diff --git a/dogtag-pki.spec b/dogtag-pki.spec
index ab842c8..ccd5501 100644
--- a/dogtag-pki.spec
+++ b/dogtag-pki.spec
@@ -14,7 +14,7 @@ Name:             dogtag-pki
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
 # - GA/update (supported): <n> where n >= 1
-%global           release_number 4
+%global           release_number 5
 
 # Development phase:
 # - development (unsupported): alpha<n> where n >= 1
@@ -220,7 +220,7 @@ BuildRequires:    javapackages-tools
 %if %{without runtime_deps}
 BuildRequires:    xmlstarlet
 %endif
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 BuildRequires:     tomcat-lib >= 1:10.1.36
 BuildRequires:     tomcat-jakartaee-migration
 %else
@@ -261,8 +261,7 @@ BuildRequires:    mvn(org.jboss.resteasy:resteasy-jackson2-provider)
 BuildRequires:    mvn(org.jboss.resteasy:resteasy-servlet-initializer)
 %endif
 
-%if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 11
-
+%if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 10
 BuildRequires:    mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
 BuildRequires:    mvn(org.apache.tomcat:tomcat-servlet-api) >= 10.1.36
 BuildRequires:    mvn(org.apache.tomcat:tomcat-jaspic-api) >= 10.1.36
@@ -697,7 +696,7 @@ Requires:         mvn(org.jboss.resteasy:resteasy-servlet-initializer)
 Provides:         bundled(resteasy-servlet-initializer) = 3.0.26
 %endif
 
-%if 0%{?rhel} && 0%{?rhel} >= 11
+%if 0%{?rhel} && 0%{?rhel} >= 10
 Requires:         tomcat >= 1:10.1.36
 %else
 Requires:         tomcat9 >= 1:9.0.62
@@ -1114,7 +1113,7 @@ popd
 
 %endif
 
-%if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 11
+%if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 10
 #migrate the source first because we are starting with tomcat 9 code, so we can build against either tomcat 9 or 10.1, based on the build platform
 /usr/bin/javax2jakarta -profile=EE -exclude=./base/tomcat-9.0 ./base ./base 
 %endif
@@ -1197,7 +1196,7 @@ then
     
     #migrate necessary files being copied around to jakarta 9.0 ee, for >= f43 and rhel10
 
-    %if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 11
+    %if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 10
     echo "Doing the tomcat 10 version..."
 
     /usr/bin/javax2jakarta  -profile=EE  jboss-jaxrs-api_2.0_spec-$JAXRS_VERSION.jar  jboss-jaxrs-api_2.0_spec-$JAXRS_VERSION.jar 
@@ -1246,7 +1245,7 @@ then
     cp /usr/share/java/resteasy/resteasy-servlet-initializer.jar \
         resteasy-servlet-initializer-$RESTEASY_VERSION.jar
 
-    %if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 11
+    %if 0%{?fedora} && 0%{?fedora} >= 44 || 0%{?rhel} && 0%{?rhel} >= 10
     /usr/bin/javax2jakarta  -profile=EE resteasy-servlet-initializer-$RESTEASY_VERSION.jar resteasy-servlet-initializer-$RESTEASY_VERSION.jar
     %endif
 
@@ -1263,7 +1262,7 @@ fi
 
 %if ! %{with server}
 %pom_disable_module tomcat base
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 %pom_disable_module tomcat-10.1 base
 %else
 %pom_disable_module tomcat-9.0 base
@@ -1316,7 +1315,7 @@ fi
 %mvn_file org.dogtagpki.pki:pki-server            pki/pki-server
 %mvn_file org.dogtagpki.pki:pki-server-webapp     pki/pki-server-webapp
 %mvn_file org.dogtagpki.pki:pki-tomcat            pki/pki-tomcat
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 %mvn_file org.dogtagpki.pki:pki-tomcat-10.1       pki/pki-tomcat-10.1
 %else
 %mvn_file org.dogtagpki.pki:pki-tomcat-9.0        pki/pki-tomcat-9.0
@@ -1341,7 +1340,7 @@ fi
 %mvn_package org.dogtagpki.pki:pki-server-webapp  pki-server
 %mvn_package org.dogtagpki.pki:pki-tomcat         pki-server
 
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 %mvn_package org.dogtagpki.pki:pki-tomcat-10.1    pki-server
 %else
 %mvn_package org.dogtagpki.pki:pki-tomcat-9.0     pki-server
@@ -1372,7 +1371,7 @@ export JAVA_HOME=%{java_home}
 %if %{with maven}
 # build Java binaries and run unit tests with Maven
 
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 %pom_disable_module tomcat-9.0 base
 %pom_remove_dep :pki-tomcat-9.0 base/server
 %else
@@ -1394,7 +1393,7 @@ ln -sf ../../base/tools/target/pki-tools.jar
 %if %{with server}
 ln -sf ../../base/tomcat/target/pki-tomcat.jar
 
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 ln -sf ../../base/tomcat-10.1/target/pki-tomcat-10.1.jar
 %else
 ln -sf ../../base/tomcat-9.0/target/pki-tomcat-9.0.jar
@@ -1460,13 +1459,6 @@ pkgs=base\
 %{?with_tests:,tests}\
 %{?with_debug:,debug}
 
-
-## Force use of tomcat 9.
-
-sed -i 's/^APP_SERVER=.*/APP_SERVER=tomcat-9.0/g' build.sh
-
-
-
 # build PKI console, Javadoc, and native binaries with CMake
 ./build.sh \
     %{?_verbose:-v} \
@@ -1987,7 +1979,7 @@ fi
 %{_datadir}/java/pki/pki-server.jar
 %{_datadir}/java/pki/pki-server-webapp.jar
 %{_datadir}/java/pki/pki-tomcat.jar
-%if 0%{?fedora} >= 44 || 0%{?rhel} >= 11
+%if 0%{?fedora} >= 44 || 0%{?rhel} >= 10
 %{_datadir}/java/pki/pki-tomcat-10.1.jar
 %else
 %{_datadir}/java/pki/pki-tomcat-9.0.jar
@@ -2179,9 +2171,13 @@ fi
 
 ################################################################################
 %changelog
-* Tue Jul 21 2026 Eduard Abdullin <eabdullin@almalinux.org> - 11.9.0-4.alma.1
+* Tue Aug 04 2026 Eduard Abdullin <eabdullin@almalinux.org> - 11.9.0-5.alma.1
 - Fix build.sh to recognize AlmaLinux as RHEL-compatible
 
+* Wed Jul 29 2026 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.9.0-5
+- Upgrade to tomcat 10
+- Resolves: RHEL-210971
+
 * Thu Jul 16 2026 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.9.0-4
 - Update jackson bundled to 2.21.4 
 - Resolves: RHEL-188290