diff --git a/.gitignore b/.gitignore
index 8d491e5..0b9dd04 100644
--- a/.gitignore
+++ b/.gitignore
@@ -415,3 +415,4 @@
 /anaconda-40.22.3.18.tar.bz2
 /anaconda-40.22.3.19.tar.bz2
 /anaconda-40.22.3.20.tar.bz2
+/anaconda-40.22.3.21.tar.bz2
diff --git a/anaconda.spec b/anaconda.spec
index 311ff8f..3dde86d 100644
--- a/anaconda.spec
+++ b/anaconda.spec
@@ -1,6 +1,6 @@
 Summary: Graphical system installer
 Name:    anaconda
-Version: 40.22.3.20
+Version: 40.22.3.21
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 URL:     http://fedoraproject.org/wiki/Anaconda
@@ -37,7 +37,7 @@ Source0: https://github.com/rhinstaller/%{name}/releases/download/%{name}-%{vers
 %define libreportanacondaver 2.0.21-1
 %define mehver 0.23-1
 %define nmver 1.0
-%define pykickstartver 3.52.5-1
+%define pykickstartver 3.52.7-1
 %define pypartedver 2.5-2
 %define pythonblivetver 1:3.9.0-1
 %define rpmver 4.15.0
@@ -481,6 +481,53 @@ rm -rf \
 %{_prefix}/libexec/anaconda/dd_*
 
 %changelog
+* Wed Jan 29 2025 Jiri Konecny <jkonecny@redhat.com> - 40.22.3.21-1
+- Disable keyboard shortcut switching on gnome-kiosk (jkonecny)
+  Related: RHEL-71880
+  Resolves: RHEL-74504
+- Improve name of compositor layout selection method (jkonecny)
+  Related: RHEL-71880
+  Resolves: RHEL-74504
+- Split LocaledWrapper code for compositor (jkonecny)
+  Related: RHEL-71880
+  Resolves: RHEL-74504
+- security: do not crash initramfs ks parsing on failing certificate dump
+  (rvykydal)
+  Resolves: RHEL-61434
+- security: require pykickstart version with %%certificates support (rvykydal)
+  Resolves: RHEL-61434
+- security: add service to transfer certificates from initramfs (rvykydal)
+  Resolves: RHEL-61434
+- security: import certificates in initramfs (rvykydal)
+  Resolves: RHEL-61434
+- security: install certificates in pre-install phase only for dnf payload
+  (rvykydal)
+  Resolves: RHEL-61434
+- security: raise exception if certificate destination is unknown (rvykydal)
+  Resolves: RHEL-61434
+- security: log a warning when dumping certificate over an existing file
+  (rvykydal)
+  Resolves: RHEL-61434
+- security: pre-install certificates before payload installation (rvykydal)
+  Resolves: RHEL-61434
+- security: add API to install certificates early before payload (rvykydal)
+  Resolves: RHEL-61434
+- security: install certificates on target system (rvykydal)
+  Resolves: RHEL-61434
+- security: Add API for installation on target system (rvykydal)
+  Resolves: RHEL-61434
+- security: import certificates early after Anaconda start (rvykydal)
+  Resolves: RHEL-61434
+- security: add API to import certificates to Anaconda environment (rvykydal)
+  Related: RHEL-61434
+- security: add API: Certificate getter (rvykydal)
+  Resolves: RHEL-61434
+- kickstart: extend section specification for list of section data (rvykydal)
+  Resolves: RHEL-61434
+- security: implement the support to install certificates to Anaconda
+  (k.koukiou)
+  Resolves: RHEL-61434
+
 * Tue Jan 14 2025 Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.20-1
 - Avoid side effect of ask rdp methods (jkonecny)
   Related: RHEL-69940
diff --git a/sources b/sources
index 6e8fe29..a4d2150 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (anaconda-40.22.3.20.tar.bz2) = f82b9f4d33d66d28a077448688093688893afcff818eb268b44d993f21915c41d0683f52deb390c03d6d9ea238c1ef45f8dc6a9b595f0af483789d9d4d680140
+SHA512 (anaconda-40.22.3.21.tar.bz2) = 6bf169fbc5c873b254fe5df5883be3c17c6e7df2e671c7d29e0ebf6aca01ed591818f38ec04feb311e42501b293f7acfda4b32137e5ac1795b04c629f7614357