diff --git a/freeipa.spec b/freeipa.spec
index a739c39..93412d7 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -231,7 +231,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        20%{?rc_version:.%rc_version}%{?dist}
+Release:        21%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
@@ -349,9 +349,9 @@ Patch0091:      0091-ipa-client-install-Fix-nsupdate-issues-when-dns_over.patch
 Patch0092:      0092-ipatests-fix-test_adtrust_install_with_non_ipa_user.patch
 Patch0093:      0093-ipa-idrange-fix-check-that-IPA-server-is-installed.patch
 Patch0094:      0094-ipa-migrate-only-remove-repl-state-attribute-options.patch
-Patch0095:      0095-ipa-kdb-support-storing-multiple-KVNO-for-the-same-p.patch
-Patch0096:      0096-Use-ipaplatform-tasks-for-krb5-enctypes.patch
-Patch0097:      0097-Add-test-for-master-key-upgrade.patch
+# Patch0095:      0095-ipa-kdb-support-storing-multiple-KVNO-for-the-same-p.patch
+# Patch0096:      0096-Use-ipaplatform-tasks-for-krb5-enctypes.patch
+# Patch0097:      0097-Add-test-for-master-key-upgrade.patch
 Patch0098:      0098-ipa-client-install-New-no-dnssec-validation-option.patch
 Patch0099:      0099-ipaserver-install-dns.py-Allow-to-Turn-off-DNSSEC-va.patch
 Patch0100:      0100-ipatests-Tests-for-32BitIdranges.patch
@@ -2015,6 +2015,9 @@ fi
 %endif
 
 %changelog
+* Mon Aug 18 2025 Rafael Jeffman <rjeffman@redhat.com> - 4.12.2-21
+- Resolves: RHEL-109768 Revert allow update of Kerberos master key
+
 * Wed Jul 30 2025 Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-20
 - Resolves: RHEL-106285 Incorrect use of external IdP GitHub trademark
 - Resolves: RHEL-106026 Include fixes in python3-ipatests package
@@ -2433,7 +2436,7 @@ temporarily revert a commit that depends on newer version of python-jwcrypto
   - ipatests: refactor test_ipa_cert_fix with tasks
   - ipatests: use whole date for journalctl --since
 * Tue Aug 17 2021 Florence Blanc-Renaud <frenaud@redhat.com> - 4.9.6-5
-- Resolves: rhbz#1988383 Do SRV discovery in ipa-getkeytab if -s and -H aren't provided 
+- Resolves: rhbz#1988383 Do SRV discovery in ipa-getkeytab if -s and -H aren't provided
   - ipa-getkeytab: add option to discover servers using DNS SRV
   - ipa-getkeytab: fix compiler warnings
   - ipatests: test ipa-getkeytab server option
@@ -2488,8 +2491,8 @@ temporarily revert a commit that depends on newer version of python-jwcrypto
 - Resolves: rhbz#1975139 Upgrade error: Add failure missing required attribute "objectclass"
 - Resolves: rhbz#1973024 CA_less ipa-server-install fails if CA cert subject contains non ascii chars
 - Resolves: rhbz#1966101 [RFE] - IDM - Allow specifying permanent logging settings for BIND
-- Resolves: rhbz#1962570 IPA in c9s should not require redhat-logos-ipa as a runtime package 
-- Resolves: rhbz#1957736 [RFE] IPA to allow configuring auto-private-groups at idrange level 
+- Resolves: rhbz#1962570 IPA in c9s should not require redhat-logos-ipa as a runtime package
+- Resolves: rhbz#1957736 [RFE] IPA to allow configuring auto-private-groups at idrange level
 
 * Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.9.3-2.1
 - Rebuilt for RHEL 9 BETA for openssl 3.0
@@ -2705,7 +2708,7 @@ temporarily revert a commit that depends on newer version of python-jwcrypto
 
 * Sat Apr 06 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.7.2-8
 - Fixed: rhbz#1696963 (Failed to install replica)
-  
+
 * Sat Apr 06 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.7.2-7
 - Support Samba 4.10
 - Support 389-ds 1.4.1.2-2.fc30 or later