diff --git a/.gitignore b/.gitignore
index 5ab5130..5182be9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
 /sequoia-openpgp-1.15.0.crate
 /sequoia-openpgp-1.16.0.crate
 /sequoia-openpgp-1.16.1.crate
+/sequoia-openpgp-1.17.0.crate
diff --git a/rust-sequoia-openpgp.spec b/rust-sequoia-openpgp.spec
index 2f5401e..28174c9 100644
--- a/rust-sequoia-openpgp.spec
+++ b/rust-sequoia-openpgp.spec
@@ -1,26 +1,25 @@
-# Generated by rust2rpm 24
+# Generated by rust2rpm 25
 %bcond_without check
 %global debug_package %{nil}
 
 %global crate sequoia-openpgp
 
 Name:           rust-sequoia-openpgp
-Version:        1.16.1
+Version:        1.17.0
 Release:        %autorelease
 Summary:        OpenPGP data types and associated machinery
 
 License:        LGPL-2.0-or-later
 URL:            https://crates.io/crates/sequoia-openpgp
 Source:         %{crates_source}
-# Automatically generated patch to strip foreign dependencies
+# Automatically generated patch to strip dependencies and normalize metadata
 Patch:          sequoia-openpgp-fix-metadata-auto.diff
 # Manually created patch for downstream crate metadata changes
-# * drop feature for Windows-specific crypto backend
-# * drop unused, benchmark-only criterion dev-dependency to speed up builds
-# * bump rpassword dev-dependency from 6 to 7
+# * drop unused, benchmark-only criterion dev-dependency
+# * drop sha1collisiondetection features from unused crypto-rust feature
 Patch:          sequoia-openpgp-fix-metadata.diff
 
-BuildRequires:  rust-packaging >= 21
+BuildRequires:  cargo-rpm-macros >= 24
 
 %global _description %{expand:
 OpenPGP data types and associated machinery.}
@@ -210,7 +209,7 @@ use the "openssl-sys" feature of the "%{crate}" crate.
 %ghost %{crate_instdir}/Cargo.toml
 
 %prep
-%autosetup -n %{crate}-%{version_no_tilde} -p1
+%autosetup -n %{crate}-%{version} -p1
 %cargo_prep
 
 %generate_buildrequires
@@ -225,10 +224,12 @@ use the "openssl-sys" feature of the "%{crate}" crate.
 
 %if %{with check}
 %check
-# * run tests with nettle crypto backend (default)
+# * run tests with the Nettle crypto backend (default)
 %cargo_test -n -f crypto-nettle,compression
-# * run tests with openssl crypto backend
-%cargo_test -n -f crypto-openssl,compression
+# * run tests with the OpenSSL crypto backend
+# * skip tests that are not reliable with OpenSSL:
+#   https://gitlab.com/sequoia-pgp/sequoia/-/issues/1064
+%cargo_test -n -f crypto-openssl,compression -- -- --skip leak_tests
 %endif
 
 %changelog
diff --git a/rust2rpm.conf b/rust2rpm.conf
deleted file mode 100644
index 784f37a..0000000
--- a/rust2rpm.conf
+++ /dev/null
@@ -1,35 +0,0 @@
-[DEFAULT]
-unwanted-features =
-  aes
-  block-padding
-  blowfish
-  botan
-  cast5
-  cfb-mode
-  cipher
-  des
-  digest
-  eax
-  ecb
-  ecdsa
-  ed25519
-  ed25519-dalek
-  generic-array
-  idea
-  md-5
-  num-bigint-dig
-  p256
-  rand07
-  rand
-  rand_core
-  ripemd
-  rsa
-  sha-1
-  sha2
-  twofish
-  typenum
-  x25519-dalek-ng
-  crypto-botan
-  crypto-botan2
-  crypto-cng
-  crypto-rust
diff --git a/rust2rpm.toml b/rust2rpm.toml
new file mode 100644
index 0000000..a30c132
--- /dev/null
+++ b/rust2rpm.toml
@@ -0,0 +1,39 @@
+[features]
+hide = [
+    # optional dependencies
+    "aes",
+    "aes-gcm",
+    "block-padding",
+    "blowfish",
+    "botan",
+    "camellia",
+    "cast5",
+    "cfb-mode",
+    "cipher",
+    "des",
+    "digest",
+    "dsa",
+    "eax",
+    "ecb",
+    "ecdsa",
+    "ed25519",
+    "ed25519-dalek",
+    "idea",
+    "md-5",
+    "num-bigint-dig",
+    "p256",
+    "rand_core",
+    "ripemd",
+    "rsa",
+    "sha2",
+    "twofish",
+    "typenum",
+    "x25519-dalek",
+    # features
+    "crypto-botan",
+    "crypto-botan2",
+    "crypto-cng",
+    "crypto-fuzzing",
+    "crypto-rust",
+]
+
diff --git a/sequoia-openpgp-fix-metadata-auto.diff b/sequoia-openpgp-fix-metadata-auto.diff
index c550561..2127d9b 100644
--- a/sequoia-openpgp-fix-metadata-auto.diff
+++ b/sequoia-openpgp-fix-metadata-auto.diff
@@ -1,15 +1,15 @@
---- sequoia-openpgp-1.16.1/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ sequoia-openpgp-1.16.1/Cargo.toml	2023-09-26T17:18:43.557770+00:00
-@@ -303,8 +303,6 @@
+--- sequoia-openpgp-1.17.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ sequoia-openpgp-1.17.0/Cargo.toml	2023-11-02T16:07:29.750839+00:00
+@@ -314,8 +314,6 @@
  crypto-cng = [
      "cipher",
      "eax",
 -    "winapi",
 -    "win-crypto-ng",
+     "ed25519",
      "ed25519-dalek",
      "num-bigint-dig",
- ]
-@@ -349,37 +347,6 @@
+@@ -365,35 +363,9 @@
      "crypto-nettle",
  ]
  
