diff --git a/.gitignore b/.gitignore
index 2c8db19..4b4f520 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,7 @@
 /kea-2.4.0.tar.gz.asc
 /kea-2.4.1.tar.gz
 /kea-2.4.1.tar.gz.asc
+/kea-2.6.0.tar.gz
+/kea-2.6.0.tar.gz.asc
+/keama-4.5.0.tar.gz
+/keama-4.5.0.tar.gz.asc
diff --git a/kea-gtest.patch b/kea-gtest.patch
new file mode 100644
index 0000000..6c014f2
--- /dev/null
+++ b/kea-gtest.patch
@@ -0,0 +1,30 @@
+diff --git a/m4macros/ax_gtest.m4 b/m4macros/ax_gtest.m4
+index 138a03f..80ebb98 100644
+--- a/m4macros/ax_gtest.m4
++++ b/m4macros/ax_gtest.m4
+@@ -173,9 +173,9 @@ if test "x$enable_gtest" = "xyes" ; then
+             for dir in $GTEST_PATHS; do
+                 if test -f "$dir/include/gtest/gtest.h"; then
+                     if test -f "$dir/lib/libgtest.a" || \
+-                       test -f "$dir/lib/libgtest.so"; then
++                       test -f "$dir/lib64/libgtest.so"; then
+                         GTEST_INCLUDES="-I$dir/include"
+-                        GTEST_LDFLAGS="-L$dir/lib"
++                        GTEST_LDFLAGS="-L$dir/lib64"
+                         GTEST_LDADD="-lgtest"
+                         GTEST_FOUND="true"
+                         AC_MSG_RESULT([$dir/lib])
+diff --git a/src/lib/util/tests/pid_file_unittest.cc b/src/lib/util/tests/pid_file_unittest.cc
+index 5f00d72..583a35b 100644
+--- a/src/lib/util/tests/pid_file_unittest.cc
++++ b/src/lib/util/tests/pid_file_unittest.cc
+@@ -181,7 +181,8 @@ TEST_F(PIDFileTest, pidGarbage) {
+ }
+ 
+ /// @brief Test failing to write a file.
+-TEST_F(PIDFileTest, pidWriteFail) {
++/// Fails to fail for root, it doesn't throw PIDFileError exception.
++TEST_F(PIDFileTest, DISABLED_pidWriteFail) {
+     PIDFile pid_file(absolutePath(TESTNAME));
+ 
+     // Create the test file and change it's permission bits
diff --git a/kea.spec b/kea.spec
index 384ac5e..8e95991 100644
--- a/kea.spec
+++ b/kea.spec
@@ -1,26 +1,41 @@
-# TODO: no support for netconf/sysconf yet
-%global sysrepo 0
-
-#%%global prever P1
-
 Name:           kea
-Version:        2.4.1
+Version:        2.6.0
 Release:        %autorelease
 Summary:        DHCPv4, DHCPv6 and DDNS server from ISC
 
 License:        MPL-2.0 AND BSL-1.0
 URL:            http://kea.isc.org
+
+# TODO: no support for netconf/sysconf yet
+%bcond_with sysrepo
+%bcond_with gtest
+
+#%%global prever P1
+%global keama_version 4.5.0
+# Bundled version of Bind libraries linked into Keama
+%global bind_version 9.11.36
+
+# Conflict with kea-next
+%global upstream_name kea
+%define upstream_name_compat() \
+%if "%{name}" != "%{upstream_name}" \
+Provides: %1 = %{version}-%{release} \
+Conflicts: %1 \
+%endif
+
 Source0:        https://downloads.isc.org/isc/kea/%{version}%{?prever:-%{prever}}/kea-%{version}%{?prever:-%{prever}}.tar.gz
 Source1:        https://downloads.isc.org/isc/kea/%{version}%{?prever:-%{prever}}/kea-%{version}%{?prever:-%{prever}}.tar.gz.asc
-# Obtained from https://www.isc.org/pgpkey/
-Source2:        isc-keyblock.asc
-Source3:        kea-dhcp4.service
-Source4:        kea-dhcp6.service
-Source5:        kea-dhcp-ddns.service
-Source6:        kea-ctrl-agent.service
-Source7:        kea-tmpfiles.d.conf
+Source2:        https://downloads.isc.org/isc/keama/%{keama_version}/keama-%{keama_version}.tar.gz
+Source3:        https://downloads.isc.org/isc/keama/%{keama_version}/keama-%{keama_version}.tar.gz.asc
+Source10:       https://www.isc.org/docs/isc-keyblock.asc
+Source11:       kea-dhcp4.service
+Source12:       kea-dhcp6.service
+Source13:       kea-dhcp-ddns.service
+Source14:       kea-ctrl-agent.service
+Source15:       kea-tmpfiles.d.conf
 
