diff --git a/net/knot/Makefile b/net/knot/Makefile
index b537585d0..648183a72 100644
--- a/net/knot/Makefile
+++ b/net/knot/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=knot
-PKG_VERSION:=2.3.3
+PKG_VERSION:=2.5.6
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://secure.nic.cz/files/knot-dns/
-PKG_HASH:=a929bce3b957a81776b1db7b43b0e4473339bf16be8dbba5abb4b0593bf43c94
+PKG_HASH:=37d1625c2aaefe2394c85f6742a6ae9421e8348318c13119a6c451796c387cfc
 
 PKG_MAINTAINER:=Daniel Salzman <daniel.salzman@nic.cz>
 PKG_LICENSE:=GPL-3.0 LGPL-2.0 0BSD MIT OLDAP-2.8
@@ -28,6 +28,7 @@ define Package/knot-lib/Default
 	SECTION:=libs
 	CATEGORY:=Libraries
 	TITLE:=Knot DNS
+	DEPENDS=+libpthread
 	URL:=https://www.knot-dns.cz
 endef
 
@@ -36,85 +37,81 @@ define Package/knot/Default
 	CATEGORY:=Network
 	SUBMENU:=IP Addresses and Names
 	TITLE:=Knot DNS
+	DEPENDS=+libatomic
 	URL:=https://www.knot-dns.cz
-	USERID:=knot=5353:knot=5353
-endef
-
-define Package/knot-libdnssec
-	$(call Package/knot-lib/Default)
-	TITLE+= DNSSEC library
-	DEPENDS=+libpthread +libgnutls +jansson
 endef
 
-define Package/knot-libknot
+define Package/knot-libs
 	$(call Package/knot-lib/Default)
-	TITLE+= library
-	DEPENDS=+libpthread +knot-libdnssec
+	TITLE+= common DNS and DNSSEC libraries
+	DEPENDS+=+libgnutls
 endef
 
 define Package/knot-libzscanner
 	$(call Package/knot-lib/Default)
 	TITLE+= zone parser library
-	DEPENDS=+libpthread
 endef
 
 define Package/knot
 	$(call Package/knot/Default)
-	TITLE+= server
-	DEPENDS=+liburcu +libedit +knot-libdnssec +knot-libknot +knot-libzscanner
+	TITLE+= server with control utility
+	DEPENDS+=+libedit +liburcu +knot-libs +knot-libzscanner
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE)), \
+	               knot-libzscanner (=$(PKG_VERSION)-$(PKG_RELEASE))
+	USERID:=knot=5353:knot=5353
 endef
 
 define Package/knot-dig
 	$(call Package/knot/Default)
 	TITLE+= advanced DNS lookup utility
-	DEPENDS=+knot-libdnssec +knot-libknot
+	DEPENDS+=+libedit +knot-libs
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
 define Package/knot-host
 	$(call Package/knot/Default)
 	TITLE+= simple DNS lookup utility
-	DEPENDS=+knot-libdnssec +knot-libknot
+	DEPENDS+=+libedit +knot-libs
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
 define Package/knot-nsupdate
 	$(call Package/knot/Default)
 	TITLE+= dynamic DNS update utility
-	DEPENDS=+knot-libdnssec +knot-libknot +knot-libzscanner
-endef
-
-define Package/knot-nsec3hash
-	$(call Package/knot/Default)
-	TITLE+= simple NSEC3 hash utility
-	DEPENDS=+knot-libdnssec
+	DEPENDS+=+libedit +knot-libs +knot-libzscanner
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE)), \
+	               knot-libzscanner (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
 define Package/knot-zonecheck
 	$(call Package/knot/Default)
 	TITLE+= zonefile check utility
-	DEPENDS=+liburcu +knot-libdnssec +knot-libknot +knot-libzscanner
+	DEPENDS+=+libedit +liburcu +knot-libs +knot-libzscanner
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE)), \
+	               knot-libzscanner (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
 define Package/knot-keymgr
 	$(call Package/knot/Default)
 	TITLE+= DNSSEC key management utility
-	DEPENDS=+liburcu +knot-libdnssec +knot-libknot +knot-libzscanner
+	DEPENDS+=+libedit +liburcu +knot-libs +knot-libzscanner
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE)), \
+	               knot-libzscanner (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
 define Package/knot-tests
 	$(call Package/knot/Default)
 	TITLE+= tests
-	DEPENDS=+liburcu +libedit +knot-libdnssec +knot-libknot +knot-libzscanner
+	DEPENDS+=+libedit +liburcu +knot-libs +knot-libzscanner
+	EXTRA_DEPENDS:=knot-libs (=$(PKG_VERSION)-$(PKG_RELEASE)), \
+	               knot-libzscanner (=$(PKG_VERSION)-$(PKG_RELEASE))
 endef
 
