diff --git a/.gitignore b/.gitignore
index 007a84b..0adf8b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -219,3 +219,4 @@
 /cockpit-254.tar.xz
 /cockpit-255.tar.xz
 /cockpit-257.tar.xz
+/cockpit-258.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 742680e..f8a87c5 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        257
+Version:        258
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -289,7 +289,7 @@ done
 for lib in systemd tmpfiles.d; do
     rm -r %{buildroot}/%{_prefix}/%{__lib}/$lib
 done
-for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
+for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-client cockpit-client.ui cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
     rm %{buildroot}/%{_libexecdir}/$libexec
 done
 rm -r %{buildroot}/%{_libdir}/security %{buildroot}/%{_sysconfdir}/pam.d %{buildroot}/%{_sysconfdir}/motd.d %{buildroot}/%{_sysconfdir}/issue.d
@@ -433,7 +433,6 @@ Requires: sos
 Recommends: (reportd if abrt)
 %endif
 # NPM modules which are also available as packages
-Provides: bundled(js-jquery) = 3.5.1
 Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
@@ -455,6 +454,11 @@ Conflicts: firewalld < 0.6.0-1
 Recommends: sscg >= 2.3
 Recommends: system-logos
 Suggests: sssd-dbus
+# for cockpit-desktop
+Suggests: python3
+
+# prevent hard python3 dependency for cockpit-desktop, it falls back to other browsers
+%global __requires_exclude_from ^%{_libexecdir}/cockpit-client$
 
 %description ws
 The Cockpit Web Service listens on the network, and authenticates users.
@@ -495,6 +499,8 @@ authentication via sssd/FreeIPA.
 %{_libexecdir}/cockpit-ws
 %{_libexecdir}/cockpit-wsinstance-factory
 %{_libexecdir}/cockpit-tls
+%{_libexecdir}/cockpit-client
+%{_libexecdir}/cockpit-client.ui
 %{_libexecdir}/cockpit-desktop
 %{_libexecdir}/cockpit-certificate-ensure
 %{_libexecdir}/cockpit-certificate-helper
@@ -522,7 +528,7 @@ fi
 
 %post ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -553,7 +559,7 @@ fi
 
 %postun ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_uninstall -s %{selinuxtype} %{name}
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -714,6 +720,11 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Wed Nov 24 2021 Allison Karlitskaya <allison.karlitskaya@redhat.com> - 258-1
+- Tweak login screen UI
+- Use official VDO LVM API
+- Add cockpit-client, to be bundled as a flatpak
+
 * Wed Nov 10 2021 Katerina Koukiou <kkoukiou@redhat.com> - 257-1
 - Support for reading TLS certificates with any permissions
 - cockpit-ws no longer supports merged certificates
diff --git a/plans/upstream.fmf b/plans/upstream.fmf
index bbfc602..603c19d 100644
--- a/plans/upstream.fmf
+++ b/plans/upstream.fmf
@@ -2,6 +2,6 @@ discover:
   how: fmf
   repository: https://github.com/cockpit-project/cockpit
   # FIXME: get rid of the hardcoding: https://github.com/psss/tmt/issues/585
-  ref: "257"
+  ref: "258"
 execute:
   how: tmt
diff --git a/sources b/sources
index 2aa921e..1bc5023 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-257.tar.xz) = 9484e19207e11b9c069d727f445f41969f6bc7abcfa111a90a18693533f43339374c4954a043f345ac09da6f00db061101dfe256bb84b8c8610cc5be6814140f
+SHA512 (cockpit-258.tar.xz) = b340e7b66b102d587ce6451ef9764cbaf89039acf1113d019a666fce01cf78896d7f9da7fcaae54a5006daf7cb3750cd1ad873810e021dbfeaf2bcced316d069