 Patch1:         kea-openssl-version.patch
+Patch2:         kea-gtest.patch
 
 # autoreconf
 BuildRequires: autoconf automake libtool
@@ -28,20 +43,24 @@ BuildRequires: boost-devel
 BuildRequires: gcc-c++
 # %%configure --with-openssl
 BuildRequires: openssl-devel
-# %%configure --with-dhcp-mysql
 %if 0%{?fedora} || 0%{?rhel} > 7
+# %%configure --with-mysql
 BuildRequires: mariadb-connector-c-devel
-# TODO: propose upstream fix so this is not needed (no server-side related
-# headers nor configuration should be needed)
+# %%configure --with-pgsql
+# TODO: https://issues.redhat.com/browse/RHEL-36609
+#%if 0%%{?fedora} > 40 || 0%%{?rhel} > 9
+#BuildRequires: libpq-devel
+#%else
 BuildRequires: postgresql-server-devel
+#%endif
 %else
-# %%configure --with-dhcp-mysql
+# %%configure --with-mysql
 BuildRequires: mariadb-devel
-# %%configure --with-dhcp-pgsql
+# %%configure --with-pgsql
 BuildRequires: postgresql-devel
 %endif
 BuildRequires: log4cplus-devel
-%if %{sysrepo}
+%if %{with sysrepo}
 # %%configure --with-sysrepo
 BuildRequires: sysrepo-devel
 %endif
@@ -49,8 +68,12 @@ BuildRequires: sysrepo-devel
 %ifnarch s390 %{mips}
 BuildRequires: valgrind-devel
 %endif
+%if %{with gtest}
+# %%configure --enable-gtest
+BuildRequires: gtest-devel
 # src/lib/testutils/dhcp_test_lib.sh
 BuildRequires: procps-ng
+%endif
 # %%configure --enable-generate-parser
 BuildRequires: bison
 BuildRequires: flex
@@ -65,6 +88,7 @@ BuildRequires: make
 BuildRequires: gnupg2
 
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+%upstream_name_compat %{upstream_name}
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
@@ -111,16 +135,30 @@ custom processing is required.
 
 %package libs
 Summary: Shared libraries used by Kea DHCP server
+%upstream_name_compat %{upstream_name}-libs
 
 %description libs
 This package contains shared libraries used by Kea DHCP server.
 
 
+%package keama
+Summary: Experimental migration assistant for Kea
+Provides: bundled(bind-libs) = %{bind_version}
+
+%description keama
+The KEA Migration Assistant is an experimental tool which helps to translate
+ISC DHCP configurations to Kea.
+
+
 %prep
 %if 0%{?fedora} || 0%{?rhel} > 8
-%{gpgverify} --keyring='%{S:2}' --signature='%{S:1}' --data='%{S:0}'
+%{gpgverify} --keyring='%{S:10}' --signature='%{S:1}' --data='%{S:0}'
+%{gpgverify} --keyring='%{S:10}' --signature='%{S:3}' --data='%{S:2}'
 %endif
+
+%autosetup -T -b2 -N -n keama-%{keama_version}
 %autosetup -p1 -n kea-%{version}%{?prever:-%{prever}}
+
 rm -rf doc/sphinx/_build
 
 # to be able to build on ppc64(le)
@@ -137,40 +175,67 @@ autoreconf --verbose --force --install
     --disable-rpath \
     --disable-silent-rules \
     --disable-static \
-    --enable-debug \
-    --enable-generate-parser \
-    --enable-shell \
     --enable-generate-docs \
     --enable-generate-messages \
+    --enable-generate-parser \
+    --enable-shell \
     --enable-perfdhcp \
+%if %{with gtest}
+    --with-gtest \
+%endif
     --with-mysql \
     --with-pgsql \
     --with-gnu-ld \
     --with-log4cplus \
-%if %{sysrepo}
+%if %{with sysrepo}
     --with-sysrepo \
 %endif
     --with-openssl
 
 %make_build
 
+# Configure & build Keama
+pushd ../keama-%{keama_version}
+%configure \
+    --disable-dependency-tracking \
+    --disable-silent-rules
+
+%make_build
+popd
+
+
+%if %{with gtest}
+%check
+make check
+%endif
+
 
