diff --git a/SPECS/thunderbird.spec b/SPECS/thunderbird.spec
index ff6e324..f80bb08 100644
--- a/SPECS/thunderbird.spec
+++ b/SPECS/thunderbird.spec
@@ -23,20 +23,17 @@
 %global rhel_minor_version 0
 %endif
 
+%global system_nss        1
 %global bundle_nss        0
-# Use system nspr/nss? FIXME
-%global system_nss        0
+
 %if 0%{?rhel} == 8
   %if 0%{?rhel_minor_version} < 2
 %global bundle_nss        1
   %endif
 %endif
-%if 0%{?rhel} == 7
-#FIXME use system nss, just for testing
-%global system_nss        1
-%endif
+
 %if 0%{?rhel} == 6
-%global bundle_nss        0
+%global system_nss        0
 %endif
 
 %define use_bundled_ffi   0
@@ -134,12 +131,12 @@
 %endif
 
 %if 0%{?system_nss}
-%global nspr_version 4.21
+%global nspr_version 4.25
 # NSS/NSPR quite often ends in build override, so as requirement the version
 # we're building against could bring us some broken dependencies from time to time.
 #%global nspr_build_version %(pkg-config --silence-errors --modversion nspr 2>/dev/null || echo 65536)
 %global nspr_build_version %{nspr_version}
-%global nss_version 3.44
+%global nss_version 3.53.1
 #%global nss_build_version %(pkg-config --silence-errors --modversion nss 2>/dev/null || echo 65536)
 %global nss_build_version %{nss_version}
 %endif
@@ -149,33 +146,23 @@
 %define bundled_python_version_3 3.6.8
 %define use_bundled_openssl     0
 %define use_bundled_nodejs      0
+%define use_bundled_yasm        0
 
 %if 0%{?rhel} == 8
   %if 0%{?rhel_minor_version} <= 2
 %define use_bundled_nodejs      1
-%define use_bundled_python_2    1
   %endif
 %endif
 
-%if 0%{?rhel} < 8
-%define use_bundled_nodejs      1
-%define use_bundled_python_2    1
-#TODO DISABLE FOR RHEL7
-%define use_bundled_yasm        0
 %if 0%{?rhel} == 7
 %define use_bundled_nodejs      1
-#TODO DISABLE FOR RHEL7
 %define use_bundled_yasm        1
 %endif
+
 %if 0%{?rhel} == 6
+%define use_bundled_nodejs      1
 %define use_bundled_openssl     1
 %define use_bundled_yasm        1
-%endif
-%endif
-
-# GTK3 bundling
-%define avoid_bundled_rebuild   0
-%if 0%{?rhel} == 6
 %define bundle_gtk3             1
 # In-tree libffi is able to build on following platforms, we have to bundle it for the rest
 %ifnarch x86_64 i686 aarch64
@@ -183,16 +170,16 @@
 %endif
 %endif
 
+# GTK3 bundling
+%define avoid_bundled_rebuild   0
+
 %define gtk3_nvr 3.22.26-1
 %define gtk3_install_path %{mozappdir}/bundled
 
-%if 0%{?bundle_gtk3}
 # We could use %%include, but in %%files, %%post and other sections, but in these
 # sections it could lead to syntax errors about unclosed %%if. Work around it by
 # using the following macro
 %define include_file() %{expand:%(cat '%1')}
-%endif
-
 
 %global mozappdir     %{_libdir}/%{name}
 %global mozappdirdev  %{_libdir}/%{name}-devel-%{version}
@@ -205,7 +192,7 @@
 Summary:        Mozilla Thunderbird mail/newsgroup client
 Name:           thunderbird
 Version:        78.3.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 URL:            http://www.mozilla.org/projects/thunderbird/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 Group:          Applications/Internet
@@ -301,6 +288,7 @@ Patch514:        mozilla-s390x-skia-gradient.patch
 Patch515:        mozilla-bmo1626236.patch
 Patch516:        D87019-thin-vec-big-endian.diff
 
+
 # CentOS patches
 %if 0%{?centos}
 Patch10000:      Bug-1238661---fix-mozillaSignalTrampoline-to-work-.patch
@@ -329,7 +317,6 @@ BuildRequires:  pkgconfig(libpng)
 BuildRequires:  xz
 BuildRequires:  libXt-devel
 BuildRequires:  mesa-libGL-devel
-BuildRequires:  zip
 Requires:       liberation-fonts-common
 Requires:       liberation-sans-fonts
 %if %{?system_jpeg}
@@ -384,7 +371,6 @@ BuildRequires:  clang >= %{llvm_version}
 BuildRequires:  clang-devel >= %{llvm_version}
 BuildRequires:  rustfmt >= %{rust_version}
 BuildRequires:  python3
-BuildRequires:  python3-devel
 BuildRequires:  nodejs >= 10.21
 %else
 %if 0%{?use_rustts}
@@ -392,8 +378,6 @@ BuildRequires:  rust-toolset-%{rust_toolset_version}
 %endif
 %if 0%{?rhel} == 7
 #BuildRequires:  rh-nodejs12
-BuildRequires:  python3
-BuildRequires:  python3-devel
 %endif
 %if 0%{?use_llvmts}
 BuildRequires:  llvm-toolset-%{llvm_version}
@@ -508,7 +492,9 @@ BuildRequires:  pkgconfig(libffi)
 %endif
 
