diff --git a/nginx.service b/nginx.service
index 8597eb4..e381803 100644
--- a/nginx.service
+++ b/nginx.service
@@ -1,6 +1,9 @@
 [Unit]
 Description=The nginx HTTP and reverse proxy server
-After=network.target remote-fs.target nss-lookup.target
+# We require network-online.target since some features like OCSP stapling
+# require working DNS resolvers
+After=network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
 
 [Service]
 Type=forking
diff --git a/nginx.spec b/nginx.spec
index a8577e0..298fa5c 100644
--- a/nginx.spec
+++ b/nginx.spec
@@ -28,7 +28,7 @@
 
 Name:              nginx
 Epoch:             1
-Version:           1.19.8
+Version:           1.19.9
 Release:           1%{?dist}
 
 Summary:           A high performance web server and reverse proxy server
@@ -492,6 +492,10 @@ fi
 
 
 %changelog
+* Wed Mar 31 2021 Felix Kaechele <heffer@fedoraproject.org> - 1:1.19.9-1
+- update mainline to 1.19.9
+- change nginx.service to wait for network-online.target
+
 * Tue Mar 09 2021 Felix Kaechele <heffer@fedoraproject.org> - 1:1.19.8-1
 - update mainline to 1.19.8
 - use make macros
diff --git a/sources b/sources
index 43b4719..7ec2f4f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (nginx-1.19.8.tar.gz) = da548dc459f7a921e2f6ea54f543496244e820acbdf3effc4db331717f69b710181fbfdac3be101cd7d1c39e3ca37a94f9a9c4017f11da843ed85a34acf26bc2
-SHA512 (nginx-1.19.8.tar.gz.asc) = a38fb2c109a35c33b274926be887a2a3e47926c4c360d57b225f37fb12d868b801a04805bfcbfd6d5101fc1e57166dbc533369c45960b5a6513ad0a5e825d336
+SHA512 (nginx-1.19.9.tar.gz) = a418aa22046f641afd95ee661c77c469d21c9957aa5ab74c4186526fcd18e0d701ee933a76ab143081b4b3f8815484074c2609aa257646218bf6b4b739b3cb88
+SHA512 (nginx-1.19.9.tar.gz.asc) = 4e8fa0dd07357d082c2af822281601c83a9d07745c5484b9ce2c8854d91c30c23e08d5fb2911a91206b37236300711ec0130fc45f94b0c036e39bf3051972586