diff --git a/STAGE2-nss b/STAGE2-nss
index d500c60..3d43b92 100644
--- a/STAGE2-nss
+++ b/STAGE2-nss
@@ -38,6 +38,11 @@ fi
 
 make -C $SRC/nss-3.*/nss/coreconf
 make -C $SRC/nss-3.*/nss/lib/dbm
+
+# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c
+# need nss/verref.h which is exported privately, move it to where it can be found.
+(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/)
+
 make -C $SRC/nss-3.*/nss
 cd $SRC/nss-3.*/nss/coreconf
 make install
diff --git a/sources b/sources
index 09053ee..c1a21b8 100644
--- a/sources
+++ b/sources
@@ -4,4 +4,4 @@ a5ae49867124ac75f029a9a33af31bad  blank-cert8.db
 691e663ccc07b7a1eaa6f088e03bf8e2  blank-cert9.db
 2ec9e0606ba40fe65196545564b7cc2a  blank-key4.db
 b8a94e863c852e1f8b75e930e76f8640  nss-pem-20140125.tar.bz2
-d94778d4309a7e285dcddec09a652223  nss-3.21.6.tar.gz
+11cb3eb4e0c5d8311f75a7ee92882731  nss-3.21.6.tar.gz