diff --git a/build_frontend.sh b/build_frontend.sh
old mode 100755
new mode 100644
diff --git a/create_bundles.sh b/create_bundles.sh
old mode 100755
new mode 100644
diff --git a/create_bundles_in_container.sh b/create_bundles_in_container.sh
old mode 100755
new mode 100644
diff --git a/grafana.spec b/grafana.spec
index eb2b8fc..af60005 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -19,13 +19,14 @@
 end}
 
 %global gomodulesmode GO111MODULE=auto
-%global gotestflags   %{gotestflags} -tags=integration
+%global _gotestflags_save %{?gotestflags}
+%global gotestflags %{?_gotestflags_save} -tags=integration
 
 %global selinux_variants mls targeted
 
 Name:             grafana
 Version:          10.2.6
-Release:          20%{?dist}
+Release:          21%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPL-3.0-only
 URL:              https://grafana.org
@@ -1016,6 +1017,10 @@ done
 %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
 
 %changelog
+* Wed Dec 3 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-21
+- Resolves RHEL-125631: CVE-2025-58183
+- Resolves RHEL-132760: Grafana-selinux prevents plugins from searching cgroups
+
 * Wed Jun 18 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-20
 - Resolves RHEL-97520: Rework grafana-selinux spec file sections
 - Resolves RHEL-92648: Add additional SELinux rules for grafana-selinux package to allow LDAP connections
diff --git a/grafana.te b/grafana.te
index 41f0cb3..a536e21 100644
--- a/grafana.te
+++ b/grafana.te
@@ -108,6 +108,16 @@ allow grafana_t self:unix_stream_socket connectto;
 
 allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
 
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
 optional_policy(`
 	require {
 		type smtp_port_t;
diff --git a/list_bundled_nodejs_packages.py b/list_bundled_nodejs_packages.py
old mode 100755
new mode 100644