diff --git a/.gitignore b/.gitignore
index d9f3ccf..6b37f54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -248,3 +248,4 @@
 /cockpit-279.tar.xz
 /cockpit-280.tar.xz
 /cockpit-280.1.tar.xz
+/cockpit-281.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index c945c87..4248bb5 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -49,7 +49,7 @@ Summary:        Web Console for Linux servers
 License:        LGPLv2+
 URL:            https://cockpit-project.org/
 
-Version:        280.1
+Version:        281
 Release:        1%{?dist}
 Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
 
@@ -74,6 +74,13 @@ Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{v
 %define build_optional 1
 %endif
 
+# Allow root login in Cockpit on RHEL 8 and lower as it also allows password login over SSH.
+%if 0%{?rhel} && 0%{?rhel} <= 8
+%define disallow_root 0
+%else
+%define disallow_root 1
+%endif
+
 # Ship custom SELinux policy (but not for cockpit-appstream)
 %if "%{name}" == "cockpit"
 %define selinuxtype targeted
@@ -481,7 +488,10 @@ if [ "$1" = 1 ]; then
     mkdir -p /etc/motd.d /etc/issue.d
     ln -s ../../run/cockpit/motd /etc/motd.d/cockpit
     ln -s ../../run/cockpit/motd /etc/issue.d/cockpit.issue
-    printf "# List of users which are not allowed to login to Cockpit\nroot\n" > /etc/cockpit/disallowed-users
+    printf "# List of users which are not allowed to login to Cockpit\n" > /etc/cockpit/disallowed-users
+%if 0%{?disallow_root}
+    printf "root\n" >> /etc/cockpit/disallowed-users
+%endif
     chmod 644 /etc/cockpit/disallowed-users
 fi
 
@@ -662,6 +672,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Thu Dec 01 2022 Packit <hello@packit.dev> - 281-1
+- Dark theme switcher
+
+
 * Thu Nov 24 2022 Packit <hello@packit.dev> - 280.1-1
 - Exclude kpatch test on RHEL gating
 
diff --git a/sources b/sources
index 63b2063..023a5fd 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-280.1.tar.xz) = cbfaeb35ef49e390e21c95e743c4f24e8715a6f55fe294e2325bf5768fa371370f250916a21f33e90221ae5fde725ad5f5d6bfac766c2e2a80c57c79e363f421
+SHA512 (cockpit-281.tar.xz) = 1c3a1652465b7b70f6536846ce37911289ef095cc8fc488aa921c1cf779115d5d5bbc38a8640c8b8a17d1363e8cc8f91d6fc9e6a5b124dc8935714d6023b8b32