diff --git a/dns/knot3/distinfo b/dns/knot3/distinfo
index 3b9983a0c7f5..00dadc33bbc2 100644
--- a/dns/knot3/distinfo
+++ b/dns/knot3/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1788551437
-SHA256 (knot-3.5.8.tar.xz) = 4197c902feccf32475b254c7ddaa1ac123700e3895f50b80103ffeb8352a2807
-SIZE (knot-3.5.8.tar.xz) = 1736408
+TIMESTAMP = 1789038600
+SHA256 (knot-3.6.0.tar.xz) = 922894f04a2835131a24c3b3edcbf761273c1b37d3dc4e46d6923ee3856af130
+SIZE (knot-3.6.0.tar.xz) = 1852000
diff --git a/dns/knot3/distinfo.py-libknot b/dns/knot3/distinfo.py-libknot
index cb08a53955fe..b4f1f0648895 100644
--- a/dns/knot3/distinfo.py-libknot
+++ b/dns/knot3/distinfo.py-libknot
@@ -1,3 +1,3 @@
-TIMESTAMP = 1788551455
-SHA256 (libknot-3.5.8.tar.gz) = d3b262423ecb573653b5daba2e08604db175eb9870a53268b059e1b041dd1607
-SIZE (libknot-3.5.8.tar.gz) = 16942
+TIMESTAMP = 1789038614
+SHA256 (libknot-3.6.0.tar.gz) = 60a0b4154b4573f5c3e156ac5d34210a78b6e15f215f96592d4d5b87179c0c8a
+SIZE (libknot-3.6.0.tar.gz) = 17725
diff --git a/dns/knot3/knotdns.mk b/dns/knot3/knotdns.mk
index c0bd72550bfc..dd29e4114bfb 100644
--- a/dns/knot3/knotdns.mk
+++ b/dns/knot3/knotdns.mk
@@ -1 +1 @@
-KNOT_VERSION=	3.5.8
+KNOT_VERSION=	3.6.0
diff --git a/dns/knot3/pkg-plist b/dns/knot3/pkg-plist
index 9444e6567b8c..4765436b3317 100644
--- a/dns/knot3/pkg-plist
+++ b/dns/knot3/pkg-plist
@@ -1,118 +1,110 @@
 %%UTILS%%bin/kdig
 %%UTILS%%bin/khost
 %%UTILS%%bin/knsec3hash
 %%UTILS%%bin/knsupdate
 %%UTILS%%bin/kzonecheck
 %%UTILS%%bin/kzonesign
 %%DAEMON%%%%ETCDIR%%/example.com.zone
 %%DAEMON%%%%EXAMPLES%%@sample %%ETCDIR%%/knot.conf.sample
 include/knot/module.h
-include/libdnssec/binary.h
-include/libdnssec/crypto.h
-include/libdnssec/digest.h
-include/libdnssec/dnssec.h
-include/libdnssec/error.h
-include/libdnssec/key.h
-include/libdnssec/keyid.h
-include/libdnssec/keystore.h
-include/libdnssec/keytag.h
-include/libdnssec/nsec.h
-include/libdnssec/pem.h
-include/libdnssec/random.h
-include/libdnssec/sign.h
-include/libdnssec/tsig.h
-include/libdnssec/version.h
 include/libknot/attribute.h
 include/libknot/codes.h
 include/libknot/consts.h
 include/libknot/control/control.h
 include/libknot/cookies.h
 include/libknot/db/db.h
 include/libknot/db/db_lmdb.h
 include/libknot/db/db_trie.h
+include/libknot/dnssec/binary.h
+include/libknot/dnssec/crypto.h
+include/libknot/dnssec/digest.h
+include/libknot/dnssec/key.h
+include/libknot/dnssec/keyid.h
+include/libknot/dnssec/keystore.h
+include/libknot/dnssec/keytag.h
+include/libknot/dnssec/nsec.h
+include/libknot/dnssec/pem.h
+include/libknot/dnssec/random.h
+include/libknot/dnssec/sign.h
+include/libknot/dnssec/tsig.h
 include/libknot/descriptor.h
