diff --git a/.gitignore b/.gitignore
index 5796ba9..796e484 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,4 @@
 /ansible-freeipa-1.8.2.tar.gz
 /ansible-freeipa-1.8.3.tar.gz
 /ansible-freeipa-1.8.4.tar.gz
+/ansible-freeipa-1.9.0.tar.gz
diff --git a/ansible-freeipa.spec b/ansible-freeipa.spec
index b807023..77507b3 100644
--- a/ansible-freeipa.spec
+++ b/ansible-freeipa.spec
@@ -7,7 +7,7 @@
 
 Summary: Roles and playbooks to deploy FreeIPA servers, replicas and clients
 Name: ansible-freeipa
-Version: 1.8.4
+Version: 1.9.0
 Release: 1%{?dist}
 URL: https://github.com/freeipa/ansible-freeipa
 License: GPLv3+
@@ -52,6 +52,7 @@ Features
 - Modules for hostgroup management
 - Modules for idrange management
 - Modules for location management
+- Modules for netgroup management
 - Modules for permission management
 - Modules for privilege management
 - Modules for pwpolicy management
@@ -88,8 +89,6 @@ Requirements
 
   Controller
   - Ansible version: 2.8+ (ansible-freeipa is an Ansible Collection)
-  - /usr/bin/kinit is required on the controller if a one time password (OTP)
-    is used
 
   Node
   - Supported FreeIPA version (see above)
@@ -121,13 +120,13 @@ to get the needed requrements to run the tests.
 # Fix python modules and module utils:
 # - Remove shebang
 # - Remove execute flag
-for i in roles/ipa*/library/*.py roles/ipa*/module_utils/*.py plugins/*/*.py; do
+for i in roles/ipa*/library/*.py roles/ipa*/module_utils/*.py plugins/*/*.py;
+do
     sed -i '1{/\/usr\/bin\/python*/d;}' $i
     chmod a-x $i
 done
 
-for i in utils/*.py utils/ansible-ipa-*-install utils/new_module \
-         utils/changelog utils/ansible-doc-test;
+for i in utils/*.py utils/new_module utils/changelog utils/ansible-doc-test;
 do
     sed -i '{s@/usr/bin/python*@%{python}@}' $i
 done
@@ -180,6 +179,29 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
 %{_datadir}/ansible-freeipa/requirements-tests.txt
 
 %changelog
+* Wed Dec  7 2022 Thomas Woerner <twoerner@redhat.com> - 1.9.0-1
+- Update to version 1.9.0
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.0
+  Related: RHBZ#2125592
+- pwpolicy: Add support for password check and grace limit
+  Resolves: RHBZ#2127911
+- ipaconfig: Do not allow enable_sid set to False
+  Resolves: RHBZ#2127446
+- ipaclient: No kinit on controller for deployment using OTP
+  Resolves: RHBZ#2127887
+- ipaclient: Configure DNS resolver
+  Resolves: RHBZ#2127895
+- New netgroup management module
+  Resolves: RHBZ#2127910
+- sudorule: Add support for 'hostmask' parameter
+  Resolves: RHBZ#2127913
+- ipaconfig: Fix fail_json calls
+  Resolves: RHBZ#2134375
+- ipaconfig: Do not require enable_sid for add_sids or netbios_name
+  Resolves: RHBZ#2134505
+- ipaserver: Add missing idstart check
+  Resolves: RHBZ#2132731
+
 * Mon Sep 12 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.4-1
 - Update to version 1.8.4
   https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.4
diff --git a/sources b/sources
index 65efb86..d75677a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (ansible-freeipa-1.8.4.tar.gz) = f36253a75a24e50b3774a5e8c7edeb41bf4903cce33253aecadaa1bdde6d0faede085e953343919b28bb32d0503c7549950df08a9f0f95d69680a7a59f8a9353
+SHA512 (ansible-freeipa-1.9.0.tar.gz) = 0f8e503f75f2c30c41b3380a0b0ca81d4d26eae47b8b6dfef317830868630c8deeb4b493293594ddd29a03845fc476fe87046eb370f2477e29260dde1b0ea1e5