diff --git a/.gitignore b/.gitignore
index fabfe78..339b025 100644
--- a/.gitignore
+++ b/.gitignore
@@ -101,3 +101,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.7.0rc5.tar.asc
 /samba-4.7.0rc6.tar.xz
 /samba-4.7.0rc6.tar.asc
+/samba-4.7.0.tar.xz
+/samba-4.7.0.tar.asc
diff --git a/samba.spec b/samba.spec
index aa01566..579e4ac 100644
--- a/samba.spec
+++ b/samba.spec
@@ -6,7 +6,7 @@
 # ctdb is enabled by default, you can disable it with: --without clustering
 %bcond_without clustering
 
-%define main_release 11
+%define main_release 12
 
 %define samba_version 4.7.0
 %define talloc_version 2.1.9
@@ -14,7 +14,7 @@
 %define tevent_version 0.9.33
 %define ldb_version 1.2.2
 # This should be rc1 or nil
-%define pre_release rc6
+%define pre_release %nil
 
 %if "x%{?pre_release}" != "x"
 %define samba_release 0.%{main_release}.%{pre_release}%{?dist}
@@ -3358,6 +3358,10 @@ rm -rf %{buildroot}
 %endif # with_clustering_support
 
 %changelog
+* Thu Sep 21 2017 Guenther Deschner <gdeschner@redhat.com> - 4.7.0-0.12
+- Update to Samba 4.7.0
+- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163
+
 * Sun Sep 17 2017 Guenther Deschner <gdeschner@redhat.com> - 4.7.0-0.11.rc6
 - Update to Samba 4.7.0rc6
 
diff --git a/sources b/sources
index 4260c94..b8a69ad 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.7.0rc6.tar.xz) = e2dcef22702261344d1bb4db68813a06dc61d785678ec821ca5aa004c35456687a718b3a4564ba682429a52bf3c46305ea807a99bd734b87a7d63ef283a7360f
-SHA512 (samba-4.7.0rc6.tar.asc) = f86d8dea0697d06aecc57a2c8b71f2fbd51b2aa54192644051a30c41b9975bbbbad1d6f4d5995c61af44c68959900319f2df7b775ddf5a8da89fe6c2b15d652c
+SHA512 (samba-4.7.0.tar.xz) = 6d5564c338dbe5d0e30a7af0c5bf06e6e9c7a78d3af6627d346f6a68dfe1a5adea789b5b79a080769c5aeb9e06cabab1923da5f1daa0842f4546362b69ccac6b
+SHA512 (samba-4.7.0.tar.asc) = 61879829ea8048b21ba8c625d3a2676c75f05eaf0ac7858fd435d1cdf27004f0a6fcbb112ecb253a1cd7f4d62a1e3492bb487368a49800e54e90dbb612853a77