diff --git a/nss.spec b/nss.spec
index 351865a..35e2336 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,6 +1,6 @@
 %global nspr_version 4.13.0
-%global nss_util_version 3.27.0
-%global nss_softokn_version 3.27.0
+%global nss_util_version 3.28.1
+%global nss_softokn_version 3.28.1
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global allTools "certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv"
 
@@ -21,7 +21,7 @@ Name:             nss
 Version:          3.28.1
 # for Rawhide, please always use release >= 2
 # for Fedora release branches, please use release < 2 (1.0, 1.1, ...)
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -793,6 +793,10 @@ fi
 
 
 %changelog
+* Fri Jan 13 2017 Daiki Ueno <dueno@redhat.com> - 3.28.1-3
+- Fix incorrect version specification in %%nss_{util,softokn}_version,
+  pointed by Elio Maldonado
+
 * Fri Jan  6 2017 Daiki Ueno <dueno@redhat.com> - 3.28.1-2
 - Rebase to NSS 3.28.1
 - Remove upstreamed patch for disabling RSA-PSS
diff --git a/setup-nsssysinit.sh b/setup-nsssysinit.sh
old mode 100744
new mode 100755