-define Package/knot-libdnssec/description
-	Knot DNS DNSSEC library.
+define Package/knot-libs/description
+	Knot DNS common DNS and DNSSEC libraries.
 endef
 
-define Package/knot-libknot/description
-	Knot DNS library.
-endef
-
-define Package/knot-libdnssec/description
+define Package/knot-libzscanner/description
 	Knot DNS zone parser library.
 endef
 
@@ -134,10 +131,6 @@ define Package/knot-nsupdate/description
 	Knot DNS dynamic DNS update utility.
 endef
 
-define Package/knot-nsec3hash/description
-	Knot DNS simple NSEC3 hash utility.
-endef
-
 define Package/knot-zonecheck/description
 	Knot DNS zonefile check utility.
 endef
@@ -158,8 +151,7 @@ CONFIGURE_ARGS += 			\
 	--with-rundir=/var/run/knot	\
 	--with-storage=/var/lib/knot	\
 	--with-configdir=/etc/knot	\
-	--with-timer-mapsize=50		\
-	--with-conf-mapsize=50
+	--with-conf-mapsize=20
 
 TARGET_CFLAGS += -DPSELECT_COMPAT -DNDEBUG
 
@@ -192,13 +184,9 @@ define Build/InstallDev
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/*.pc	$(1)/usr/lib/pkgconfig/
 endef
 
-define Package/knot-libdnssec/install
+define Package/knot-libs/install
 	$(INSTALL_DIR) 						$(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libdnssec.so.*		$(1)/usr/lib/
-endef
-
-define Package/knot-libknot/install
-	$(INSTALL_DIR) 						$(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libknot.so.*		$(1)/usr/lib/
 endef
 
@@ -235,11 +223,6 @@ define Package/knot-nsupdate/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/knsupdate	$(1)/usr/bin/
 endef
 
-define Package/knot-nsec3hash/install
-	$(INSTALL_DIR)						$(1)/usr/bin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/knsec3hash	$(1)/usr/bin/
-endef
-
 define Package/knot-zonecheck/install
 	$(INSTALL_DIR)						$(1)/usr/bin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/kzonecheck	$(1)/usr/bin/
@@ -258,50 +241,35 @@ define Package/knot-tests/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/libtap/runtests		$(1)/usr/share/knot/tap/
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/libtap/tap/libtap.sh	$(1)/usr/share/knot/tap/
 
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests
-	find $(PKG_BUILD_DIR)/tests/.libs -maxdepth 1 -executable -type f | \
-		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/.libs/{}		$(1)/usr/share/knot/tests/test_{}
-
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests/dnssec
-	find $(PKG_BUILD_DIR)/src/dnssec/tests -maxdepth 1 -executable -type f | \
-		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/src/dnssec/tests/{}	$(1)/usr/share/knot/tests/dnssec/test_{}
-
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests/contrib
-	find $(PKG_BUILD_DIR)/tests/contrib/.libs -maxdepth 1 -executable -type f | \
-		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/contrib/.libs/{}	$(1)/usr/share/knot/tests/contrib/{}
+	$(INSTALL_DIR)								$(1)/usr/share/knot/tests
 
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests/libknot
-	find $(PKG_BUILD_DIR)/tests/libknot/.libs -maxdepth 1 -executable -type f | \
-		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/libknot/.libs/{}	$(1)/usr/share/knot/tests/libknot/{}
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/zscanner/tests/.libs/zscanner-tool	$(1)/usr/share/knot/tests/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/zscanner/tests/unittests		$(1)/usr/share/knot/tests/test_zscanner
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/src/zscanner/tests/TESTS		$(1)/usr/share/knot/tests/
+	cp -a $(PKG_BUILD_DIR)/src/zscanner/tests/data				$(1)/usr/share/knot/tests/
 
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests/modules
-	find $(PKG_BUILD_DIR)/tests/modules/.libs -maxdepth 1 -executable -type f | \
+	find $(PKG_BUILD_DIR)/src/dnssec/tests -maxdepth 1 -executable -type f | \
 		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/modules/.libs/{}	$(1)/usr/share/knot/tests/modules/test_{}
+		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/src/dnssec/tests/{}	$(1)/usr/share/knot/tests/dnssec_test_{}
 