@@ -18,6 +18,7 @@
 -features = [
 -    "std",
 -    "wasmbind",
+-    "clock",
 -]
 -default-features = false
 -
@@ -25,13 +26,8 @@
 -version = "0.2"
 -features = ["js"]
 -
--[target."cfg(all(target_arch = \"wasm32\", target_os = \"unknown\"))".dependencies.rand07]
--version = "0.7"
--features = ["wasm-bindgen"]
--package = "rand"
--
 -[target."cfg(windows)".dependencies.win-crypto-ng]
--version = ">=0.4, <0.5.1"
+-version = "0.5.1"
 -features = [
 -    "rand",
 -    "block-cipher",
@@ -47,3 +43,6 @@
  [badges.gitlab]
  repository = "sequoia-pgp/sequoia"
  
+ [badges.maintenance]
+ status = "actively-developed"
++
diff --git a/sequoia-openpgp-fix-metadata.diff b/sequoia-openpgp-fix-metadata.diff
index 5657756..52b6024 100644
--- a/sequoia-openpgp-fix-metadata.diff
+++ b/sequoia-openpgp-fix-metadata.diff
@@ -1,22 +1,22 @@
---- sequoia-openpgp-1.16.1/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ sequoia-openpgp-1.16.1/Cargo.toml	2023-09-26T17:19:35.531001+00:00
-@@ -264,10 +264,6 @@
+--- sequoia-openpgp-1.17.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ sequoia-openpgp-1.17.0/Cargo.toml	2023-11-02T16:07:42.232894+00:00
+@@ -277,10 +277,6 @@
+ [dependencies.xxhash-rust]
  version = "0.8"
  features = ["xxh3"]
- 
+-
 -[dev-dependencies.criterion]
--version = "0.4"
+-version = "0.5"
 -features = ["html_reports"]
--
+ 
  [dev-dependencies.quickcheck]
  version = "1"
- default-features = false
-@@ -276,7 +272,7 @@
- version = "0.8"
- 
- [dev-dependencies.rpassword]
--version = "6.0"
-+version = "7.0"
- 
- [build-dependencies.lalrpop]
- version = ">=0.17, <0.20"
+@@ -346,8 +342,6 @@
+     "ripemd",
+     "rsa",
+     "sha2",
+-    "sha1collisiondetection/digest-trait",
+-    "sha1collisiondetection/oid",
+     "twofish",
+     "typenum",
+     "x25519-dalek",
diff --git a/sources b/sources
index ebe0569..0969d47 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sequoia-openpgp-1.16.1.crate) = c12b0bdacfc120f51f02d05029627b81c9d3be3a7297763a378c472560a5b81d1a46c3bd2acf5482c8147e1cc1f247cf0afeac735d786a77c32eeaa8e624e914
+SHA512 (sequoia-openpgp-1.17.0.crate) = 275d0e393befc19e8b9a70f7e931d8f95f093a2f4734e8ff2543176b1c38b7d9e07e95bf474df0a1784d210baadfcc4f3de689e5061818ca3a22d604f52f6cba