diff --git a/SOURCES/grafana.te b/SOURCES/grafana.te
index 162bb4a..a536e21 100644
--- a/SOURCES/grafana.te
+++ b/SOURCES/grafana.te
@@ -27,13 +27,6 @@ gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
 ## </desc>
 gen_tunable(grafana_can_tcp_connect_mysql_port, false)
 
-## <desc>
-## <p>
-## Allow grafana to connect to postgresql's default tcp port of 5432
-## </p>
-## </desc>
-gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
-
 ## <desc>
 ## <p>
 ## Allow grafana to connect to prometheus' default tcp port of 9090
@@ -41,6 +34,19 @@ gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
 ## </desc>
 gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
 
+## <desc>            
+## <p>
+## Allow grafana to connect to postgresql's default tcp port of 5432            
+## </p>            
+## </desc>            
+gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
+
+## <desc>            
+## <p>
+## Allow grafana to connect to ldap's tcp port           
+## </p>            
+## </desc>  
+gen_tunable(grafana_can_tcp_connect_ldap_port, false)
 
 type grafana_t;
 type grafana_exec_t;
@@ -102,6 +108,16 @@ allow grafana_t self:unix_stream_socket connectto;
 
 allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
 
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
 optional_policy(`
 	require {
 		type smtp_port_t;
@@ -110,6 +126,14 @@ optional_policy(`
 	allow grafana_t smtp_port_t:tcp_socket name_connect;
 ')
 
+optional_policy(`
+	require {
+		type ntop_port_t;
+		class tcp_socket { name_bind };
+	}
+	allow grafana_t ntop_port_t:tcp_socket name_bind;
+')
+
 optional_policy(`
 	require {
 		type usr_t;
@@ -145,6 +169,14 @@ optional_policy(`
 	allow grafana_t autofs_t:dir getattr;
 ')
 
+optional_policy(`
+	require {
+		type postfix_local_t;
+		class dir { search };
+	}
+	allow postfix_local_t grafana_var_lib_t:dir search;
+')
+
 manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
 manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
 
@@ -216,6 +248,10 @@ tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default
 	corenet_tcp_connect_postgresql_port(grafana_t)
 ')
 
+tunable_policy(`grafana_can_tcp_connect_ldap_port',`
+	corenet_tcp_connect_ldap_port(grafana_t)
+')
+
 optional_policy(`
     systemd_private_tmp(grafana_tmp_t)
 ')
diff --git a/SPECS/grafana.spec b/SPECS/grafana.spec
index 5af0f1e..7f319b6 100644
--- a/SPECS/grafana.spec
+++ b/SPECS/grafana.spec
@@ -19,13 +19,14 @@
 end}
 
 %global gomodulesmode GO111MODULE=auto
-%global gotestflags   %{gotestflags} -tags=integration
+%global _gotestflags_save %{?gotestflags}
+%global gotestflags %{?_gotestflags_save} -tags=integration
 
 %global selinux_variants mls targeted
 
 Name:             grafana
 Version:          10.2.6
-Release:          15%{?dist}
+Release:          17%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPL-3.0-only
 URL:              https://grafana.org
@@ -121,7 +122,7 @@ Requires:         shared-mime-info
 %if 0%{?fedora} >= 35 || 0%{?rhel} >= 8
 # This ensures that the grafana-selinux package and all its dependencies are
 # not pulled into containers and other systems that do not use SELinux
-Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-targeted)
+Requires: (grafana-selinux = %{version}-%{release} if selinux-policy-any)
 %else
 Requires: grafana-selinux = %{version}-%{release}
 %endif
@@ -743,15 +744,11 @@ Graphite, InfluxDB & OpenTSDB.
 
 # SELinux package
 %package selinux
-Summary:        SELinux policy module supporting grafana
-BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted
-%if "%{_selinux_policy_version}" != ""
-Requires:       selinux-policy >= %{_selinux_policy_version}
-%endif
-Requires:       %{name} = %{version}-%{release}
-Requires:	selinux-policy-targeted
-Requires(post):   /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana
-Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana
+Summary:             SELinux policy module supporting grafana
+Requires:	           selinux-policy-any
+Requires(post):      selinux-policy-any, /usr/sbin/semanage
+Requires(postun):    /usr/sbin/semanage
+BuildRequires:       selinux-policy-devel
 
 %description selinux
 SELinux policy module supporting grafana
@@ -766,10 +763,6 @@ rm -r plugins-bundled
 %setup -q -T -D -b 2
 %endif
 
-# SELinux policy
-mkdir SELinux
-cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
-
 %patch -P 1 -p1
 %patch -P 2 -p1
 %patch -P 3 -p1
@@ -813,15 +806,11 @@ for cmd in grafana grafana-cli grafana-server; do
 done
 
