diff --git a/freeipa.spec b/freeipa.spec
index 7a25e4e..6ecadd6 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -234,7 +234,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        2%{?rc_version:.%rc_version}%{?dist}
+Release:        3%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
@@ -1251,6 +1251,9 @@ mkdir -p %{buildroot}%{_sysconfdir}/cron.d
 %if ! %{ONLY_CLIENT}
 
 %post server
+# Drop the systemd users file BEFORE restarting dbus and oddjob
+# Otherwise dbus doesn't recognize ipaapi user
+%sysusers_create %{_sysusersdir}/ipa.conf
 # NOTE: systemd specific section
     /bin/systemctl --system daemon-reload 2>&1 || :
 # END
@@ -1260,7 +1263,6 @@ fi
 /bin/systemctl reload-or-try-restart dbus
 /bin/systemctl reload-or-try-restart oddjobd
 
-%sysusers_create %{_sysusersdir}/ipa.conf
 %tmpfiles_create ipa.conf
 %journal_catalog_update
 
@@ -1982,13 +1984,16 @@ fi
 %endif
 
 %changelog
+* Wed Feb 11 2026 Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
+- Resolves:  RHEL-4895 ipa use systemd-sysusers
+
 * Fri Feb 06 2026 Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
 - Resolves: RHEL-146023 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
--Resolves:  RHEL-145855 Include latest fixes in python3-ipatests package
--Resolves:  RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
--Resolves:  RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system)
--Resolves:  RHEL-4895 ipa use systemd-sysusers
--Resolves:  RHEL-4823 Names of domains from a trusted forest should be compared case-insentive
+- Resolves:  RHEL-145855 Include latest fixes in python3-ipatests package
+- Resolves:  RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
+- Resolves:  RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system)
+- Resolves:  RHEL-4895 ipa use systemd-sysusers
+- Resolves:  RHEL-4823 Names of domains from a trusted forest should be compared case-insentive
 
 * Fri Jan 16 2026 Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
 - Resolves: RHEL-140587 Support replaceable WebUI artwork for RHEL and CentOS