diff --git a/Makefile b/Makefile
index 9f06d45..9277fc4 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,8 @@
 
 PACKAGER?=	$(shell hg config ui.username)
 
+TARBALL?=	https://nginx.org/download/nginx-$(VERSION).tar.gz
+
 BASE_MAKEFILES=	alpine/Makefile \
 		debian/Makefile \
 		rpm/SPECS/Makefile
@@ -23,6 +25,16 @@
 MODULES=	geoip image-filter perl xslt
 EXTERNAL_MODULES=	njs
 
+ifeq ($(shell sha512sum --version >/dev/null 2>&1 || echo FAIL),)
+SHA512SUM = sha512sum
+else ifeq ($(shell shasum --version >/dev/null 2>&1 || echo FAIL),)
+SHA512SUM = shasum -a 512
+else ifeq ($(shell openssl version >/dev/null 2>&1 || echo FAIL),)
+SHA512SUM = openssl dgst -r -sha512
+else
+SHA512SUM = $(error SHA-512 checksumming not found)
+endif
+
 default:
 	@{ \
 		echo "Latest available $(FLAVOR) nginx package version: $(CURRENT_VERSION)-$(CURRENT_RELEASE)" ; \
@@ -39,13 +51,18 @@
 		fi ; \
 	}
 
-release: version-check
+nginx-$(VERSION).tar.gz:
+	curl -o nginx-$(VERSION).tar.gz -fL $(TARBALL)
+
+release: version-check nginx-$(VERSION).tar.gz
 	@{ \
+		set -e ; \
 		echo "==> Preparing $(FLAVOR) release $(VERSION)-$(RELEASE)" ; \
+		$(SHA512SUM) nginx-$(VERSION).tar.gz >>contrib/src/nginx/SHA512SUMS ; \
+		sed -e "s,^NGINX_VERSION :=.*,NGINX_VERSION := $(VERSION),g" -i contrib/src/nginx/version ; \
 		for f in $(BASE_MAKEFILES); do \
 			echo "--> $${f}" ; \
-			sed -e "s,^BASE_VERSION=.*,BASE_VERSION=	$(VERSION),g" \
-				-e "s,^BASE_RELEASE=.*,BASE_RELEASE=	$(RELEASE),g" \
+			sed -e "s,^BASE_RELEASE=.*,BASE_RELEASE=	$(RELEASE),g" \
 				-i $${f} ; \
 		done ; \
 		reldate=`date +"%Y-%m-%d"` ; \
@@ -72,7 +89,7 @@
 	}
 
 revert:
-	@hg revert -v docs/ $(BASE_MAKEFILES)
+	@hg revert -v contrib/src/nginx/ docs/ $(BASE_MAKEFILES)
 
 commit:
 	@hg commit -vm 'Updated nginx to $(VERSION)'