 %if %{?use_bundled_nodejs}
-#BuildRequires: python3-devel
+%if !0%{?use_bundled_python_3}
+BuildRequires: python3-devel
+%endif
 BuildRequires: zlib-devel
 #BuildRequires: brotli-devel
 #BuildRequires: gcc >= 4.9.4
@@ -607,6 +593,8 @@ echo "use_bundled_yasm      %{?use_bundled_yasm}"
 %patch514 -p1 -b .mozilla-s390x-skia-gradient
 %patch515 -p1 -b .mozilla-bmo1626236
 %patch516 -p1 -b .D87019-thin-vec-big-endian.diff
+
+
 %patch1001 -p1 -b .ppc64le-inline
 %patch1004 -p1 -b .icu-make
 
@@ -805,7 +793,7 @@ function build_bundled_package() {
     %endif
     %if 0%{?rhel} > 6
       export PACKAGE_DIR="$PACKAGE_DIR/$ARCH_STR"
-        %endif
+    %endif
   fi
   pushd $PACKAGE_DIR
 
@@ -844,7 +832,6 @@ function build_bundled_package() {
    install_rpms_to_current_dir nspr-4*.rpm
    install_rpms_to_current_dir nspr-devel*.rpm
    popd
-   #FIXME needs nspr install location and flags
    echo "Setting nspr flags"
    # nss-setup-flags-env.inc
    sed -i 's@%{gtk3_install_path}@%{_buildrootdir}%{gtk3_install_path}@g' %{_buildrootdir}%{gtk3_install_path}/%{_lib}/pkgconfig/nspr*.pc
@@ -855,12 +842,10 @@ function build_bundled_package() {
    export PKG_CONFIG_PATH=%{_buildrootdir}%{gtk3_install_path}/%{_lib}/pkgconfig
    export PATH="{_buildrootdir}%{gtk3_install_path}/bin:$PATH"
 
-   #%include_file %{SOURCE401}
    export PATH=%{_buildrootdir}/%{gtk3_install_path}/bin:$PATH
    echo $PKG_CONFIG_PATH
 
    rpm -ivh %{SOURCE403}
-   #rpmbuild --nodeps --define '_prefix %{gtk3_install_path}' --without=tests -ba %{_specdir}/nss.spec
    rpmbuild --nodeps --define '_prefix %{gtk3_install_path}' -ba %{_specdir}/nss.spec
    pushd %{_buildrootdir}
    #cleanup
@@ -927,8 +912,6 @@ function build_bundled_package() {
     pushd %{_builddir}/python2/Python-%{bundled_python_version_2}
     ./configure --prefix="%{_buildrootdir}" --exec-prefix="%{_buildrootdir}" --libdir="%{_buildrootdir}/lib"
     make %{?_smp_mflags} install V=1
-    which python2
-    which python
     popd    
 %endif
 
@@ -1041,12 +1024,6 @@ MOZ_OPT_FLAGS=$(echo "%{optflags}" | %{__sed} -e 's/-Wall//')
 # for some sources
 # Explicitly force the hardening flags for Firefox so it passes the checksec test;
 # See also https://fedoraproject.org/wiki/Changes/Harden_All_Packages
-%if 0%{?fedora} < 30
-MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -Wformat-security -Wformat -Werror=format-security"
-%else
-# Workaround for mozbz#1531309
-MOZ_OPT_FLAGS=$(echo "$MOZ_OPT_FLAGS" | %{__sed} -e 's/-Werror=format-security//')
-%endif
 MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -Wformat-security -Wformat -Werror=format-security"
 %if 0%{?fedora} > 23
 # Disable null pointer gcc6 optimization in gcc6 (rhbz#1328045)
@@ -1070,7 +1047,7 @@ export MOZ_DEBUG_FLAGS=" "
 # We don't wantfirefox to use CK_GCM_PARAMS_V3 in nss
 MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -DNSS_PKCS11_3_0_STRICT"
 
-%ifarch s390 %{arm} ppc aarch64 i686 x86_64
+%ifarch s390 %{arm} ppc aarch64 i686 x86_64 s390x
 MOZ_LINK_FLAGS="-Wl,--no-keep-memory -Wl,--reduce-memory-overheads"
 %endif
 %ifarch %{arm} i686
@@ -1436,7 +1413,7 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #===============================================================================
 
 %changelog
-* Sat Sep 19 2020 Jan Horak <jhorak@redhat.com> - 78.3.0-2
+* Sat Sep 19 2020 Jan Horak <jhorak@redhat.com> - 78.3.0-3
 - Update to 78.3.0 build1
 - Remove librdp.so as long as we cannot ship it in RHEL