a4c3d7b6c24b2:
+- manual: Do not mention STATIC_TLS in dynamic linker hardening recommendations
+- resolv: Do not wait for non-existing second DNS response after error (bug 30081)
+- resolv: Allow short error responses to match any query (bug 31890)
+- Increase version number to 2.40
+- libc.pot: regenerate (only line number changes)
+- x86: Disable non-temporal memset on Skylake Server
+
 * Thu Jul 18 2024 Arjun Shankar <arjun@redhat.com> - 2.39.9000-35
 - ppc64le: Build early startup code with -mcpu=power8
 
diff --git a/sources b/sources
index 601829c..f3bf2fc 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glibc-2.39.9000-411-ga11e15ea0a.tar.xz) = aa7043f64d00106490280a92c5834fc946a1d679c38bfa03bb883e599b04a95b1c43b534d33fe2e563c1ad8433cf1723a80700181feeaf7170e45bc0e12a76cb
+SHA512 (glibc-2.40-5-g145b588637.tar.xz) = e83265cb511f102c6b8c6aafa347b538bec657914c16d44485b582c692c564f5118969b538d3ba0a68b3e4033fd2c984f2e1c304a53961f9ca678c5d0f938c1c