 include/libknot/dname.h
 include/libknot/dynarray.h
 include/libknot/endian.h
 include/libknot/errcode.h
 include/libknot/error.h
 include/libknot/libknot.h
 include/libknot/lookup.h
 include/libknot/mm_ctx.h
 include/libknot/packet/compr.h
 include/libknot/packet/pkt.h
 include/libknot/packet/rrset-wire.h
 include/libknot/packet/wire.h
 include/libknot/probe/data.h
 include/libknot/probe/probe.h
 %%DOQ%%include/libknot/quic/quic.h
 %%DOQ%%include/libknot/quic/quic_conn.h
 %%DOQ%%include/libknot/quic/tls.h
 %%DOQ%%include/libknot/quic/tls_common.h
 include/libknot/rdata.h
 include/libknot/rdataset.h
 include/libknot/rrset-dump.h
 include/libknot/rrset.h
 include/libknot/rrtype/dnskey.h
 include/libknot/rrtype/ds.h
 include/libknot/rrtype/naptr.h
 include/libknot/rrtype/nsec.h
 include/libknot/rrtype/nsec3.h
 include/libknot/rrtype/nsec3param.h
 include/libknot/rrtype/opt.h
 include/libknot/rrtype/rdname.h
 include/libknot/rrtype/rrsig.h
 include/libknot/rrtype/soa.h
 include/libknot/rrtype/svcb.h
 include/libknot/rrtype/tsig.h
 include/libknot/rrtype/zonemd.h
 include/libknot/tsig-op.h
 include/libknot/tsig.h
 include/libknot/version.h
 include/libknot/wire.h
 include/libknot/xdp.h
 include/libknot/xdp/tcp_iobuf.h
 include/libknot/yparser/yparser.h
 include/libknot/yparser/ypformat.h
 include/libknot/yparser/ypschema.h
 include/libknot/yparser/yptrafo.h
 include/libzscanner/error.h
 include/libzscanner/scanner.h
 include/libzscanner/version.h
-lib/libdnssec.a
-lib/libdnssec.so
-lib/libdnssec.so.10
-lib/libdnssec.so.10.0.0
 lib/libknot.a
 lib/libknot.so
-lib/libknot.so.16
-lib/libknot.so.16.0.0
+lib/libknot.so.17
+lib/libknot.so.17.0.0
 lib/libzscanner.a
 lib/libzscanner.so
 lib/libzscanner.so.5
 lib/libzscanner.so.5.0.0
 %%DAEMON%%libdata/pkgconfig/knotd.pc
-libdata/pkgconfig/libdnssec.pc
 libdata/pkgconfig/libknot.pc
 libdata/pkgconfig/libzscanner.pc
 %%DOCS%%share/man/man1/kdig.1.gz
 %%DOCS%%share/man/man1/khost.1.gz
 %%DOCS%%share/man/man1/knsec3hash.1.gz
 %%DOCS%%share/man/man1/knsupdate.1.gz
 %%DOCS%%share/man/man1/kzonecheck.1.gz
 %%DOCS%%share/man/man1/kzonesign.1.gz
 %%DOCS%%share/man/man5/knot.conf.5.gz
 %%DOCS%%share/man/man8/kcatalogprint.8.gz
 %%DOCS%%share/man/man8/keymgr.8.gz
 %%DOCS%%share/man/man8/kjournalprint.8.gz
 %%DOCS%%share/man/man8/knotc.8.gz
 %%DOCS%%share/man/man8/knotd.8.gz
 %%DOCS%%share/man/man8/kxdpgun.8.gz
 %%DAEMON%%sbin/kcatalogprint
 %%DAEMON%%sbin/keymgr
 %%DAEMON%%sbin/kjournalprint
 %%DAEMON%%sbin/knotc
 %%DAEMON%%sbin/knotd
 %%DAEMON%%@dir(%%USERS%%,%%GROUPS%%,0750) %%DATADIR%%
 %%DAEMON%%@dir(%%USERS%%,%%GROUPS%%,0750) %%ETCDIR%%
 %%DAEMON%%@dir(%%USERS%%,%%GROUPS%%,0700) %%RUNDIR%%