diff --git a/.gitignore b/.gitignore
index ec054c2..679def2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -326,3 +326,6 @@
 /cockpit-348.tar.xz
 /cockpit-349.tar.xz
 /cockpit-350.tar.xz
+/cockpit-351.tar.xz
+/cockpit-353.1.tar.xz
+/cockpit-node-353.1.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 6727215..c16d39b 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -51,15 +51,21 @@
 %define pamdir %{_libdir}/security
 %endif
 
+# distributions which ship nodejs-esbuild can rebuild the bundle during package build
+%if 0%{?fedora} >= 42
+%define rebuild_bundle 1
+%endif
+
 Name:           cockpit
 Summary:        Web Console for Linux servers
 
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/
 
-Version:        350
+Version:        353.1
 Release:        1%{?dist}
 Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
+Source1:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-node-%{version}.tar.xz
 
 %if 0%{?fedora} >= 41 || 0%{?rhel}
 ExcludeArch: %{ix86}
@@ -107,6 +113,11 @@ BuildRequires: docbook-style-xsl
 BuildRequires: krb5-server
 BuildRequires: gdb
 
+%if %{defined rebuild_bundle}
+BuildRequires: nodejs
+BuildRequires: nodejs-esbuild
+%endif
+
 # For documentation
 BuildRequires: xmlto
 
@@ -149,8 +160,20 @@ BuildRequires:  python3-pytest-timeout
 
 %prep
 %setup -q -n cockpit-%{version}
+%if %{defined rebuild_bundle}
+%setup -q -D -T -a 1 -n cockpit-%{version}
+%endif
 
 %build
+%if %{defined rebuild_bundle}
+rm -rf dist
+# HACK: node module packaging is currently broken in Fedora, should be in
+# common location, not major version specific one
+NODE_ENV=production NODE_PATH=$(echo /usr/lib/node_modules_*) ./build.js
+%else
+# Use pre-built bundle on distributions without nodejs-esbuild
+%endif
+
 %configure \
     %{?selinux_configure_arg} \
 %if 0%{?suse_version}
@@ -342,27 +365,17 @@ Provides: bundled(npm(@patternfly/react-table)) = 6.4.0
 Provides: bundled(npm(@patternfly/react-tokens)) = 6.4.0
 Provides: bundled(npm(@xterm/addon-canvas)) = 0.7.0
 Provides: bundled(npm(@xterm/xterm)) = 5.5.0
-Provides: bundled(npm(argparse)) = 1.0.10
-Provides: bundled(npm(attr-accept)) = 2.2.5
-Provides: bundled(npm(autolinker)) = 3.16.2
 Provides: bundled(npm(dequal)) = 2.0.3
-Provides: bundled(npm(file-selector)) = 2.1.2
 Provides: bundled(npm(focus-trap)) = 7.6.4
-Provides: bundled(npm(ipaddr.js)) = 2.2.0
-Provides: bundled(npm(js-tokens)) = 4.0.0
+Provides: bundled(npm(ipaddr.js)) = 2.3.0
 Provides: bundled(npm(json-stable-stringify-without-jsonify)) = 1.0.1
 Provides: bundled(npm(lodash)) = 4.17.21
-Provides: bundled(npm(loose-envify)) = 1.4.0
-Provides: bundled(npm(object-assign)) = 4.1.1
 Provides: bundled(npm(prop-types)) = 15.8.1
-Provides: bundled(npm(react-dom)) = 18.3.1
-Provides: bundled(npm(react-dropzone)) = 14.3.8
-Provides: bundled(npm(react-is)) = 16.13.1
 Provides: bundled(npm(react)) = 18.3.1
+Provides: bundled(npm(react-dom)) = 18.3.1
 Provides: bundled(npm(remarkable)) = 2.0.1
 Provides: bundled(npm(scheduler)) = 0.23.2
-Provides: bundled(npm(sprintf-js)) = 1.0.3
-Provides: bundled(npm(tabbable)) = 6.2.0
+Provides: bundled(npm(tabbable)) = 6.3.0
 Provides: bundled(npm(throttle-debounce)) = 5.0.2
 Provides: bundled(npm(tslib)) = 2.8.1
 Provides: bundled(npm(uuid)) = 13.0.0
@@ -504,7 +517,7 @@ SELinux policy module for the cockpit-ws package.
 %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
 %{_mandir}/man8/%{name}_session_selinux.8cockpit.*
 %{_mandir}/man8/%{name}_ws_selinux.8cockpit.*
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%ghost %{_selinux_store_path}/%{selinuxtype}/active/modules/200/%{name}
 
