diff --git a/.gitignore b/.gitignore
index 2678961..0f8a87b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -288,3 +288,4 @@
 /cockpit-314.tar.xz
 /cockpit-315.tar.xz
 /cockpit-316.tar.xz
+/cockpit-317.tar.xz
diff --git a/README.packit b/README.packit
index bee8d88..2fa216c 100644
--- a/README.packit
+++ b/README.packit
@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.95.0.
+The file was generated using packit 0.97.1.post1.dev4+g1268842e.
diff --git a/cockpit.spec b/cockpit.spec
index 176ccce..133e04c 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -49,7 +49,7 @@ Summary:        Web Console for Linux servers
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/
 
-Version:        316
+Version:        317
 Release:        1%{?dist}
 Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
 
@@ -154,8 +154,6 @@ BuildRequires:  python3-tox-current-env
 %build
 %configure \
     %{?selinux_configure_arg} \
-    --with-cockpit-user=cockpit-ws \
-    --with-cockpit-ws-instance-user=cockpit-wsinstance \
 %if 0%{?suse_version}
     --docdir=%_defaultdocdir/%{name} \
 %endif
@@ -330,11 +328,11 @@ Provides: cockpit-users = %{version}-%{release}
 Obsoletes: cockpit-dashboard < %{version}-%{release}
 %if 0%{?rhel}
 Requires: NetworkManager >= 1.6
-Requires: /usr/bin/kdumpctl
 Requires: sos
 Requires: sudo
 Recommends: PackageKit
 Recommends: setroubleshoot-server >= 3.3.3
+Recommends: /usr/bin/kdumpctl
 Suggests: NetworkManager-team
 Provides: cockpit-kdump = %{version}-%{release}
 Provides: cockpit-networkmanager = %{version}-%{release}
@@ -345,12 +343,12 @@ Provides: cockpit-sosreport = %{version}-%{release}
 Recommends: (reportd if abrt)
 %endif
 
-Provides: bundled(npm(@patternfly/patternfly)) = 5.3.0
-Provides: bundled(npm(@patternfly/react-core)) = 5.3.0
-Provides: bundled(npm(@patternfly/react-icons)) = 5.3.0
-Provides: bundled(npm(@patternfly/react-styles)) = 5.3.0
-Provides: bundled(npm(@patternfly/react-table)) = 5.3.0
-Provides: bundled(npm(@patternfly/react-tokens)) = 5.3.0
+Provides: bundled(npm(@patternfly/patternfly)) = 5.3.1
+Provides: bundled(npm(@patternfly/react-core)) = 5.3.3
+Provides: bundled(npm(@patternfly/react-icons)) = 5.3.2
+Provides: bundled(npm(@patternfly/react-styles)) = 5.3.1
+Provides: bundled(npm(@patternfly/react-table)) = 5.3.3
+Provides: bundled(npm(@patternfly/react-tokens)) = 5.3.1
 Provides: bundled(npm(argparse)) = 1.0.10
 Provides: bundled(npm(array-buffer-byte-length)) = 1.0.1
 Provides: bundled(npm(attr-accept)) = 2.2.2
@@ -407,13 +405,13 @@ Provides: bundled(npm(object-keys)) = 1.1.1
 Provides: bundled(npm(object.assign)) = 4.1.5
 Provides: bundled(npm(possible-typed-array-names)) = 1.0.0
 Provides: bundled(npm(prop-types)) = 15.8.1
-Provides: bundled(npm(react-dom)) = 18.2.0
+Provides: bundled(npm(react-dom)) = 18.3.1
 Provides: bundled(npm(react-dropzone)) = 14.2.3
 Provides: bundled(npm(react-is)) = 16.13.1
-Provides: bundled(npm(react)) = 18.2.0
+Provides: bundled(npm(react)) = 18.3.1
 Provides: bundled(npm(regexp.prototype.flags)) = 1.5.2
 Provides: bundled(npm(remarkable)) = 2.0.1
-Provides: bundled(npm(scheduler)) = 0.23.0
+Provides: bundled(npm(scheduler)) = 0.23.2
 Provides: bundled(npm(set-function-length)) = 1.2.2
 Provides: bundled(npm(set-function-name)) = 2.0.2
 Provides: bundled(npm(side-channel)) = 1.0.6
@@ -477,6 +475,7 @@ authentication via sssd/FreeIPA.
 %{_unitdir}/cockpit.service
 %{_unitdir}/cockpit-motd.service
 %{_unitdir}/cockpit.socket
+%{_unitdir}/cockpit-ws-user.service
 %{_unitdir}/cockpit-wsinstance-http.socket
 %{_unitdir}/cockpit-wsinstance-http.service
 %{_unitdir}/cockpit-wsinstance-https-factory.socket
@@ -484,7 +483,8 @@ authentication via sssd/FreeIPA.
 %{_unitdir}/cockpit-wsinstance-https@.socket
 %{_unitdir}/cockpit-wsinstance-https@.service
 %{_unitdir}/system-cockpithttps.slice
-%{_prefix}/%{__lib}/tmpfiles.d/cockpit-tempfiles.conf
+%{_prefix}/%{__lib}/tmpfiles.d/cockpit-ws.conf
+%{_sysusersdir}/cockpit-wsinstance.conf
 %{pamdir}/pam_ssh_add.so
 %{pamdir}/pam_cockpit_cert.so
 %{_libexecdir}/cockpit-ws
@@ -503,8 +503,8 @@ authentication via sssd/FreeIPA.
 %ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
 
