diff --git a/.gitignore b/.gitignore
index e548efa..1d41c7c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /sbsigntools-0.9.1.tar.xz
 /sbsigntools-0.9.2.tar.xz
 /sbsigntools-0.9.3.tar.xz
+/sbsigntools-0.9.4.tar.xz
diff --git a/sbsigntools-mktarball.sh b/sbsigntools-mktarball.sh
index c34d870..07f8a30 100755
--- a/sbsigntools-mktarball.sh
+++ b/sbsigntools-mktarball.sh
@@ -12,8 +12,8 @@ tmp=$(mktemp -d)
 
 unset CDPATH
 pwd=$(pwd)
-version=0.9.3
-commit=fe88da5f66241d959b7aeca7502d401ad88df410
+version=0.9.4
+commit=d52f7bbb73401aab8a1d59e8d0d686ad9641035e
 
 pushd "$tmp"
 git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git
diff --git a/sbsigntools.spec b/sbsigntools.spec
index 80ba706..a42d63b 100644
--- a/sbsigntools.spec
+++ b/sbsigntools.spec
@@ -1,7 +1,7 @@
 %bcond_without check
 
 Name:          sbsigntools
-Version:       0.9.3
+Version:       0.9.4
 Release:       1%{?dist}
 Summary:       Signing utility for UEFI secure boot
 License:       GPLv3+
@@ -73,12 +73,16 @@ make check
 %{_bindir}/sbvarsign
 %{_bindir}/sbverify
 %{_mandir}/man1/sbattach.1.*
+%{_mandir}/man1/sbkeysync.1.*
 %{_mandir}/man1/sbsiglist.1.*
 %{_mandir}/man1/sbsign.1.*
 %{_mandir}/man1/sbvarsign.1.*
 %{_mandir}/man1/sbverify.1.*
 
 %changelog
+* Fri Jul 03 2020 Dominik Mierzejewski <dominik@greysector.net> - 0.9.4-1
+- update to 0.9.4 (#1846578)
+
 * Mon Feb 03 2020 Dominik Mierzejewski <dominik@greysector.net> - 0.9.3-1
 - update to 0.9.3
 - update bundled CCAN components list
diff --git a/sources b/sources
index c0019fc..3141750 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sbsigntools-0.9.3.tar.xz) = b57d2c708171701e0c7c155c7637a99a72347ad1ff787d456c01098566c2f7c44719d212a3b57f700fc3bfc41b20c0a62a18ed0e8e2c83d5724122db16b7cfa0
+SHA512 (sbsigntools-0.9.4.tar.xz) = ad1a2ed2a937414c6aee593a6d37638a56076fdbda112943af16c46dcaca578d3dac6498dc02f7e62499328cd82b48ab635f4fbac1ae49c606c9a717d9301133