 %install
 %make_install docdir=%{_pkgdocdir}
 
+# Install Keama
+pushd ../keama-%{keama_version}
+%make_install
+popd
+
+# Remove Keama's static library, dhcp headers and man pages
+rm -f %{buildroot}/%{_libdir}/libdhcp.a
+rm -rf %{buildroot}/%{_includedir}/omapip/
+rm -rf %{buildroot}%{_mandir}/man5/
+
 # Get rid of .la files
 find %{buildroot} -type f -name "*.la" -delete -print
 
-%if !%{sysrepo}
-# remove netconf files
+%if %{without sysrepo}
+# Remove netconf files
 rm %{buildroot}%{_mandir}/man8/kea-netconf.8
 %endif
 
 # Install systemd units
-install -Dpm 0644 %{S:3} %{buildroot}%{_unitdir}/kea-dhcp4.service
-install -Dpm 0644 %{S:4} %{buildroot}%{_unitdir}/kea-dhcp6.service
-install -Dpm 0644 %{S:5} %{buildroot}%{_unitdir}/kea-dhcp-ddns.service
-install -Dpm 0644 %{S:6} %{buildroot}%{_unitdir}/kea-ctrl-agent.service
+install -Dpm 0644 %{S:11} %{buildroot}%{_unitdir}/kea-dhcp4.service
+install -Dpm 0644 %{S:12} %{buildroot}%{_unitdir}/kea-dhcp6.service
+install -Dpm 0644 %{S:13} %{buildroot}%{_unitdir}/kea-dhcp-ddns.service
+install -Dpm 0644 %{S:14} %{buildroot}%{_unitdir}/kea-ctrl-agent.service
 
 # Start empty lease databases
 mkdir -p %{buildroot}%{_sharedstatedir}/kea/
@@ -183,7 +248,7 @@ rm -f %{buildroot}%{_pkgdocdir}/html/.buildinfo
 mkdir -p %{buildroot}/run
 install -dm 0755 %{buildroot}/run/kea/
 
-install -Dpm 0644 %{S:7} %{buildroot}%{_tmpfilesdir}/kea.conf
+install -Dpm 0644 %{S:15} %{buildroot}%{_tmpfilesdir}/kea.conf
 
 
 %post
@@ -224,7 +289,7 @@ install -Dpm 0644 %{S:7} %{buildroot}%{_tmpfilesdir}/kea.conf
 %{_mandir}/man8/kea-dhcp4.8*
 %{_mandir}/man8/kea-dhcp6.8*
 %{_mandir}/man8/kea-lfc.8*
-%if %{sysrepo}
+%if %{with sysrepo}
 %{_mandir}/man8/kea-netconf.8*
 %endif
 %{_mandir}/man8/kea-shell.8*
@@ -237,12 +302,13 @@ install -Dpm 0644 %{S:7} %{buildroot}%{_tmpfilesdir}/kea.conf
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/AUTHORS
 %doc %{_pkgdocdir}/ChangeLog
-%doc %{_pkgdocdir}/README
-%doc %{_pkgdocdir}/examples
-%doc %{_pkgdocdir}/CONTRIBUTING.md
-%doc %{_pkgdocdir}/platforms.rst
 %doc %{_pkgdocdir}/code_of_conduct.md
+%doc %{_pkgdocdir}/CONTRIBUTING.md
+%doc %{_pkgdocdir}/examples
 %doc %{_pkgdocdir}/html
+%doc %{_pkgdocdir}/platforms.rst
+%doc %{_pkgdocdir}/README
+%doc %{_pkgdocdir}/SECURITY.md
 
