diff --git a/main/arm-trusted-firmware/APKBUILD b/main/arm-trusted-firmware/APKBUILD
index 102c2f691855dfa3f4b86e28188792b59f74e6f0..c261ab8240ad1644116adab79f8b42ec2c43e807 100644
--- a/main/arm-trusted-firmware/APKBUILD
+++ b/main/arm-trusted-firmware/APKBUILD
@@ -2,7 +2,7 @@
 # Contributor: Maxim Karasev <begs@disroot.org>
 # Maintainer: Bart Ribbers <bribbers@disroot.org>
 pkgname=arm-trusted-firmware
-pkgver=2.8.8
+pkgver=2.8.9
 pkgrel=0
 pkgdesc="ARM Trusted Firmware-A (TF-A)"
 url="https://github.com/ARM-software/arm-trusted-firmware"
@@ -78,7 +78,7 @@ tools() {
 }
 
 sha512sums="
-f0107e8cf8362f48e427e4831084093f703823525c7126b3993d05828190d4f615b21bbe589254680838bca8c49d00736399bba2f0241fc9c2d58c5de999ac18  arm-trusted-firmware-2.8.8.tar.gz
-f2ff9b6d2b843123e9044af5ead00a1e927e5389e5ab6bdb05ef0eb3a23468a615d6203e14afd05b3e250c9b39836d0d33920833f1211b51671ae5cd3e7e0da8  key_t.patch
+01aae529eb28be0ea54bb912eda9477e092a9432960c5be9d5891203a39048e9baed50fcffd84720afdf9ec174e3db07623bdab9d1e88aeb0c2f939a00b7f41e  arm-trusted-firmware-2.8.9.tar.gz
+71f59abbb3c53d975afe0f20456e8bd943f005aeeb14633f609ad7b7617d51c479a505b54f9c49f77e02ecdea233bc8dffecd31b79b86a38d9ad39f6b0dc1129  key_t.patch
 4b26d06cc5f23cd73515927624c164745dd144a0255a717052d80d904a58e001cb7b334ce1fa20cf21ba18b6e0f024da011321cb2c53dfb44ddd52ee24e31a66  rk3399.patch
 "
diff --git a/main/arm-trusted-firmware/key_t.patch b/main/arm-trusted-firmware/key_t.patch
index af014e352f558c3fad8a81d659c076cfecd97f7c..07c6cf16b283d77c2a4d26a5616bf52602ba44d0 100644
--- a/main/arm-trusted-firmware/key_t.patch
+++ b/main/arm-trusted-firmware/key_t.patch
@@ -2,9 +2,9 @@ without it /usr/include/bits/alltypes.h defines key_t as int
 
 --- a/tools/cert_create/Makefile
 +++ b/tools/cert_create/Makefile
-@@ -43,7 +43,7 @@
- include ${PLAT_CERT_CREATE_HELPER_MK}
- endif
+@@ -49,7 +49,7 @@ endif
+ # from setting the OPENSSL_DIR path.
+ $(eval $(call SELECT_OPENSSL_API_VERSION))
  
 -HOSTCCFLAGS := -Wall -std=c99
 +HOSTCCFLAGS := -Wall -std=c99 -D__DEFINED_key_t=1