diff --git a/strongswan-5.8.4.tar.bz2 b/strongswan-5.8.4.tar.bz2
deleted file mode 100644
index 8cc45ed..0000000
--- a/strongswan-5.8.4.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2d9a57e33813b62d58cba07531c4d5a35c6b823dfe9b8ff7c623b6571f02553c
-size 4546240
diff --git a/strongswan-5.8.4.tar.bz2.sig b/strongswan-5.8.4.tar.bz2.sig
deleted file mode 100644
index 190bf14..0000000
--- a/strongswan-5.8.4.tar.bz2.sig
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1
-
-iQGcBAABAgAGBQJegIHmAAoJEN9CwXCzTbp3onEL/iwMScWYL6KgjQCJp2acqFZf
-R+aVc18W/Pb4z6Qc8YghcVPlXG1L9cyfHTCHV3jNPXAX3qB+EMSG+DVfY7INdOfg
-3It6rVLwMLMYiPmmsMUoZpOfM4Fpw5rM6fjWPI3KogUpjF814TN1JJNIXC0e5jA0
-AxzLczzhhNbG+YnSdSDd/XhjG816QDYAv1WdoFvgP65QSVBKmQPzZz+ons6Ivjl5
-Il3Tly5IJnOeDfe/K0bsnNBXomjIWnQDtlwG4wfAFJV6YwTtJEvwMErQg9W9iVHY
-tndOdn/C8CfPXVnaBAbnkX3Vk9MWhLP+pFMF56Xojga8gPkqTD15zLubVlx8Gzal
-dW3s7qi0bmca10JwzOpuDePhzziemcqpsexdlhOuffaz+GZ2wHfupeixVXuFoV+F
-b3/htxfibnU8IqQl0YCdYh4vwKYwr6cz07TphmQBhrsLy8SjVr/EngPreDVDCgJ4
-tip0FJvV6yU7RTyNHqJOvKfwz9AEbo1ZRsfEEi6Qxw==
-=Xj8F
------END PGP SIGNATURE-----
diff --git a/strongswan-5.9.0.tar.bz2 b/strongswan-5.9.0.tar.bz2
new file mode 100644
index 0000000..7814955
--- /dev/null
+++ b/strongswan-5.9.0.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:72b47a385da5d1532b816d9fe04c50d074c29ed42ea3f0878fbd66335917bb66
+size 4568404
diff --git a/strongswan-5.9.0.tar.bz2.sig b/strongswan-5.9.0.tar.bz2.sig
new file mode 100644
index 0000000..b7bc796
--- /dev/null
+++ b/strongswan-5.9.0.tar.bz2.sig
@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQGcBAABAgAGBQJfIVyVAAoJEN9CwXCzTbp3p3cL+gKB4H0U/CxpV/pazru6bkBB
+aZYWm+zTNZG+W0Xh7466NlhZU+Z4nDYm8nr4M3tZPJ9Gas4bZnkZmqYROWotyzH8
+6R72n50ZIT7aRdL72LBNZqk89RCGJqWMcgs9aJwr319/s75SEV2ez53zEWUsMwLi
+j8JMjE9I8swmcyKk1qHLuyGUTk/THKq2iN5v3w9kHkGNSow892XVhjl5MvE6sVZt
+ceNc3YBmnWsJc1XbPP94TMtUJQ4PIscJvx1ysfSsLnIhej/VlId4DzbgVNXwWYNp
+RwuecQi8UZTjQ1PORIYlCAK3a+t//Fts4oz7XxS5vCE96LlmoiM17Kt9uPFKNv24
+q1CzmExoW5BmqKxiILWM7EOMIFELmRdq5j2Ar9qLdreAxYXFqwoc+o+DRa79QyuZ
+4Ul09JRBAvcvLk/B2zY7Z6IPvCsyWyfq9uznzeKo1zsv+q/61H/pvZ6uSr6S58No
+BsZSeBXrFLkSJDbGrREpP1/ajYCDFfBwz8jx//J/NQ==
+=OvzW
+-----END PGP SIGNATURE-----
diff --git a/strongswan.changes b/strongswan.changes
index eb05874..7048f2d 100644
--- a/strongswan.changes
+++ b/strongswan.changes
@@ -1,3 +1,21 @@
+-------------------------------------------------------------------
+Mon Sep  7 08:38:01 UTC 2020 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 5.9.0
+  * Prefer AEAD algorithms for ESP; this puts AES-GCM in a default
+    AEAD proposal in front of the previous default proposal.
+  * If a connection fails after getting redirected, we now
+    restart connecting to the original host, not the one
+    redirected to.
+  * For peers that don't send the EAP_ONLY_AUTHENTICATION notify
+    but still expect to use EAP-only authentication, the
+    charon.force_eap_only_authentication option can be enabled to
+    force this type of authentication even on non-compliant
+    peers.
+  * IPv6 virtual IPs are now always enumerated, ignoring the
+    charon.prefer_temporary_addrs setting, which should fix route
+    installation if the latter is enabled.
+
 -------------------------------------------------------------------
 Tue Sep  1 16:31:02 UTC 2020 - Jan Engelhardt <jengelh@inai.de>
 
diff --git a/strongswan.spec b/strongswan.spec
index c7ad454..4be2ea9 100644
--- a/strongswan.spec
+++ b/strongswan.spec
@@ -17,7 +17,7 @@
 
 
 Name:           strongswan
-Version:        5.8.4
+Version:        5.9.0
 Release:        0
 %define         upstream_version     %{version}
 %define         strongswan_docdir    %{_docdir}/%{name}
@@ -478,13 +478,13 @@ sed -i 's/\(load[ ]*=[ ]*\)yes/\1no/g' %{buildroot}/%{strongswan_configs}/charon
 
 %postun libs0 -p /sbin/ldconfig
 
-%pre ipsec
 %if %{with systemd}
+%pre ipsec
 %service_add_pre %{name}.service
 %endif
 
-%post ipsec
 %if %{with systemd}
+%post ipsec
 %service_add_post %{name}.service
 %endif
 
@@ -503,8 +503,8 @@ if test -s %{_sysconfdir}/ipsec.conf.rpmsave ; then
 	                        %{_sysconfdir}/ipsec.conf.rpmsave.old
 fi
 
-%postun ipsec
 %if %{with systemd}
+%postun ipsec
 %service_del_postun %{name}.service
 %endif