 # SELinux policy
-cd SELinux
-for selinuxvariant in %{selinux_variants}
-do
-  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
-  mv grafana.pp grafana.pp.${selinuxvariant}
-  make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
-done
-cd -
+mkdir selinux
+cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} selinux
 
+make -f %{_datadir}/selinux/devel/Makefile grafana.pp
+bzip2 -9 grafana.pp
 
 %install
 # dirs, shared files, public html, webpack
@@ -886,14 +875,12 @@ echo "d %{_rundir}/%{name} 0755 %{GRAFANA_USER} %{GRAFANA_GROUP} -" \
 install -p -m 644 -D %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf
 
 # SELinux policy
-cd SELinux
 for selinuxvariant in %{selinux_variants}
 do
-  install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
-  install -p -m 644 grafana.pp.${selinuxvariant} \
-    %{buildroot}%{_datadir}/selinux/${selinuxvariant}/grafana.pp
+  install -D -m 0644 grafana.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2
+  install -D -p -m 0644 selinux/grafana.if \
+    %{buildroot}%{_datadir}/selinux/devel/include/distributed/grafana.if
 done
-cd -
 
 %pre
 %sysusers_create_compat %{SOURCE3}
@@ -999,50 +986,54 @@ export TZ=GMT
 %doc README.md ROADMAP.md SECURITY.md SUPPORT.md UPGRADING_DEPENDENCIES.md WORKFLOW.md
 
 # SELinux policy
+%pre selinux
+%selinux_relabel_pre
+
 %post selinux
 for selinuxvariant in %{selinux_variants}
 do
-  /usr/sbin/semodule -s ${selinuxvariant} -i \
-    %{_datadir}/selinux/${selinuxvariant}/grafana.pp &> /dev/null || :
+  %selinux_modules_install -s ${selinuxvariant} %{_datadir}/selinux/packages/${selinuxvariant}/grafana.pp.bz2 &>/dev/null
+  /usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
+  semodule -X400 -r grafana &>/dev/null || true
 done
-/sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
-/sbin/restorecon -RvF /etc/grafana &> /dev/null || :
-/sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
-/sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
-/sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
-/usr/sbin/semanage port -a -t grafana_port_t -p tcp 3000 &> /dev/null || :
+%selinux_relabel_post
 
-%postun selinux
-if [ $1 -eq 0 ] ; then
-/usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
-  for selinuxvariant in %{selinux_variants}
-  do
-    /usr/sbin/semodule -s ${selinuxvariant} -r grafana &> /dev/null || :
-  done
-  /sbin/restorecon -RvF /usr/sbin/grafana* &> /dev/null || :
-  /sbin/restorecon -RvF /etc/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /var/log/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /var/lib/grafana &> /dev/null || :
-  /sbin/restorecon -RvF /usr/libexec/grafana-pcp &> /dev/null || :
+if [ "$1" -le "1" ]; then # First install
+   # The daemon needs to be restarted for the custom label to be applied.
+   # This will fail in case "post selinux" is executed before the service file is installed,
+   # but then it is safe to ignore since the service will first start with the proper label
+   %systemd_postun_with_restart grafana.service &> /dev/null || :
 fi
 
+%postun selinux
+for selinuxvariant in %{selinux_variants}
+do
+  if [ $1 -eq 0 ]; then
+    /usr/sbin/semanage port -d -p tcp 3000 &> /dev/null || :
+    %selinux_modules_uninstall -s ${selinuxvariant} grafana
+    %selinux_relabel_post -s ${selinuxvariant}
+  fi
+done
+
 %files selinux
-%defattr(-,root,root,0755)
-%doc SELinux/*
-%{_datadir}/selinux/*/grafana.pp
+%{_datadir}/selinux/packages/*/grafana.pp.*
+%{_datadir}/selinux/devel/include/distributed/grafana.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
 
 %changelog
-* Tue Jul 22 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-15
-- Resolves RHEL-101998: Grafana SELinux policy prevents loading plugins
+* Wed Dec 3 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-17
+- Resolves RHEL-125692: CVE-2025-58183
+- Resolves RHEL-120426: Grafana-selinux prevents plugins from searching cgroups
 
-* Tue May 13 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-14
-- Resolves RHEL-89309: CVE-2025-22871
+* Wed Jun 18 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-15
+- Resolves RHEL-97518: Rework grafana-selinux spec file sections
+- Resolves RHEL-87861: Add additional SELinux rules for grafana-selinux package to allow LDAP connections
 
 * Tue May 13 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-13
-- Resolves RHEL-89954: CVE-2025-4123
+- Resolves RHEL-89953: CVE-2025-4123
 
 * Tue Apr 29 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-12
-- Resolves RHEL-88922: Move home directory of grafana to /var/lib/grafana
+- Resolves RHEL-85419: Move grafana home directory to /var/lib/grafana
 
 * Tue Mar 25 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-11
 - Resolves RHEL-84636: CVE-2025-30204