diff --git a/.gitignore b/.gitignore
index b4a15d7..d10e24e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -106,3 +106,5 @@
 /freeipa-4.9.1.tar.gz.asc
 /freeipa-4.9.2.tar.gz
 /freeipa-4.9.2.tar.gz.asc
+/freeipa-4.9.3.tar.gz
+/freeipa-4.9.3.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index ba6e541..10e0e94 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -49,9 +49,9 @@
 # lint is not executed during rpmbuild
 # %%global with_lint 1
 %if %{with lint}
-    %global linter_options --enable-pylint --with-jslint
+    %global linter_options --enable-pylint --with-jslint --enable-rpmlint
 %else
-    %global linter_options --disable-pylint --without-jslint
+    %global linter_options --disable-pylint --without-jslint --disable-rpmlint
 %endif
 
 # Include SELinux subpackage
@@ -74,13 +74,12 @@
 %global slapi_nis_version 0.56.4
 %global python_ldap_version 3.1.0-1
 %if 0%{?rhel} < 9
-# python3-lib389
-# Fix for "Installation fails: Replica Busy"
-# https://pagure.io/389-ds-base/issue/49818
-%global ds_version 1.4.2.4-6
+# Bug 1929067 - PKI instance creation failed with new 389-ds-base build
+%global ds_version 1.4.3.16-12
 %else
 %global ds_version 2.0.3-3
 %endif
+
 # Fix for TLS 1.3 PHA, RHBZ#1775158
 %global httpd_version 2.4.37-21
 %global bind_version 9.11.20-6
@@ -169,7 +168,7 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.9.2
+%define IPA_VERSION 4.9.3
 # Release candidate version -- uncomment with one percent for RC versions
 #%%global rc_version %%nil
 %define AT_SIGN @
@@ -182,7 +181,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        4%{?rc_version:.%rc_version}%{?dist}
+Release:        1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPLv3+
@@ -640,6 +639,11 @@ Requires: nfs-utils
 Requires: sssd-tools >= %{sssd_version}
 Requires(post): policycoreutils
 
+# https://pagure.io/freeipa/issue/8530
+Recommends: libsss_sudo
+Recommends: sudo
+Requires: (libsss_sudo if sudo)
+
 Provides: %{alt_name}-client = %{version}
 Conflicts: %{alt_name}-client
 Obsoletes: %{alt_name}-client < %{version}
@@ -1673,6 +1677,9 @@ fi
 %endif
 
 %changelog
+* Wed Mar 31 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.9.3-1
+- Upstream release FreeIPA 4.9.3
+
 * Fri Feb 26 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.9.2-4
 - Rebuild against 389-ds and PKI to fix https://github.com/389ds/389-ds-base/issues/4609
 
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..f5915e0
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,3 @@
+---
+specname:
+    match: suffix
diff --git a/sources b/sources
index daf6092..fa4620c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.9.2.tar.gz) = 2e04821c701032ff2f5fc4f318a8473b2f2affa6a017fc0ed766408f344f3dc1fc4faed4b6dbaca8fb460cc6751633aac4034fb4cf18de447027e638f351211d
-SHA512 (freeipa-4.9.2.tar.gz.asc) = 3527ca2546796611b9a390b0aa4fb91b1a2902a1c40aec6d449d7253e7847fbe955c6ea67c61ca0f7e95731d98ae97fd4d759778c92ad96e8477c4e863c2d6ba
+SHA512 (freeipa-4.9.3.tar.gz) = a0c1b0271bb1fa2504a366b487825473abe76534bb5518fdc7d543a6e14a3521689c695c7ec979ff83e3cef8c6c94f6280683a1da9b8b12305e361b3a6a7749c
+SHA512 (freeipa-4.9.3.tar.gz.asc) = c4a265c54266ba858ef9b7e2e61ae305fa4fe254fa476d55ddb8b74415767b2c04d62c9478caee07a07d0b627cdb6a9b7ad13dd6e3ab6d077a0945003fcd5c08