diff --git a/F00102-lib64.patch b/F00102-lib64.patch
index 18ac3ba..8b07d52 100644
--- a/F00102-lib64.patch
+++ b/F00102-lib64.patch
@@ -130,7 +130,7 @@ Co-authored-by: Iryna Shcherbina <shcherbina.iryna@gmail.com>
          'data': '{userbase}',
 --- a/Lib/test/test_site.py
 +++ b/Lib/test/test_site.py
-@@ -266,8 +266,8 @@ class HelperFunctionsTests(unittest.Test
+@@ -267,8 +267,8 @@ class HelperFunctionsTests(unittest.Test
          dirs = site.getsitepackages()
          if os.sep == '/':
              # OS X, Linux, FreeBSD, etc
@@ -183,7 +183,7 @@ Co-authored-by: Iryna Shcherbina <shcherbina.iryna@gmail.com>
      }
 --- a/configure
 +++ b/configure
-@@ -15188,9 +15188,9 @@ fi
+@@ -15214,9 +15214,9 @@ fi
  
  
  if test x$PLATFORM_TRIPLET = x; then
@@ -197,7 +197,7 @@ Co-authored-by: Iryna Shcherbina <shcherbina.iryna@gmail.com>
  
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4674,9 +4674,9 @@ fi
+@@ -4689,9 +4689,9 @@ fi
  dnl define LIBPL after ABIFLAGS and LDVERSION is defined.
  AC_SUBST(PY_ENABLE_SHARED)
  if test x$PLATFORM_TRIPLET = x; then
diff --git a/Python-3.8.5.tar.xz b/Python-3.8.5.tar.xz
deleted file mode 100644
index 79da25c..0000000
--- a/Python-3.8.5.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e3003ed57db17e617acb382b0cade29a248c6026b1bd8aad1f976e9af66a83b0
-size 18019640
diff --git a/Python-3.8.5.tar.xz.asc b/Python-3.8.5.tar.xz.asc
deleted file mode 100644
index 3e21ae2..0000000
--- a/Python-3.8.5.tar.xz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAl8VnlAACgkQsmmV4xAl
-BWj2+Q/9FxlF7DPcVP3+9eHsW//aXpXNm/3hFZNlvpDX5Y0qsT4mOCFlqzBVVufY
-nXp+pz4l5HJGcvMfgW13aDVvl5HHK0WHEl7gI19wuE+1Ot3LO2Cq4sgNW3SzvmdF
-Dif3Ovvz1mE/S5LYXfLrsmOpU9oNe1oOiHX7l8WTBArMzCckc+e6TxRlLZw0NTr4
-8mgWu9+OTw8ltOSDyGZLrzXHoRssfSSLjjwxeDm2fLYo4YWj11Q6qIFp7dUEK23d
-Yv7o980fiw8VaxFFV3a/UH2EXVS+AL8Gxb7NpxS4ejtfPmLKnb0CHSjvnT45KqFi
-MfkV41ng4chW4CC14rugfd2QvC9a+EIKm3Hd1qt3iFIv1pn38w8wT5Nf7tMN9lhZ
