diff --git a/.gitignore b/.gitignore
index 8772936..f3e57d3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -122,3 +122,5 @@
 /freeipa-4.9.10.tar.gz.asc
 /freeipa-4.10.0.tar.gz
 /freeipa-4.10.0.tar.gz.asc
+/freeipa-4.10.1.tar.gz
+/freeipa-4.10.1.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index 798477f..05ef65b 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -72,20 +72,25 @@
 %global python_netaddr_version 0.7.19
 # Require 4.14.5-11 which brings CVE-2020-25717 fixes
 %global samba_version 4.14.5-11
-%global selinux_policy_version 3.14.3-52
 %global slapi_nis_version 0.56.4
 %global python_ldap_version 3.1.0-1
 %if 0%{?rhel} < 9
 # Bug 1929067 - PKI instance creation failed with new 389-ds-base build
 %global ds_version 1.4.3.16-12
+%global selinux_policy_version 3.14.3-107
 %else
 %global ds_version 2.0.3-3
+# TBD update selinux_policy_version when BZ#2114902 is fixed
+%global selinux_policy_version 3.14.3-52
 %endif
 
 # Fix for TLS 1.3 PHA, RHBZ#1775158
 %global httpd_version 2.4.37-21
 %global bind_version 9.11.20-6
 
+# Fix for https://github.com/SSSD/sssd/issues/6331
+%global sssd_version 2.8.0
+
 %else
 # Fedora
 %global package_name freeipa
@@ -96,7 +101,12 @@
 %global samba_version 2:4.15.7
 
 # 3.14.5-45 or later includes a number of interfaces fixes for IPA interface
+# 36.16-1 fixes BZ#2115691
+%if 0%{?fedora} < 36
 %global selinux_policy_version 3.14.5-45
+%else
+%global selinux_policy_version 36.16-1
+%endif
 %global slapi_nis_version 0.56.5
 
 %global krb5_kdb_version 8.0
@@ -109,11 +119,26 @@
 # Fix for TLS 1.3 PHA, RHBZ#1775146
 %global httpd_version 2.4.41-9
 
-%global bind_version 9.16.29-1
+# Fix for RHBZ#2117342
+%if 0%{?fedora} < 37
+%global bind_version 9.16.33-1
+%else
+%global bind_version 32:9.18.8-1
+%endif
+
 # Don't use Fedora's Python dependency generator on Fedora 30/rawhide yet.
 # Some packages don't provide new dist aliases.
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/
 %{?python_disable_dependency_generator}
+
+%if 0%{?fedora} < 37
+# F35+, adds IdP integration
+%global sssd_version 2.7.4
+%else
+# Fix for https://github.com/SSSD/sssd/issues/6331
+%global sssd_version 2.8.1
+%endif
+
 # Fedora
 %endif
 
@@ -175,7 +200,7 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.10.0
+%define IPA_VERSION 4.10.1
 # Release candidate version -- uncomment with one percent for RC versions
 #%%global rc_version %%nil
 %define AT_SIGN @
@@ -188,7 +213,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        6%{?rc_version:.%rc_version}%{?dist}
+Release:        1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPLv3+
@@ -205,12 +230,6 @@ Source1:        https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_vers
 # product-name.png
 # RHEL spec file only: END: Change branding to IPA and Identity Management
 
-Patch0001:      0001-Only-calculate-LDAP-password-grace-when-the-password.patch
-Patch0002:      0002-Disabling-gracelimit-does-not-prevent-LDAP-binds.patch
-Patch0003:      0003-webui-Allow-grace-login-limit.patch
-Patch0004:      0004-DNSResolver-Fix-use-of-nameservers-with-ports.patch
-Patch0005:      0005_Set_passwordgracelimit_to_match_global_policy_on_group_pw_policies_#6419.patch
-
 # RHEL spec file only: START
 %if %{NON_DEVELOPER_BUILD}
 %if 0%{?rhel} >= 8
@@ -1717,11 +1736,14 @@ fi
 %if %{with selinux}
 %files selinux
 %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 # with selinux
 %endif
 
 %changelog
+* Sun Nov 27 2022 Alexander Bokovoy <abokovoy@redhat.com> - 4.10.1-1
+- Upstream release FreeIPA 4.10.1
+
 * Wed Sep 14 2022 Alexander Bokovoy <abokovoy@redhat.com> - 4.10.0-6
 - Rebuild against final samba 4.17.0 release
 
diff --git a/sources b/sources
index 74575ae..f0bf56b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.10.0.tar.gz) = e2e2e07263a5ae35149a7f320f41efa51c36d07d050c19c047350f764d8d2ba67c01f0d317c18e54d8d7ee0c750d15d14c5d49eafea650d94d6b833ff8aa6edc
-SHA512 (freeipa-4.10.0.tar.gz.asc) = e53de8b9dd9d4c84aab6b7c604142389a53c42f42774a912c58d46bc84fa0556bf565434d786395a5730d9d1c15fb01739b305aeba163559ae7edbe827b73112
+SHA512 (freeipa-4.10.1.tar.gz) = b06ff7d18aaf6345132eebba1cfe1b9653f71ba07e12f708a52253327961ff03eddd19b79bfdbee9d44f20f04d410fe860f2fd916e66c79fc6366ceb3f8ec5f2
+SHA512 (freeipa-4.10.1.tar.gz.asc) = cc1e795a5e953b9bdd5e68ccbd7a46da0ab9bf236b96e1a6eae41e3100ebc46cdd93414cbad89bc35c3bf87b518b9bad74b8e4858f42f12b37c5734e1edb5efc