diff --git a/.gitignore b/.gitignore
index ee2518e..fb1d122 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,5 @@
 /jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
 /openjdk-jdk16-jdk-16+36.tar.xz
 /openjdk-jdk16u-jdk-16.0.1+9.tar.xz
+/openjdk-jdk16u-jdk-16.0.2-ga.tar.xz
+/openjdk-jdk16u-jdk-16.0.2+7.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 1a019ff..569ed31 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -130,8 +130,10 @@ pushd "${FILE_NAME_ROOT}"
                 # get PR3823.patch (from http://icedtea.classpath.org/hg/icedtea16) from most correct tag
                 # Do not push it or publish it (see https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823)
 		echo "PR3823 not found. Downloading..."
-		wget https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
-	        echo "Applying ${PWD}/pr3823.patch"
+		# wget https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
+		# now using backup server... not sure when it will die...
+		wget https://icedtea.wildebeest.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
+		echo "Applying ${PWD}/pr3823.patch"
 		patch -Np1 < pr3823.patch
 		rm pr3823.patch
 	    else
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index fade353..a745b2a 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -274,7 +274,7 @@
 # New Version-String scheme-style defines
 %global featurever 16
 %global interimver 0
-%global updatever 1
+%global updatever 2
 %global patchver 0
 # If you bump featurever, you must bump also vendor_version_string
 # Used via new version scheme. JDK 16 was
@@ -297,8 +297,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        9
-%global rpmrelease      5
+%global buildver        7
+%global rpmrelease      1
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -2256,7 +2256,10 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
-* Tue Jun 29 2021 Jiri Vanek <jvanek@redhat.com> -1:16.0.1.0.9-5.rolling
+* Fri Jul 23 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.2.0.7-1.rolling
+- bumped to security update of 16.0.2-ga
+
+* Tue Jun 29 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-5.rolling
 - renamed source15 to source17 to match el8
 - added fips support:
 - added pr3695-toggle_system_crypto_policy.patch ; missing prerequisity
diff --git a/sources b/sources
index 0349b1c..f9a2042 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-3.15.0.tar.xz) = c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk16u-jdk-16.0.1+9.tar.xz) = ff06d5c97377cac4d5e8921766c61d4d96dc0c968913263b5371f0d3d0e98bb6a5ccf5b1cbb3ddaff3380bf4499ff6501e73f96e0e922b2294d1f7c1ec3eee23
+SHA512 (openjdk-jdk16u-jdk-16.0.2+7.tar.xz) = 9f0db34edcb1ffcd7af159113133677c03edb75990a2f54e60f445942447c7615af799f3229527abe3306ff626fd1cee4afd1ba86a8c799d688802f0e4b6d0d3