-90eVh8nJAUHlAs+4Zz/crHwfxQ82pnf6TpIqJEJzaxQ3ncS0creG0jKwnWhLLheJ
-TVhqAxIENVbync7mfjHD2sNknC/YqiuUGSef13Wc3d15V26HqeUULiNupsZ9n6wr
-G1Llh+Wxld0kW7ht+1Gt1R1I9CsTYMWX3CvWCZVibh0ClT4r63n09kJGul4WdYp1
-IdjrEPgm0GMSRFuR1MN0qSCBkpGyYgikHJYw8fwykqi+MSp1Ibh/eO1DhuInyrbx
-Rb1FicRsRi7E9Tak9yXjKzAr67dPLcPwnblTkdRINFglAP3IiGo=
-=ussS
------END PGP SIGNATURE-----
diff --git a/Python-3.8.6.tar.xz b/Python-3.8.6.tar.xz
new file mode 100644
index 0000000..d1fdeef
--- /dev/null
+++ b/Python-3.8.6.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a9e0b79d27aa056eb9cce8d63a427b5f9bab1465dee3f942dcfdb25a82f4ab8a
+size 18233864
diff --git a/Python-3.8.6.tar.xz.asc b/Python-3.8.6.tar.xz.asc
new file mode 100644
index 0000000..8d228f0
--- /dev/null
+++ b/Python-3.8.6.tar.xz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAl9rVG4ACgkQsmmV4xAl
+BWjO7Q//c53m2UmRypzJxgxF1EizNzmPGmc1w87X9oaDJNsMhNBwgHCbMkwDdyO3
+mh+MjfkvLhIS1tXj4X+FYl+XURB1FGO1qhtXlpPTHVw+z5l5RmZwyAJIm3TgjPL5
+p/3jG9p/LqB3sADhds2lhbc4cEtXOhrm789FqjEz6r1hAYieo/frx4RbrmIF+OER
+rmRp6Z7MdMwYDxaIvR5yZicbUFoMl8wvN0WAjLpXb7BAHb+l0zjc00803rmi9xaR
+u0tIjz3jn25Mw81gpgjfnnqOSncap1F6OHhw2AzUN5GzgoG3/cPA96VjqJuAXpSC
+RjhHdV7DMvVh806Ck6BX98Ed3wLGbAVAIXKsdZSSZ67s1CTXfyp+wf5NeIKU70wA
+1NCxPosQsrzGr6TpUts9MXed45dg9EPPuf7MjTeyKx8m7JaOsQOo8rkI8B5Sw+bf
+QIilcSHJnWOKjMQUsCqFI96ZF/zwfyFMKZ6zd+9bIH7iIqXgQ2wiWgR17AGH9uBW
+CVPIw5ucnt+1VR5+eZqYU+mLjqgJILkOkNlvpJBywtNOivUcBZVt8LHpt6tD60bI
+EbOBVrQveY8mmiQsXEDCza7PnRDk83iqHS2BPOCLFAeNdN6JAGfVdr0WA5ZM9EmT
+kbLICbAABfJSFXoPeEqnCLIFP4omsT7R7rTv29K8/lPGbc2VTaA=
+=/x9a
+-----END PGP SIGNATURE-----
diff --git a/SUSE-FEDORA-multilib.patch b/SUSE-FEDORA-multilib.patch
index 48f09de..a386007 100644
--- a/SUSE-FEDORA-multilib.patch
+++ b/SUSE-FEDORA-multilib.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4671,12 +4671,26 @@ else
+@@ -4686,12 +4686,26 @@ else
    LIBPYTHON=''
  fi
  
