diff --git a/mozilla-nss.changes b/mozilla-nss.changes
index 01b72f7..4afa1de 100644
--- a/mozilla-nss.changes
+++ b/mozilla-nss.changes
@@ -1,3 +1,38 @@
+-------------------------------------------------------------------
+Mon Apr 10 21:31:33 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- update to NSS 3.89
+  * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase
+  * bmo#1820175 - PR_STATIC_ASSERT is cursed
+  * bmo#1767883 - Need to add policy control to keys lengths for signatures
+  * bmo#1820175 - Fix unreachable code warning in fuzz builds
+  * bmo#1820175 - Fix various compiler warnings in NSS
+  * bmo#1820175 - Enable various compiler warnings for clang builds
+  * bmo#1815136 - set PORT error after sftk_HMACCmp failure
+  * bmo#1767883 - Need to add policy control to keys lengths for signatures
+  * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt
+  * bmo#1804660 - Make high tag number assertion failure an error
+  * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key
+                  length from 284 to 384
+  * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello
+  * bmo#1789436 - Fix build failure on Windows
+  * bmo#1811337 - migrate Win 2012 tasks to Azure
+  * bmo#1810702 - fix title length in doc
+  * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite
+  * bmo#1570615 - Add presence/absence tests for TLS GREASE
+  * bmo#1804688 - Correct addition of GREASE value to ALPN xtn
+  * bmo#1789436 - CH extension permutation
+  * bmo#1570615 - TLS GREASE (RFC8701)
+  * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types
+  * bmo#1815870 - use a different treeherder symbol for each docker
+                  image build task
+  * bmo#1815868 - pin an older version of the ubuntu:18.04 and
+                  20.04 docker images
+  * bmo#1810702 - remove nested table in rst doc
+  * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag
+  * bmo#1812671 - build failure while implicitly casting SECStatus
+                  to PRUInt32
+
 -------------------------------------------------------------------
 Sat Mar 11 13:21:23 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>
 
diff --git a/mozilla-nss.spec b/mozilla-nss.spec
index 448ebe4..67b0492 100644
--- a/mozilla-nss.spec
+++ b/mozilla-nss.spec
@@ -17,14 +17,14 @@
 #
 
 
-%global nss_softokn_fips_version 3.88
+%global nss_softokn_fips_version 3.89
 %define NSPR_min_version 4.35
 %define nspr_ver %(rpm -q --queryformat '%%{VERSION}' mozilla-nspr)
 %define nssdbdir %{_sysconfdir}/pki/nssdb
 Name:           mozilla-nss
-Version:        3.88.1
+Version:        3.89
 Release:        0
-%define underscore_version 3_88_1
+%define underscore_version 3_89
 Summary:        Network Security Services
 License:        MPL-2.0
 Group:          System/Libraries
diff --git a/nss-3.88.1.tar.gz b/nss-3.88.1.tar.gz
deleted file mode 100644
index 02b800f..0000000
--- a/nss-3.88.1.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:27d243edf87d1cf1bb9c861f03d387e0e9230ce5017f4308c941f558b54b3496
-size 71607211
diff --git a/nss-3.89.tar.gz b/nss-3.89.tar.gz
new file mode 100644
index 0000000..d02fb94
--- /dev/null
+++ b/nss-3.89.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:55c37a3f4da010d0574fb8b39264cb1e7b4ce9e6c2954c1c7ecf9f41ee00bed5
+size 71617802