diff --git a/.gitignore b/.gitignore
index d10e24e..3ae0d94 100644
--- a/.gitignore
+++ b/.gitignore
@@ -108,3 +108,5 @@
 /freeipa-4.9.2.tar.gz.asc
 /freeipa-4.9.3.tar.gz
 /freeipa-4.9.3.tar.gz.asc
+/freeipa-4.9.4.tar.gz
+/freeipa-4.9.4.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index f492bca..d19e3fd 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -49,7 +49,7 @@
 # lint is not executed during rpmbuild
 # %%global with_lint 1
 %if %{with lint}
-    %global linter_options --enable-pylint --with-jslint --enable-rpmlint
+    %global linter_options --enable-pylint --without-jslint --enable-rpmlint
 %else
     %global linter_options --disable-pylint --without-jslint --disable-rpmlint
 %endif
@@ -109,7 +109,7 @@
 %if 0%{?fedora} < 34
 %global ds_version %{lua: local v={}; v['32']='1.4.3.20-2'; v['33']='1.4.4.13-2'; print(v[rpm.expand('%{fedora}')])}
 %else
-%global ds_version 2.0.3-3
+%global ds_version 2.0.4-1
 %endif
 
 # Fix for TLS 1.3 PHA, RHBZ#1775146
@@ -160,6 +160,16 @@
 %global systemd_version 239
 %endif
 
+# augeas support for new chrony options
+# see https://pagure.io/freeipa/issue/8676
+# Note: will need to be updated for RHEL9 when a fix is available for
+# https://bugzilla.redhat.com/show_bug.cgi?id=1931787
+%if 0%{?fedora} >= 33
+%global augeas_version 1.12.0-6
+%else
+%global augeas_version 1.12.0-3
+%endif
+
 %global plugin_dir %{_libdir}/dirsrv/plugins
 %global etc_systemd_dir %{_sysconfdir}/systemd/system
 %global gettext_domain ipa
@@ -168,7 +178,7 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.9.3
+%define IPA_VERSION 4.9.4
 # Release candidate version -- uncomment with one percent for RC versions
 #%%global rc_version %%nil
 %define AT_SIGN @
@@ -181,7 +191,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        4%{?rc_version:.%rc_version}%{?dist}
+Release:        1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPLv3+
@@ -192,8 +202,7 @@ Source0:        https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_vers
 Source1:        https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz.asc
 %endif
 
-Patch0001:      freeipa-bz1948034.patch
-Patch0002:      freeipa-fix-389-ds-2.0.5-upgrade.patch
+Patch0001:      freeipa-fix-missing-creds.patch
 
 # RHEL spec file only: START: Change branding to IPA and Identity Management
 # Moved branding logos and background to redhat-logos-ipa-80.4:
@@ -312,7 +321,10 @@ BuildRequires: python3-m2r
 #
 %if %{with lint}
 BuildRequires:  git
+%if 0%{?fedora} < 34
+# jsl is orphaned in Fedora 34+
 BuildRequires:  jsl
+%endif
 BuildRequires:  nss-tools
 BuildRequires:  rpmlint
 BuildRequires:  softhsm
@@ -344,12 +356,8 @@ BuildRequires:  python3-polib
 BuildRequires:  python3-pyasn1
 BuildRequires:  python3-pyasn1-modules
 BuildRequires:  python3-pycodestyle
-%if 0%{?fedora} || 0%{?rhel} > 8
-# https://bugzilla.redhat.com/show_bug.cgi?id=1648299
-BuildRequires:  python3-pylint >= 2.1.1-2
-%else
-BuildRequires:  python3-pylint >= 1.7
-%endif
+# .wheelconstraints.in limits pylint version in Azure and tox tests
+BuildRequires:  python3-pylint
 BuildRequires:  python3-pytest-multihost
 BuildRequires:  python3-pytest-sourceorder
 BuildRequires:  python3-qrcode-core >= 5.0.0
@@ -436,7 +444,12 @@ Requires(pre): certmonger >= %{certmonger_version}
 Requires(pre): 389-ds-base >= %{ds_version}
 Requires: fontawesome-fonts
 Requires: open-sans-fonts
+%if 0%{?fedora} >= 32 || 0%{?rhel} >= 9
+# https://pagure.io/freeipa/issue/8632
+Requires: openssl > 1.1.1i
+%else
 Requires: openssl
+%endif
 Requires: softhsm >= 2.0.0rc1-1
 Requires: p11-kit
 Requires: %{etc_systemd_dir}
@@ -488,6 +501,7 @@ Requires: %{name}-common = %{version}-%{release}
 # we need pre-requires since earlier versions may break upgrade
 Requires(pre): python3-ldap >= %{python_ldap_version}
 Requires: python3-augeas
+Requires: augeas-libs >= %{augeas_version}
 Requires: python3-custodia >= 0.3.1
 Requires: python3-dbus
 Requires: python3-dns >= 1.15
@@ -523,8 +537,8 @@ Requires: %{name}-client-common = %{version}-%{release}
 Requires: httpd >= %{httpd_version}
 Requires: systemd-units >= %{systemd_version}
 Requires: custodia >= 0.3.1
-%if 0%{?rhel} >= 8
-Requires: redhat-logos-ipa >= 80.4
+%if 0%{?rhel} >= 8 && ! 0%{?eln}
+Requires: system-logos-ipa >= 80.4
 %endif
 
 Provides: %{alt_name}-server-common = %{version}
@@ -711,6 +725,7 @@ Requires: %{name}-client-common = %{version}-%{release}
 Requires: %{name}-common = %{version}-%{release}
 Requires: python3-ipalib = %{version}-%{release}
 Requires: python3-augeas
+Requires: augeas-libs >= %{augeas_version}
 Requires: python3-dns >= 1.15
 Requires: python3-jinja2
 
@@ -1680,6 +1695,9 @@ fi
 %endif
 
 %changelog
+* Fri Jun 04 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.9.4-1
+- Upstream release FreeIPA 4.9.4
+
 * Tue Jun 01 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.9.3-4
 - Handle upgrade of 389-ds replication plugin rename (part 2)
 
diff --git a/sources b/sources
index fa4620c..11504ce 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.9.3.tar.gz) = a0c1b0271bb1fa2504a366b487825473abe76534bb5518fdc7d543a6e14a3521689c695c7ec979ff83e3cef8c6c94f6280683a1da9b8b12305e361b3a6a7749c
-SHA512 (freeipa-4.9.3.tar.gz.asc) = c4a265c54266ba858ef9b7e2e61ae305fa4fe254fa476d55ddb8b74415767b2c04d62c9478caee07a07d0b627cdb6a9b7ad13dd6e3ab6d077a0945003fcd5c08
+SHA512 (freeipa-4.9.4.tar.gz) = 26704b7e508e74a6b1a0cb5d6b78c7a6e0bea21e811a7e4597e56aac9f7ef36870160070e051e9ef6ae6d3ea894af2e3326501546b6334dd1c4226ffb293d8c4
+SHA512 (freeipa-4.9.4.tar.gz.asc) = 1a8aca1f4378af01e08b5538309c90fa76e08ba04b297297c2423905e629153d3b44e119b90118543b60189cd616b07b16edd6103f3976598267e5869fe1322a