 %pre ws
-getent group cockpit-ws >/dev/null || groupadd -r cockpit-ws
-getent passwd cockpit-ws >/dev/null || useradd -r -g cockpit-ws -d /nonexisting -s /sbin/nologin -c "User for cockpit web service" cockpit-ws
+# HACK: old RPM and even Fedora's current RPM don't properly support sysusers
+# https://github.com/rpm-software-management/rpm/issues/3073
 getent group cockpit-wsinstance >/dev/null || groupadd -r cockpit-wsinstance
 getent passwd cockpit-wsinstance >/dev/null || useradd -r -g cockpit-wsinstance -d /nonexisting -s /sbin/nologin -c "User for cockpit-ws instances" cockpit-wsinstance
 
@@ -529,7 +529,7 @@ if [ "$1" = 1 ]; then
     chmod 644 /etc/cockpit/disallowed-users
 fi
 
-%tmpfiles_create cockpit-tempfiles.conf
+%tmpfiles_create cockpit-ws.conf
 %systemd_post cockpit.socket cockpit.service
 # firewalld only partially picks up changes to its services files without this
 test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
@@ -697,6 +697,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Wed May 29 2024 Packit <hello@packit.dev> - 317-1
+- webserver: System user changes
+- metrics: Prefer valkey over redis on Fedora
+
 * Thu Apr 25 2024 Packit <hello@packit.dev> - 316-1
 - cockpit.js API: Fix format_bytes() units
 
diff --git a/gating.yaml b/gating.yaml
index 5a2cf7d..1b4592c 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -7,8 +7,8 @@ rules:
 
 --- !Policy
 product_versions:
-  - rhel-8
   - rhel-9
+  - rhel-10
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
diff --git a/packit.yaml b/packit.yaml
index fa5260c..9043d51 100644
--- a/packit.yaml
+++ b/packit.yaml
@@ -33,6 +33,7 @@ jobs:
       - fedora-development
       - centos-stream-9-x86_64
       - centos-stream-9-aarch64
+      - centos-stream-10
 
   # current Fedora runs reverse dependency testing against https://copr.fedorainfracloud.org/coprs/g/cockpit/main-builds/
   - job: tests
diff --git a/plans/all.fmf b/plans/all.fmf
index a4b2091..e8f82ab 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -8,17 +8,17 @@ execute:
 environment:
     TEST_AUDIT_NO_SELINUX: 1
 
-/basic:
-    summary: Run tests for basic packages
+/main:
+    summary: Non-storage tests
     discover+:
-        test: /test/browser/basic
+        test: /test/browser/main
 
-/network:
-    summary: Run tests for cockpit-networkmanager
+/storage-basic:
+    summary: Basic storage tests
     discover+:
-        test: /test/browser/network
+        test: /test/browser/storage-basic
 
-/optional:
-    summary: Run tests for optional packages
+/storage-extra:
+    summary: More expensive storage tests (LVM, LUKS, Anaconda)
     discover+:
-        test: /test/browser/optional
+        test: /test/browser/storage-extra
diff --git a/sources b/sources
index b9ff63a..e5dce79 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-316.tar.xz) = d7d04ac85a654f365abbeb386f819afe06d1e46374cf984101084ccfe3c1f6e21a61b6b60c51d11f0e066667f4c51f70d3e4364eb887969a8beba66081add353
+SHA512 (cockpit-317.tar.xz) = 55dfa449fd77dcd71d5f27cfd72235daa50c1a3c2d19cac5bc43b933322b4ba353b35f5acfc9f119c1d03a20dbbb80736b9feaca12ae95accbd46e067bb0c558