diff --git a/config/rootfiles/common/knot b/config/rootfiles/common/knot
index cde89bede..20bad49a3 100644
--- a/config/rootfiles/common/knot
+++ b/config/rootfiles/common/knot
@@ -4,22 +4,6 @@ usr/bin/knsec3hash
 usr/bin/knsupdate
 #usr/include/knot
 #usr/include/knot/module.h
-#usr/include/libdnssec
-#usr/include/libdnssec/binary.h
-#usr/include/libdnssec/crypto.h
-#usr/include/libdnssec/digest.h
-#usr/include/libdnssec/dnssec.h
-#usr/include/libdnssec/error.h
-#usr/include/libdnssec/key.h
-#usr/include/libdnssec/keyid.h
-#usr/include/libdnssec/keystore.h
-#usr/include/libdnssec/keytag.h
-#usr/include/libdnssec/nsec.h
-#usr/include/libdnssec/pem.h
-#usr/include/libdnssec/random.h
-#usr/include/libdnssec/sign.h
-#usr/include/libdnssec/tsig.h
-#usr/include/libdnssec/version.h
 #usr/include/libknot
 #usr/include/libknot/attribute.h
 #usr/include/libknot/codes.h
@@ -33,6 +17,19 @@ usr/bin/knsupdate
 #usr/include/libknot/db/db_trie.h
 #usr/include/libknot/descriptor.h
 #usr/include/libknot/dname.h
+#usr/include/libknot/dnssec
+#usr/include/libknot/dnssec/binary.h
+#usr/include/libknot/dnssec/crypto.h
+#usr/include/libknot/dnssec/digest.h
+#usr/include/libknot/dnssec/key.h
+#usr/include/libknot/dnssec/keyid.h
+#usr/include/libknot/dnssec/keystore.h
+#usr/include/libknot/dnssec/keytag.h
+#usr/include/libknot/dnssec/nsec.h
+#usr/include/libknot/dnssec/pem.h
+#usr/include/libknot/dnssec/random.h
+#usr/include/libknot/dnssec/sign.h
+#usr/include/libknot/dnssec/tsig.h
 #usr/include/libknot/dynarray.h
 #usr/include/libknot/endian.h
 #usr/include/libknot/errcode.h
@@ -85,18 +82,13 @@ usr/bin/knsupdate
 #usr/include/libzscanner/error.h
 #usr/include/libzscanner/scanner.h
 #usr/include/libzscanner/version.h
-#usr/lib/libdnssec.la
-#usr/lib/libdnssec.so
-usr/lib/libdnssec.so.10
-usr/lib/libdnssec.so.10.0.0
 #usr/lib/libknot.la
 #usr/lib/libknot.so
-usr/lib/libknot.so.16
-usr/lib/libknot.so.16.0.0
+usr/lib/libknot.so.17
+usr/lib/libknot.so.17.0.0
 #usr/lib/libzscanner.la
 #usr/lib/libzscanner.so
 usr/lib/libzscanner.so.5
 usr/lib/libzscanner.so.5.0.0
-#usr/lib/pkgconfig/libdnssec.pc
 #usr/lib/pkgconfig/libknot.pc
 #usr/lib/pkgconfig/libzscanner.pc
diff --git a/lfs/knot b/lfs/knot
index c3626cad7..97995b669 100644
--- a/lfs/knot
+++ b/lfs/knot
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.5.8
+VER        = 3.6.0
 
 THISAPP    = knot-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = e7793b469c7782a3aa14c8e02fb038d8d1d943283a9cd4dde7bee6a7296d5c4149e0752f8741317dabadbe4dfe930c715a8c82b6c27bb483b8f358c17acac3c4
+$(DL_FILE)_BLAKE2 = 454d12deb35c91fd3c3e71cfd4021bd0d36fb39446e3cef41a47df3bbc0362950de1a21eb742d936dbce13a822891b313da335b8bb21026b88d4d985d8c763c0
 
 install : $(TARGET)