diff --git a/kernel.spec b/kernel.spec
index 29ec560b5..049fbfc56 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -62,7 +62,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 1
+%global baserelease 2
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -680,7 +680,7 @@ Patch800: linux-2.6-crash-driver.patch
 Patch900: modsign-20120802.patch
 
 # secure boot
-Patch1000: secure-boot-20120802.patch
+Patch1000: secure-boot-20120809.patch
 
 # virt + ksm patches
 Patch1555: fix_xen_guest_on_old_EC2.patch
@@ -1381,7 +1381,7 @@ ApplyPatch linux-2.6-e1000-ich9-montevina.patch
 ApplyPatch modsign-20120802.patch
 
 # secure boot
-ApplyPatch secure-boot-20120802.patch
+ApplyPatch secure-boot-20120809.patch
 
 # Assorted Virt Fixes
 ApplyPatch fix_xen_guest_on_old_EC2.patch
@@ -2293,6 +2293,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu Aug 09 2012 Josh Boyer <jwboyer@redhat.com> - 3.6.0-0.rc1.git3.2
+- Update secure-boot patch to pass correct CFLAGS to EFI stub
+
 * Thu Aug 09 2012 Josh Boyer <jwboyer@redhat.com> - 3.6.0-0.rc1.git3.1
 - Linux v3.6-rc1-207-gf4ba394
 
diff --git a/secure-boot-20120802.patch b/secure-boot-20120809.patch
similarity index 94%
rename from secure-boot-20120802.patch
rename to secure-boot-20120809.patch
index e00612bd9..0d6a837cf 100644
--- a/secure-boot-20120802.patch
+++ b/secure-boot-20120809.patch
@@ -699,3 +699,36 @@ index 22036d4..f6821b3 100644
 -- 
 1.7.11.2
 
+From:	Matthew Garrett <mjg@redhat.com>
+To:	matt.fleming@intel.com
+Cc:	linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org,
+	x86@kernel.org, Matthew Garrett <mjg@redhat.com>
+Date:	Thu, 26 Jul 2012 18:00:00 -0400
+Message-Id: <1343340000-7587-1-git-send-email-mjg@redhat.com>
+Subject: [PATCH] efi: Build EFI stub with EFI-appropriate options
+
+We can't assume the presence of the red zone while we're still in a boot
+services environment, so we should build with -fno-red-zone to avoid
+problems. Change the size of wchar at the same time to make string handling
+simpler.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+---
+ arch/x86/boot/compressed/Makefile |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index e398bb5..8a84501 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -28,6 +28,9 @@ VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
+ 	$(obj)/string.o $(obj)/cmdline.o $(obj)/early_serial_console.o \
+ 	$(obj)/piggy.o
+ 
++$(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
++$(obj)/efi_stub_$(BITS).o: KBUILD_CLFAGS += -fshort-wchar -mno-red-zone
++
+ ifeq ($(CONFIG_EFI_STUB), y)
+ 	VMLINUX_OBJS += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
+ endif
+