diff --git a/.gitignore b/.gitignore
index 7ebd50a..6764791 100644
--- a/.gitignore
+++ b/.gitignore
@@ -205,3 +205,4 @@
 /cockpit-241.tar.xz
 /cockpit-242.tar.xz
 /cockpit-243.tar.xz
+/cockpit-244.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 2345f0f..75f9d56 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        243
+Version:        244
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -85,7 +85,7 @@ Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{v
 %if 0%{?rhel} >= 9 || 0%{?fedora}
 %define selinuxtype targeted
 %define with_selinux 1
-%define selinux_policy_version %(rpm --quiet -q selinux-policy && rpm -q --queryformat "%{V}" selinux-policy || echo 1)
+%define selinux_policy_version %(rpm --quiet -q selinux-policy && rpm -q --queryformat "%{V}-%{R}" selinux-policy || echo 1)
 %endif
 
 BuildRequires: gcc
@@ -208,8 +208,10 @@ install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 
 %if 0%{?with_selinux}
     install -D -m 644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-    install -D -m 644 -t %{buildroot}%{_mandir}/man8 selinux/%{name}_session_selinux.8
-    install -D -m 644 -t %{buildroot}%{_mandir}/man8 selinux/%{name}_ws_selinux.8
+    install -D -m 644 -t %{buildroot}%{_mandir}/man8 selinux/%{name}_session_selinux.8cockpit
+    install -D -m 644 -t %{buildroot}%{_mandir}/man8 selinux/%{name}_ws_selinux.8cockpit
+    # create this directory in the build root so that %ghost sees the desired mode
+    install -d -m 700 %{buildroot}%{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
 %endif
 
 # only ship deprecated PatternFly API for stable releases
@@ -270,6 +272,7 @@ echo '%dir %{_datadir}/cockpit/playground' > tests.list
 find %{buildroot}%{_datadir}/cockpit/playground -type f >> tests.list
 
 echo '%dir %{_datadir}/cockpit/static' > static.list
+echo '%dir %{_datadir}/cockpit/static/fonts' >> static.list
 find %{buildroot}%{_datadir}/cockpit/static -type f >> static.list
 
 # when not building basic packages, remove their files
@@ -314,8 +317,6 @@ sed -i "s|%{buildroot}||" *.list
 pushd %{buildroot}/%{_datadir}/cockpit/branding
 find -L * -type l -printf "%H\n" | sort -u | xargs rm -rv
 popd
-# need this in SUSE as post build checks dislike stale symlinks
-install -m 644 -D /dev/null %{buildroot}/run/cockpit/motd
 %else
 %global _debugsource_packages 1
 %global _debuginfo_subpackages 0
@@ -413,10 +414,9 @@ Provides: cockpit-shell = %{version}-%{release}
 Provides: cockpit-systemd = %{version}-%{release}
 Provides: cockpit-tuned = %{version}-%{release}
 Provides: cockpit-users = %{version}-%{release}
-Obsoletes: cockpit-dashboard
+Obsoletes: cockpit-dashboard < %{version}-%{release}
 %if 0%{?rhel}
 Provides: cockpit-networkmanager = %{version}-%{release}
-Obsoletes: cockpit-networkmanager
 Requires: NetworkManager >= 1.6
 Provides: cockpit-kdump = %{version}-%{release}
 Requires: kexec-tools
@@ -450,8 +450,10 @@ Summary: Cockpit Web Service
 Requires: glib-networking
 Requires: openssl
 Requires: glib2 >= 2.50.0
+%if 0%{?with_selinux}
 Requires: (selinux-policy >= %{selinux_policy_version} if selinux-policy-%{selinuxtype})
 Requires(post): (policycoreutils if selinux-policy-%{selinuxtype})
+%endif
 Conflicts: firewalld < 0.6.0-1
 Recommends: sscg >= 2.3
 Recommends: system-logos
@@ -474,10 +476,9 @@ authentication via sssd/FreeIPA.
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
 %config(noreplace) %{_sysconfdir}/pam.d/cockpit
-%config %{_sysconfdir}/issue.d/cockpit.issue
-%config %{_sysconfdir}/motd.d/cockpit
-%ghost /run/cockpit/motd
-%ghost %dir /run/cockpit
+# created in %post, so that users can rm the files
+%ghost %{_sysconfdir}/issue.d/cockpit.issue
+%ghost %{_sysconfdir}/motd.d/cockpit
 %dir %{_datadir}/cockpit/motd
 %{_datadir}/cockpit/motd/update-motd
 %{_datadir}/cockpit/motd/inactive.motd
@@ -508,8 +509,8 @@ authentication via sssd/FreeIPA.
 
 %if 0%{?with_selinux}
     %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-    %{_mandir}/man8/%{name}_session_selinux.8.*
-    %{_mandir}/man8/%{name}_ws_selinux.8.*
+    %{_mandir}/man8/%{name}_session_selinux.8cockpit.*
+    %{_mandir}/man8/%{name}_ws_selinux.8cockpit.*
     %ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
 %endif
 
@@ -533,6 +534,13 @@ if %{_sbindir}/selinuxenabled 2>/dev/null; then
 fi
 %endif
 
+# set up dynamic motd/issue symlinks on first-time install; don't bring them back on upgrades if admin removed them
+if [ "$1" = 1 ]; then
+    mkdir -p /etc/motd.d /etc/issue.d
+    ln -s /run/cockpit/motd /etc/motd.d/cockpit
+    ln -s /run/cockpit/motd /etc/issue.d/cockpit.issue
+fi
+
 %tmpfiles_create cockpit-tempfiles.conf
 %systemd_post cockpit.socket cockpit.service
 # firewalld only partially picks up changes to its services files without this
@@ -702,6 +710,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Wed May 12 2021 Katerina Koukiou <kkoukiou@redhat.com> - 244-1
+
+- Shell: sudo is invoked only when explicitly requested
+
 * Wed Apr 28 2021 Martin Pitt <mpitt@redhat.com> - 243-1
 
 - Services: Show sockets and memory usage
diff --git a/plans/upstream.fmf b/plans/upstream.fmf
index 7f459e6..373c96f 100644
--- a/plans/upstream.fmf
+++ b/plans/upstream.fmf
@@ -2,6 +2,6 @@ discover:
   how: fmf
   repository: https://github.com/cockpit-project/cockpit
   # FIXME: get rid of the hardcoding: https://github.com/psss/tmt/issues/585
-  ref: "243"
+  ref: "244"
 execute:
   how: tmt
diff --git a/sources b/sources
index 3d34c40..8df1d92 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-243.tar.xz) = 9b80d1258d8dfb72b63d6d35081937b6e42ef82bd5d8d46c2c9095afc1b938f434c87e9fbd17bad0f3a3fbffef614226cc4e30bd7d95f6b7fedecfbb76483a48
+SHA512 (cockpit-244.tar.xz) = 41a566484e9f85825f69d3fe23c56d92f91e79d782674e5b63bd7cafa7fae096b21d594054cb95b34e12ae986a6e5a3a18dc98a0a5a04321375aa203882106cd