diff --git a/.gitignore b/.gitignore
index ebef4d5..7e26587 100644
--- a/.gitignore
+++ b/.gitignore
@@ -217,3 +217,4 @@
 /cockpit-252.tar.xz
 /cockpit-253.tar.xz
 /cockpit-254.tar.xz
+/cockpit-255.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index a234a8b..1a8c350 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        254
+Version:        255
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -146,7 +146,7 @@ Requires: cockpit-system
 
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
-Recommends: cockpit-packagekit
+Recommends: (cockpit-packagekit if dnf)
 Suggests: cockpit-pcp
 
 %if 0%{?rhel} == 0
@@ -714,6 +714,9 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Wed Oct 13 2021 Martin Pitt <mpitt@redhat.com> - 255-1
+- FreeIPA-issued webserver certificates get auto-renewed
+
 * Wed Sep 29 2021 Matej Marusak <mmarusak@redhat.com> - 254-1
 - Overview: Move last login to Health Card
 - Webserver: Restrict frame embedding to same origin
diff --git a/plans/upstream.fmf b/plans/upstream.fmf
index 76b01aa..e831993 100644
--- a/plans/upstream.fmf
+++ b/plans/upstream.fmf
@@ -2,6 +2,6 @@ discover:
   how: fmf
   repository: https://github.com/cockpit-project/cockpit
   # FIXME: get rid of the hardcoding: https://github.com/psss/tmt/issues/585
-  ref: "254"
+  ref: "255"
 execute:
   how: tmt
diff --git a/sources b/sources
index 57df689..cd477ef 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-254.tar.xz) = f8c8c5986f03a05ae08db1c2341068f22593fdb2d96bef0afefc8316c0887ef26d41a08e7fc49832a3051545dfcad027f089c9efb4e5d7c40d1c73fd24e91bbf
+SHA512 (cockpit-255.tar.xz) = a9863bc4b79a56a54e66fdf4d50cb9dbe37531dfaaffad4f2b1f9858e84ddc2fe618df1a2156ad87d34264428b38faee697009888bc6364f6d0249f14b20382f