diff --git a/cockpit.spec b/cockpit.spec
index 8fc65e7..842dad8 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -49,7 +49,7 @@ Summary:        Web Console for Linux servers
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/
 
-Version:        310.8
+Version:        310.9
 Release:        1%{?dist}
 Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
 Source1:        cockpit.css.gz
@@ -786,6 +786,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Tue Aug 04 2026 Jelle van der Waa <jvanderwaa@redhat.com> - 310.9-1
+- sosreport: Provide encryption pass via an env variable (RHEL-219123)
+- selinux: give cockpit_session_t Kerberos access (RHEL-185926)
+
 * Wed May 20 2026 Tomas Matus <tmatus@redhat.com> - 310.8-1
 - ws: fix uninitialized read in tls-sniffing code
 - ws: tighten up branding path construction
diff --git a/plans/all.fmf b/plans/all.fmf
index c3d76bd..df6c572 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -1,7 +1,7 @@
 discover:
     how: fmf
     url: https://github.com/cockpit-project/cockpit
-    ref: "310.8"
+    ref: "310.9"
 execute:
     how: tmt
 
diff --git a/sources b/sources
index cb77fab..8af1fd1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (cockpit-310.8.tar.xz) = 708ca16860a525be1cdf14f15b9e415cbcf639d32a152d6cf716c5e501afe64f8d74e5380258d422621accbe771ae578f33f5b9e6ddd6fa1575a2e9a783bc895
+SHA512 (cockpit-310.9.tar.xz) = 912055ab8f95164bc7ac332e718fd67db60a2d48684c46567e1de2f9f75f4e211a0ce1f8c4b74158d629b2d05fad3974450e9b1233169639eb763b20634b5db9
 SHA512 (cockpit.css.gz) = 1851e890e49141c17e498f1472c3bc307439cefaa0f1dccecbfc87b04087af03ca42199c86116c1fcf8890b58ca98f8aecfb01cc8b3c03a76e2685f7bd610568