diff --git a/crypto-policies.spec b/crypto-policies.spec
index f1f6c78..0de276e 100644
--- a/crypto-policies.spec
+++ b/crypto-policies.spec
@@ -1,5 +1,5 @@
-%global git_date 20230731
-%global git_commit 94f0e2c4f7ebf2b1513b405d11227bae79ffe070
+%global git_date 20230920
+%global git_commit 8dcf74d6d64184aabebcd93d0520ede6f9382da1
 %{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
 
 %global _python_bytecompile_extra 0
@@ -238,6 +238,10 @@ end
 %{_mandir}/man8/fips-finish-install.8*
 
 %changelog
+* Wed Sep 20 2023 Alexander Sosedkin <asosedkin@redhat.com> - 20230920-1.git8dcf74d
+- OSPP subpolicy: tighten beyond reason for OSPP 4.3
+- fips-mode-setup: more thorough --disable, still unsupported
+
 * Mon Jul 31 2023 Alexander Sosedkin <asosedkin@redhat.com> - 20230731-1.git94f0e2c
 - krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
 - FIPS: enforce EMS in FIPS mode
diff --git a/sources b/sources
index 2a0ddf7..1435507 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (crypto-policies-git94f0e2c.tar.gz) = 3284b38772740db388f65717cb74c844de62b49e334f998dc3b118f1f24e06d9fdde81289e4a083c5c8bec321278acbe7acb78b2e97aad3ed25daa751e0b8be0
+SHA512 (crypto-policies-git8dcf74d.tar.gz) = dde440c60451167655e63cc8f8f6d964ce4a3250b64c1d8634f2be19719a0da6e77a322bd55a71b8d09b72d1052bf80933ecc5511485f7595a15ea1fdd248163