-	$(INSTALL_DIR)									$(1)/usr/share/knot/tests/utils
-	find $(PKG_BUILD_DIR)/tests/utils/.libs -maxdepth 1 -executable -type f | \
+	find $(PKG_BUILD_DIR)/tests/.libs -maxdepth 1 -executable -type f | \
 		xargs -I{} basename {} | \
-		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/utils/.libs/{}	$(1)/usr/share/knot/tests/utils/{}
+		xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/.libs/{}		$(1)/usr/share/knot/tests/{}
 
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/zscanner/tests/.libs/zscanner-tool	$(1)/usr/share/knot/tests/
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/zscanner/tests/unittests		$(1)/usr/share/knot/tests/test_zscanner
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/src/zscanner/tests/TESTS		$(1)/usr/share/knot/tests/
-	cp -a $(PKG_BUILD_DIR)/src/zscanner/tests/data				$(1)/usr/share/knot/tests/
+	for module in contrib libknot modules utils; do \
+		find $(PKG_BUILD_DIR)/tests/$$$${module}/.libs -maxdepth 1 -executable -type f | \
+			xargs -I{} basename {} | \
+			xargs -I{} $(INSTALL_BIN) -T $(PKG_BUILD_DIR)/tests/$$$${module}/.libs/{} \
+											$(1)/usr/share/knot/tests/$$$${module}_{}; \
+	done
 endef
 
-$(eval $(call BuildPackage,knot-libdnssec))
-$(eval $(call BuildPackage,knot-libknot))
+$(eval $(call BuildPackage,knot-libs))
 $(eval $(call BuildPackage,knot-libzscanner))
 $(eval $(call BuildPackage,knot))
 $(eval $(call BuildPackage,knot-dig))
 $(eval $(call BuildPackage,knot-host))
 $(eval $(call BuildPackage,knot-nsupdate))
-$(eval $(call BuildPackage,knot-nsec3hash))
 $(eval $(call BuildPackage,knot-zonecheck))
 $(eval $(call BuildPackage,knot-keymgr))
 $(eval $(call BuildPackage,knot-tests))
diff --git a/net/knot/files/runtests.sh b/net/knot/files/runtests.sh
index e70c76b32..b0b772eeb 100644
--- a/net/knot/files/runtests.sh
+++ b/net/knot/files/runtests.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 cd `dirname "$0"`/tests
-../tap/runtests -b /tmp ./contrib/test_* ./dnssec/test_* ./libknot/test_* ./modules/test_* ./utils/test_* ./test_*
+../tap/runtests -b /tmp ./*test_*
 ret=$?
 cd -
 
diff --git a/net/knot/patches/02_knot.conf.patch b/net/knot/patches/02_knot.conf.patch
index 215b09fbe..54ad80b75 100644
--- a/net/knot/patches/02_knot.conf.patch
+++ b/net/knot/patches/02_knot.conf.patch
@@ -1,5 +1,5 @@
 diff --git a/samples/knot.sample.conf.in b/samples/knot.sample.conf.in
-index e07c8a7..ecc13ad 100644
+index e07c8a7..8e057b0 100644
 --- a/samples/knot.sample.conf.in
 +++ b/samples/knot.sample.conf.in
 @@ -9,7 +9,7 @@ server:
@@ -11,3 +11,14 @@ index e07c8a7..ecc13ad 100644
  
  log:
      # Log info and more serious events to syslog.
+@@ -33,7 +33,9 @@ acl:
+ #    action: notify
+ 
+ template:
+-#  - id: default
++   - id: default
++     max-journal-db-size: 20M
++     max-timer-db-size: 5M
+ #    storage: "@storage_dir@"
+ 
+ zone:
diff --git a/net/knot/patches/03_contrib_files.patch b/net/knot/patches/03_contrib_files.patch
deleted file mode 100644
index 02f519803..000000000
--- a/net/knot/patches/03_contrib_files.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/src/contrib/files.c b/src/contrib/files.c
-index 8aee482..12f36ca 100644
---- a/src/contrib/files.c
-+++ b/src/contrib/files.c
-@@ -24,6 +24,10 @@
- #include <sys/stat.h>
- #include <unistd.h>
- 
-+#ifndef O_NOFOLLOW
-+#define O_NOFOLLOW 0
-+#endif
-+
- static bool special_name(const char *name)
- {
- 	return strcmp(name, ".") == 0 || strcmp(name, "..") == 0;