diff --git a/.gitignore b/.gitignore
index 0155221..2ca4f5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,4 @@
 /cockpit-134.tar.xz
 /cockpit-137.tar.xz
 /cockpit-138.tar.xz
+/cockpit-139.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 47dada8..fbfcebf 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:	138
+Version:	139
 Release: 1%{?dist}
 #
 # This file is maintained at the following location:
@@ -138,6 +138,7 @@ make -j4 check
 %install
 make install DESTDIR=%{buildroot}
 make install-tests DESTDIR=%{buildroot}
+make install-integration-tests DESTDIR=%{buildroot}
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
 install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
 rm -f %{buildroot}/%{_libdir}/cockpit/*.so
@@ -356,8 +357,18 @@ Cockpit support for remoting to other servers, bastion hosts, and a basic dashbo
 
 %post dashboard
 # HACK: Until policy changes make it downstream
-# https://bugzilla.redhat.com/show_bug.cgi?id=1381331
+echo "Applying workaround for broken SELinux policy: https://bugzilla.redhat.com/show_bug.cgi?id=1381331" >&2
 test -f %{_bindir}/chcon && chcon -t cockpit_ws_exec_t %{_libexecdir}/cockpit-ssh
+%if 0%{?fedora} > 0 && 0%{?fedora} >= 26
+if type semodule >/dev/null 2>&1; then
+    tmp=$(mktemp -d)
+    echo 'module local 1.0; require { type cockpit_ws_exec_t; type cockpit_ws_t; class file execute_no_trans; } allow cockpit_ws_t cockpit_ws_exec_t:file execute_no_trans;' > "$tmp/local.te"
+    checkmodule -M -m -o "$tmp/local.mod" "$tmp/local.te"
+    semodule_package -o "$tmp/local.pp" -m "$tmp/local.mod"
+    semodule -i "$tmp/local.pp"
+    rm -rf "$tmp"
+fi
+%endif
 %endif
 
 %package storaged
@@ -432,6 +443,30 @@ These files are not required for running Cockpit.
 %{_datadir}/%{name}/playground
 %{_prefix}/lib/cockpit-test-assets
 
+%package integration-tests
+Summary: Integration tests for Cockpit
+Requires: curl
+Requires: expect
+Requires: libvirt
+Requires: libvirt-client
+Requires: libvirt-daemon
+Requires: libvirt-python
+Requires: qemu-kvm
+Requires: npm
+Requires: python
+Requires: rsync
+Requires: xz
+Requires: openssh-clients
+Requires: fontconfig
+
+%description integration-tests
+This package contains Cockpit's integration tests for running in VMs.
+These are not required for running Cockpit.
+
+%files integration-tests
+%{_datadir}/%{name}/test
+%{_datadir}/%{name}/containers
+
 %package ws
 Summary: Cockpit Web Service
 Requires: glib-networking
@@ -564,7 +599,7 @@ utility setroubleshoot to diagnose and resolve SELinux issues.
 Summary: Cockpit user interface for Docker containers
 Requires: %{name}-bridge >= 122
 Requires: %{name}-shell >= 122
-Requires: docker >= 1.3.0
+Requires: /usr/bin/docker
 Requires: python
 
 %description docker
@@ -599,6 +634,14 @@ cluster. Installed on the Kubernetes master. This package is not yet complete.
 
 # The changelog is automatically generated and merged
 %changelog
+* Fri Apr 21 2017 Martin Pitt <<mpitt@redhat.com>> - 139-1
+
+- Show more information about virtual machines, such as boot order
+- Fix enablement of timer systemd units created on Services page
+- Fix Storage crash on multiple iSCSI sessions
+- cockpit-docker is now installable with docker-ce or other alternatives
+- Hide docker push commands on Registry image pages for  "pull" roles
+
 * Mon Apr 10 2017 Stef Walter <<stefw@redhat.com>> - 138-1
 - Only allow mdraid disk removal when it won't destroy data
 - Allow DN style usernames in the Kubernetes dashboard
diff --git a/sources b/sources
index 232be6f..a4f45bf 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-138.tar.xz) = b46ac39a0710e61ab09e7df4eb57c6fef307c7c7ac92a6998fe8dd15c44173b74ec660ce2c5990446d84a15c653c4c1d9e1936f527245147f13afb1e30d0300f
+SHA512 (cockpit-139.tar.xz) = 38bf809d951eafd34442c9042943c55ae1c184476878b9f8b0c2d19f785c01d2f7bcb5812baba58f580bf309cfff3fdd594c27b381e1a2c11c00e31070cc614b