diff --git a/.gitignore b/.gitignore
index a899280..e9d062c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/openjdk-jdk17-jdk-17+33.tar.xz
+SOURCES/openjdk-jdk17-jdk-17+35.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz
diff --git a/.java-17-openjdk.metadata b/.java-17-openjdk.metadata
index 045cd9d..5e77c19 100644
--- a/.java-17-openjdk.metadata
+++ b/.java-17-openjdk.metadata
@@ -1,2 +1,2 @@
-e2edecf5fbb3d791367caf2a0e148d643ad7e9cf SOURCES/openjdk-jdk17-jdk-17+33.tar.xz
+a2bffc90da173240cdf0e3ea6971d4ba432b3cfe SOURCES/openjdk-jdk17-jdk-17+35.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
diff --git a/SOURCES/jdk8272332-rh2004078-broken_harfbuzz_linking.patch b/SOURCES/jdk8272332-rh2004078-broken_harfbuzz_linking.patch
new file mode 100644
index 0000000..9acd70d
--- /dev/null
+++ b/SOURCES/jdk8272332-rh2004078-broken_harfbuzz_linking.patch
@@ -0,0 +1,21 @@
+commit e506cb23cfce35d1bc997d1e280f4dc40c9b3397
+Author: Severin Gehwolf <sgehwolf@openjdk.org>
+Date:   Mon Aug 16 09:57:28 2021 +0000
+
+    8272332: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790
+    
+    Backport-of: d38b31438dd4730ee2149c02277d60c35b9d7d81
+
+diff --git openjdk.orig/make/modules/java.desktop/lib/Awt2dLibraries.gmk openjdk/make/modules/java.desktop/lib/Awt2dLibraries.gmk
+index 4d0c0c00dbf..ef7eadae206 100644
+--- openjdk.orig/make/modules/java.desktop/lib/Awt2dLibraries.gmk
++++ openjdk/make/modules/java.desktop/lib/Awt2dLibraries.gmk
+@@ -435,7 +435,7 @@ endif
+ 
+ ifeq ($(USE_EXTERNAL_HARFBUZZ), true)
+    LIBFONTMANAGER_EXTRA_SRC =
+-   BUILD_LIBFONTMANAGER_FONTLIB += $(LIBHARFBUZZ_LIBS)
++   BUILD_LIBFONTMANAGER_FONTLIB += $(HARFBUZZ_LIBS)
+ else
+    LIBFONTMANAGER_EXTRA_SRC = libharfbuzz
+ 
diff --git a/SPECS/java-17-openjdk.spec b/SPECS/java-17-openjdk.spec
index ed96b3c..b472157 100644
--- a/SPECS/java-17-openjdk.spec
+++ b/SPECS/java-17-openjdk.spec
@@ -276,7 +276,7 @@
 %global interimver 0
 %global updatever 0
 %global patchver 0
-# If you bump featurever, you must bump also vendor_version_string
+# If you bump featurever, you must also bump vendor_version_string
 # Used via new version scheme. JDK 17 was
 # GA'ed in September 2021 => 21.9
 %global vendor_version_string 21.9
@@ -297,8 +297,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        33
-%global rpmrelease      5
+%global buildver        35
+%global rpmrelease      3
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -321,7 +321,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global expected_ea_designator ""
@@ -1188,6 +1188,13 @@ Patch1012: rh1996182-extend_security_policy.patch
 #
 #############################################
 
+#############################################
+#
+# OpenJDK patches appearing in 17.0.1
+#
+#############################################
+# JDK-8272332, RH2004078: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790
+Patch100: jdk8272332-rh2004078-broken_harfbuzz_linking.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -1534,6 +1541,7 @@ pushd %{top_level_dir_name}
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch100 -p1
 popd # openjdk
 
 %patch1000
@@ -2263,6 +2271,13 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Thu Sep 16 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-3
+- Update to jdk-17+35, also known as jdk-17-ga.
+- Switch to GA mode.
+- Add JDK-8272332 fix so we actually link against HarfBuzz.
+- Resolves: rhbz#2003072
+- Resolves: rhbz#2004078
+
 * Mon Aug 30 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.5.ea
 - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
 - Resolves: rhbz#1996182