@@ -267,7 +267,7 @@
              addsitedir(sitedir, known_paths)
 --- a/Lib/test/test_site.py
 +++ b/Lib/test/test_site.py
-@@ -266,8 +266,11 @@ class HelperFunctionsTests(unittest.Test
+@@ -267,8 +267,11 @@ class HelperFunctionsTests(unittest.Test
          dirs = site.getsitepackages()
          if os.sep == '/':
              # OS X, Linux, FreeBSD, etc
@@ -314,7 +314,7 @@
          # just making sure _main() runs and returns things in the stdout
 --- a/configure
 +++ b/configure
-@@ -15188,9 +15188,9 @@ fi
+@@ -15214,9 +15214,9 @@ fi
  
  
  if test x$PLATFORM_TRIPLET = x; then
@@ -361,7 +361,7 @@
  import tempfile
  import textwrap
  
-@@ -1070,12 +1071,13 @@ class InitConfigTests(EmbeddingTestsMixi
+@@ -1072,12 +1073,13 @@ class InitConfigTests(EmbeddingTestsMixi
              return config['config']['module_search_paths']
          else:
              ver = sys.version_info
@@ -377,7 +377,7 @@
                               f'python{ver.major}.{ver.minor}', 'lib-dynload'),
              ]
  
-@@ -1180,13 +1182,15 @@ class InitConfigTests(EmbeddingTestsMixi
+@@ -1188,13 +1190,15 @@ class InitConfigTests(EmbeddingTestsMixi
      def test_init_pyvenv_cfg(self):
          # Test path configuration with pyvenv.cfg configuration file
  
diff --git a/bpo34022-stop_hash-based_invalidation_w_SOURCE_DATE_EPOCH.patch b/bpo34022-stop_hash-based_invalidation_w_SOURCE_DATE_EPOCH.patch
index b92feba..e155da6 100644
--- a/bpo34022-stop_hash-based_invalidation_w_SOURCE_DATE_EPOCH.patch
+++ b/bpo34022-stop_hash-based_invalidation_w_SOURCE_DATE_EPOCH.patch
@@ -70,7 +70,7 @@ subsequent commits.
  class EncodingTest(unittest.TestCase):
      """Issue 6716: compileall should escape source code when printing errors
      to stdout."""
-@@ -579,6 +594,21 @@ class CommandLineTestsBase:
+@@ -620,6 +635,21 @@ class CommandLineTestsBase:
  
  
  class CommmandLineTestsWithSourceEpoch(CommandLineTestsBase,
@@ -124,8 +124,8 @@ subsequent commits.
  
 --- a/Lib/test/test_py_compile.py
 +++ b/Lib/test/test_py_compile.py
-@@ -216,5 +216,19 @@ class PyCompileTestsWithoutSourceEpoch(P
-     pass
+@@ -272,5 +272,19 @@ class PyCompileCLITestCase(unittest.Test
+         self.assertIn(b'No such file or directory', stderr)
  
  
 +class PyCompileTestsWithSourceEpoch(PyCompileTestsBase,
diff --git a/python38.changes b/python38.changes
index 8e4e714..43b7fd4 100644
--- a/python38.changes
+++ b/python38.changes
@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Mon Nov  9 10:51:30 UTC 2020 - Matej Cepl <mcepl@suse.com>
+
+- Update to 3.8.6, which contains various bug fixes including security
+  fix of included pip and setuptools (bpo#41490, bsc#1176262,
+  CVE-2019-20916). Full list of changes is available at
+  https://docs.python.org/release/3.8.6/whatsnew/changelog.html#python-3-8-6
+- Revert previous patch, and readd bpo-31046_ensurepip_honours_prefix.patch.
+
+-------------------------------------------------------------------
+Fri Oct 30 17:49:32 CET 2020 - Matej Cepl <mcepl@suse.com>
+
+- Replace ensurepip with simple script instructing to install
+  packaged pip (bsc#1176262).
+- Remove bpo-31046_ensurepip_honours_prefix.patch, which is not
+  necessary anymore.
+
 -------------------------------------------------------------------
 Fri Oct  9 16:05:50 UTC 2020 - Dominique Leuenberger <dimstar@opensuse.org>
 
diff --git a/python38.spec b/python38.spec
index 8e99a9b..66c9d19 100644
--- a/python38.spec
+++ b/python38.spec
@@ -87,7 +87,7 @@
 %bcond_without profileopt
 %endif
 Name:           %{python_pkg_name}%{psuffix}
-Version:        3.8.5
+Version:        3.8.6
 Release:        0
 Summary:        Python 3 Interpreter
 License:        Python-2.0
diff --git a/subprocess-raise-timeout.patch b/subprocess-raise-timeout.patch
index 98d751e..ffbd28f 100644
--- a/subprocess-raise-timeout.patch
+++ b/subprocess-raise-timeout.patch
@@ -1,6 +1,6 @@
 --- a/Lib/test/test_subprocess.py
 +++ b/Lib/test/test_subprocess.py
-@@ -1124,7 +1124,8 @@ class ProcessTestCase(BaseTestCase):
+@@ -1125,7 +1125,8 @@ class ProcessTestCase(BaseTestCase):
          self.assertIn("0.0001", str(c.exception))  # For coverage of __str__.
          # Some heavily loaded buildbots (sparc Debian 3.x) require this much
          # time to start.