diff --git a/.gitignore b/.gitignore
index a8387d2..f74efcd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -214,3 +214,4 @@
 /cockpit-249.tar.xz
 /cockpit-250.tar.xz
 /cockpit-251.tar.xz
+/cockpit-254.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 8895173..da8e11f 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        251
+Version:        254
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -215,12 +215,14 @@ install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 %endif
 
 # only ship deprecated PatternFly API for stable releases
-%if 0%{?fedora} <= 33 || 0%{?rhel} <= 8
+%if 0%{?rhel} <= 8
     ln -s cockpit.css.gz %{buildroot}/%{_datadir}/cockpit/base1/patternfly.css.gz
 %endif
 
 # Build the package lists for resource packages
-echo '%dir %{_datadir}/cockpit/base1' > base.list
+# cockpit-bridge is the basic dependency for all cockpit-* packages, so centrally own the page directory
+echo '%dir %{_datadir}/cockpit' > base.list
+echo '%dir %{_datadir}/cockpit/base1' >> base.list
 echo '%dir %{_datadir}/cockpit/base1/fonts' >> base.list
 find %{buildroot}%{_datadir}/cockpit/base1 -type f -o -type l >> base.list
 echo '%{_sysconfdir}/cockpit/machines.d' >> base.list
@@ -291,7 +293,7 @@ for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-ws
     rm %{buildroot}/%{_libexecdir}/$libexec
 done
 rm -r %{buildroot}/%{_libdir}/security %{buildroot}/%{_sysconfdir}/pam.d %{buildroot}/%{_sysconfdir}/motd.d %{buildroot}/%{_sysconfdir}/issue.d
-rm %{buildroot}/usr/bin/cockpit-bridge %{buildroot}/usr/sbin/remotectl
+rm %{buildroot}/usr/bin/cockpit-bridge
 rm -f %{buildroot}%{_libexecdir}/cockpit-ssh
 rm -f %{buildroot}%{_datadir}/metainfo/cockpit.appdata.xml
 %endif
@@ -356,7 +358,6 @@ troubleshooting, interactive command-line sessions, and more.
 %{_docdir}/cockpit/AUTHORS
 %{_docdir}/cockpit/COPYING
 %{_docdir}/cockpit/README.md
-%dir %{_datadir}/cockpit
 %{_datadir}/metainfo/cockpit.appdata.xml
 %{_datadir}/pixmaps/cockpit.png
 %doc %{_mandir}/man1/cockpit.1.gz
@@ -428,14 +429,11 @@ Provides: cockpit-selinux = %{version}-%{release}
 Provides: cockpit-sosreport = %{version}-%{release}
 Requires: sos
 %endif
-%if 0%{?fedora} >= 29
-# 0.7.0 (actually) supports task cancellation.
-# 0.7.1 fixes tasks never announcing completion.
-Recommends: (reportd >= 0.7.1 if abrt)
+%if 0%{?fedora}
+Recommends: (reportd if abrt)
 %endif
 # NPM modules which are also available as packages
 Provides: bundled(js-jquery) = 3.5.1
-Provides: bundled(xstatic-bootstrap-datepicker-common) = 1.9.0
 Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
@@ -469,7 +467,6 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man5/cockpit.conf.5.gz
 %doc %{_mandir}/man8/cockpit-ws.8.gz
 %doc %{_mandir}/man8/cockpit-tls.8.gz
-%doc %{_mandir}/man8/remotectl.8.gz
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
@@ -493,7 +490,6 @@ authentication via sssd/FreeIPA.
 %{_unitdir}/cockpit-wsinstance-https@.service
 %{_unitdir}/system-cockpithttps.slice
 %{_prefix}/%{__lib}/tmpfiles.d/cockpit-tempfiles.conf
-%{_sbindir}/remotectl
 %{pamdir}/pam_ssh_add.so
 %{pamdir}/pam_cockpit_cert.so
 %{_libexecdir}/cockpit-ws
@@ -718,6 +714,12 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Thu Sep 30 2021 Matej Marusak <mmarusak@redhat.com> - 254-1
+- Overview: Move last login to Health Card
+- Webserver: Restrict frame embedding to same origin
+- Login: Add Arch Linux branding
+- Users: Add login history
+
 * Mon Aug 23 2021 Matej Marusak <mmarusak@redhat.com> - 251-1
 - Logs: Fix layout in Asian languages (rhbz#1989888)
 
diff --git a/plans/upstream.fmf b/plans/upstream.fmf
index c9c25f2..76b01aa 100644
--- a/plans/upstream.fmf
+++ b/plans/upstream.fmf
@@ -2,7 +2,6 @@ discover:
   how: fmf
   repository: https://github.com/cockpit-project/cockpit
   # FIXME: get rid of the hardcoding: https://github.com/psss/tmt/issues/585
-  # HACK: Use https://github.com/cockpit-project/cockpit/pull/16252
-  ref: "53e99fe3bd7305f357f53a942d3f7bed3758782f"
+  ref: "254"
 execute:
   how: tmt
diff --git a/sources b/sources
index 2c8c0b4..57df689 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-251.tar.xz) = 9ded4b394520b11a3c711ad7c808fb7f216a5015b935077ddd8bd4c34951bd536696a3353d90e1b2819e284fe3001ed25ab8e6e03262eb3eaa1e30393db1a136
+SHA512 (cockpit-254.tar.xz) = f8c8c5986f03a05ae08db1c2341068f22593fdb2d96bef0afefc8316c0887ef26d41a08e7fc49832a3051545dfcad027f089c9efb4e5d7c40d1c73fd24e91bbf