 %pre ws-selinux
 %selinux_relabel_pre -s %{selinuxtype}
@@ -650,6 +663,13 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Mon Dec 15 2025 Jelle van der Waa <jelle@vdwaa.nl> - 353.1-1
+- Release workflow fixes
+
+
+* Wed Nov 12 2025 Packit <hello@packit.dev> - 351-1
+- Firewall ports can be deleted individually
+
 * Wed Oct 29 2025 Packit <hello@packit.dev> - 350-1
 - networking: fix renaming of bridges and other groups (RHEL-117883)
 - bridge: fix OpenSSH_10.2p1 host key detection
diff --git a/packit.yaml b/packit.yaml
index 3cfd52f..d7891a0 100644
--- a/packit.yaml
+++ b/packit.yaml
@@ -1,24 +1,30 @@
 upstream_project_url: https://github.com/cockpit-project/cockpit
 specfile_path: cockpit.spec
 actions:
+  # create-archive does not work with multiple sources, so do the spec mangling ourselves
   post-upstream-clone:
-    # build patched spec
-    - tools/node-modules make_package_lock_json
-    - cp tools/cockpit.spec .
-    # packit will compute and set the version by itself
-    - tools/fix-spec ./cockpit.spec 0
+    # we already build a spec file with correct Version, so extract it
+    - |
+      bash -exc '
+      mapfile -t TARBALLS < <(tools/make-dist)
+      # Extract spec file from main tarball (first in array)
+      tar -xJf "${TARBALLS[0]}" --wildcards "*/tools/cockpit.spec" --strip-components=2
+      # Move all tarballs to current directory for packit
+      mv "${TARBALLS[@]}" .
+      '
 
-  create-archive:
-    - tools/make-dist
+  fix-spec-file:
+    # packit needs local file names, not URLs
+    - sed -i 's|^\(Source[0-9]*:\s*\).*\/|\1|' cockpit.spec
 
 srpm_build_deps:
   - automake
   - gcc
   - gettext
   - glib2-devel
+  - jq
   - make
   - nodejs
-  - npm
   - systemd-devel
 
 # use the nicely formatted release NEWS from our upstream release, instead of git shortlog
@@ -87,11 +93,11 @@ jobs:
         - cp tools/cockpit.spec .
         # packit will compute and set the version by itself
         - tools/fix-spec ./cockpit.spec 0
-      # HACK: tarball for releases (copr_build, koji, etc.), copying spec's Source0; this
+      # HACK: tarball for releases (copr_build, koji, etc.), copying spec's Source0 and Source1; this
       # really should be the default, see https://github.com/packit/packit-service/issues/1505
-      create-archive:
-        - sh -exc "curl -L -O https://github.com/cockpit-project/cockpit/releases/download/${PACKIT_PROJECT_VERSION}/${PACKIT_PROJECT_NAME_VERSION}.tar.xz"
-        - sh -exc "ls ${PACKIT_PROJECT_NAME_VERSION}.tar.xz"
+      fix-spec-file:
+        - 'sh -exc "curl -L --fail -O https://github.com/cockpit-project/cockpit/releases/download/${PACKIT_PROJECT_VERSION}/${PACKIT_PROJECT_NAME_VERSION}.tar.xz"'
+        - 'sh -exc "curl -L --fail -O https://github.com/cockpit-project/cockpit/releases/download/${PACKIT_PROJECT_VERSION}/cockpit-node-${PACKIT_PROJECT_VERSION}.tar.xz"'
 
   - job: propose_downstream
     trigger: release
diff --git a/sources b/sources
index b3b88e1..4a147d8 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (cockpit-350.tar.xz) = 2148a6c2a2f9283ae613bd7ae19e3858b57e43d491f8089f0813e01439c3d4a15e14e73645fe5ac41cf50e290a87f53ea7e7500e53f657a523b51c71483981f2
+SHA512 (cockpit-353.1.tar.xz) = 2d8a9c8303c7b8557ffecaba70094e328d212a472807c3cc7f9a0995ca0348f9f124061c6be59c4bbe42dd60d8a6636fb61590404b54331097479690dd7cd065
+SHA512 (cockpit-node-353.1.tar.xz) = 8ccdc3f12cac6cf865e9501c816b4587d82cd14da76e8ab8de2bd96c1bad4dbe30f3d1a0eed6c01e304ade903c5fccb7f703f67e6f96b0bfb695956f9d2ce4e6