 %files devel
 %{_includedir}/kea
@@ -255,29 +321,34 @@ install -Dpm 0644 %{S:7} %{buildroot}%{_tmpfilesdir}/kea.conf
 %files libs
 %license COPYING
 # find `rpm --eval %%{_topdir}`/BUILDROOT/kea-*/usr/lib64/ -type f | grep /usr/lib64/libkea | sed -e 's#.*/usr/lib64\(.*\.so\.[0-9]\+\)\.[0-9]\+\.[0-9]\+#%%{_libdir}\1*#' | sort
-%{_libdir}/libkea-asiodns.so.35*
-%{_libdir}/libkea-asiolink.so.56*
-%{_libdir}/libkea-cc.so.54*
-%{_libdir}/libkea-cfgclient.so.51*
-%{_libdir}/libkea-cryptolink.so.38*
-%{_libdir}/libkea-d2srv.so.30*
-%{_libdir}/libkea-database.so.48*
-%{_libdir}/libkea-dhcp_ddns.so.41*
-%{_libdir}/libkea-dhcp++.so.74*
-%{_libdir}/libkea-dhcpsrv.so.90*
-%{_libdir}/libkea-dns++.so.42*
-%{_libdir}/libkea-eval.so.52*
-%{_libdir}/libkea-exceptions.so.23*
-%{_libdir}/libkea-hooks.so.78*
-%{_libdir}/libkea-http.so.56*
-%{_libdir}/libkea-log.so.48*
-%{_libdir}/libkea-mysql.so.53*
-%{_libdir}/libkea-pgsql.so.53*
-%{_libdir}/libkea-process.so.57*
-%{_libdir}/libkea-stats.so.29*
-%{_libdir}/libkea-tcp.so.5*
+%{_libdir}/libkea-asiodns.so.48*
+%{_libdir}/libkea-asiolink.so.71*
+%{_libdir}/libkea-cc.so.68*
+%{_libdir}/libkea-cfgclient.so.65*
+%{_libdir}/libkea-cryptolink.so.50*
+%{_libdir}/libkea-d2srv.so.46*
+%{_libdir}/libkea-database.so.61*
+%{_libdir}/libkea-dhcp_ddns.so.56*
+%{_libdir}/libkea-dhcp++.so.89*
+%{_libdir}/libkea-dhcpsrv.so.108*
+%{_libdir}/libkea-dns++.so.56*
+%{_libdir}/libkea-eval.so.69*
+%{_libdir}/libkea-exceptions.so.33*
+%{_libdir}/libkea-hooks.so.97*
+%{_libdir}/libkea-http.so.71*
+%{_libdir}/libkea-log.so.61*
+%{_libdir}/libkea-mysql.so.69*
+%{_libdir}/libkea-pgsql.so.69*
+%{_libdir}/libkea-process.so.72*
+%{_libdir}/libkea-stats.so.41*
+%{_libdir}/libkea-tcp.so.18*
 %{_libdir}/libkea-util-io.so.0*
-%{_libdir}/libkea-util.so.68*
+%{_libdir}/libkea-util.so.84*
+
+%files keama
+%license COPYING
+%{_bindir}/keama
+%{_mandir}/man8/keama.8*
 
 
 %changelog
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..270e9ce
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,8 @@
+---
+badfuncs:
+  # Keama converts old ISC dhcpd configuration to a new Kea format.
+  # It is not multi-threaded so it is safe to use.
+  allowed:
+    /usr/bin/keama:
+      - gethostbyname
+
diff --git a/sources b/sources
index b912392..25debd5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,4 @@
-SHA512 (kea-2.4.1.tar.gz) = b8a3b6f2cae213fd9826c37568c71d3458f52eed973dbe437a1d0974dafa026635a730d828c6ff03b32e030be57d75a7914a8ca313833e91d9996b6a05b2b224
-SHA512 (kea-2.4.1.tar.gz.asc) = 68050e555018b882fb796081075e64c1004ebe330397318e9e6e8eb3519f1086ad2796e20c1af9fa551df3af8857509c54e0cf57ecaedc8dffa946b879205c99
+SHA512 (kea-2.6.0.tar.gz) = 6451be2f2556324fba8ab75238e8a46203ef8d94db98a7590718715a3bb5dff49d113bf387c413376a36ca0674077425ee46be0c6e50803397aa6f9428f7b50d
+SHA512 (kea-2.6.0.tar.gz.asc) = 9dc485c2d9d2e11ea263ac8bbda51eb4ac570f45a55c38ab1979920dadcd96e03aeefd6e4fc552c2c4fa2401329ac40e0321fc866716ca23e1418c16b6dbf34b
+SHA512 (keama-4.5.0.tar.gz) = 2e48987e21999718be7ceb5b604be672c84666b07dde9545285ff7146ab6825e81af1ec3b5a4b50f20e61b40ed11b0254e3705cc580bb85de24b77ee8cbca162
+SHA512 (keama-4.5.0.tar.gz.asc) = 8ec416e44e143037a6936682d1e11b96c1a48be05f3e747e7a26b190e1f11c75104ef16c23eda9b257433b8de5a73c081b65fd903b611d8faa9c4b3b47702763