diff --git a/.cockpit.metadata b/.cockpit.metadata
index 565fa3a..f72a870 100644
--- a/.cockpit.metadata
+++ b/.cockpit.metadata
@@ -1 +1 @@
-7a2ebdbe91f84ae42ade76ab0a155fbd20000acc SOURCES/cockpit-257.tar.xz
+91f1f6be0b02466a8e784667e6f161e5e130844d SOURCES/cockpit-258.tar.xz
diff --git a/.gitignore b/.gitignore
index 9a44353..bf9f959 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/cockpit-257.tar.xz
+SOURCES/cockpit-258.tar.xz
diff --git a/SPECS/cockpit.spec b/SPECS/cockpit.spec
index cfcdca6..c1fdef3 100644
--- a/SPECS/cockpit.spec
+++ b/SPECS/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        257
+Version:        258
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -289,7 +289,7 @@ done
 for lib in systemd tmpfiles.d; do
     rm -r %{buildroot}/%{_prefix}/%{__lib}/$lib
 done
-for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
+for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-client cockpit-client.ui cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
     rm %{buildroot}/%{_libexecdir}/$libexec
 done
 rm -r %{buildroot}/%{_libdir}/security %{buildroot}/%{_sysconfdir}/pam.d %{buildroot}/%{_sysconfdir}/motd.d %{buildroot}/%{_sysconfdir}/issue.d
@@ -433,7 +433,6 @@ Requires: sos
 Recommends: (reportd if abrt)
 %endif
 # NPM modules which are also available as packages
-Provides: bundled(js-jquery) = 3.5.1
 Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
@@ -455,6 +454,11 @@ Conflicts: firewalld < 0.6.0-1
 Recommends: sscg >= 2.3
 Recommends: system-logos
 Suggests: sssd-dbus
+# for cockpit-desktop
+Suggests: python3
+
+# prevent hard python3 dependency for cockpit-desktop, it falls back to other browsers
+%global __requires_exclude_from ^%{_libexecdir}/cockpit-client$
 
 %description ws
 The Cockpit Web Service listens on the network, and authenticates users.
@@ -495,6 +499,8 @@ authentication via sssd/FreeIPA.
 %{_libexecdir}/cockpit-ws
 %{_libexecdir}/cockpit-wsinstance-factory
 %{_libexecdir}/cockpit-tls
+%{_libexecdir}/cockpit-client
+%{_libexecdir}/cockpit-client.ui
 %{_libexecdir}/cockpit-desktop
 %{_libexecdir}/cockpit-certificate-ensure
 %{_libexecdir}/cockpit-certificate-helper
@@ -522,7 +528,7 @@ fi
 
 %post ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -553,7 +559,7 @@ fi
 
 %postun ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_uninstall -s %{selinuxtype} %{name}
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -714,6 +720,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Thu Nov 25 2021 Martin Pitt <mpitt@redhat.com> - 258-1
+- Tweak login screen UI
+- Fix SELinux policy installation
+
 * Wed Nov 10 2021 Katerina Koukiou <kkoukiou@redhat.com> - 257-1
 - Support for reading TLS certificates with any permissions
 - cockpit-ws no longer supports merged certificates