diff --git a/Makefile.rhelver b/Makefile.rhelver
index 14498ed..79c85ca 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 0
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 3
+RHEL_RELEASE = 4
 
 #
 # Early y+1 numbering
@@ -44,4 +44,4 @@ ifneq ("$(ZSTREAM)", "yes")
   endif
 endif
 
-RTBUILD:=.3
+RTBUILD:=.4
diff --git a/kernel.spec b/kernel.spec
index 2163420..0f66215 100755
--- a/kernel.spec
+++ b/kernel.spec
@@ -80,7 +80,7 @@ Summary: The Linux kernel
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
 
-%global distro_build 3
+%global distro_build 4
 
 %if 0%{?fedora}
 %define secure_boot_arch x86_64
@@ -125,13 +125,13 @@ Summary: The Linux kernel
 
 %define rpmversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 3.rt21.3
+%define pkgrelease 4.rt21.4.el9
 
 # This is needed to do merge window version magic
 %define patchlevel 14
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 3.rt21.3%{?buildid}%{?dist}
+%define specrelease 4.rt21.4%{?buildid}%{?dist}
 
 %define pkg_release %{specrelease}
 
@@ -700,7 +700,7 @@ BuildRequires: lld
 # exact git commit you can run
 #
 # xzcat -qq ${TARBALL} | git get-tar-commit-id
-Source0: linux-5.14.0-3.rt21.3.tar.xz
+Source0: linux-5.14.0-4.rt21.4.el9.tar.xz
 
 Source1: Makefile.rhelver
 
@@ -1428,8 +1428,8 @@ ApplyOptionalPatch()
   fi
 }
 
-%setup -q -n kernel-5.14.0-3.rt21.3 -c
-mv linux-5.14.0-3.rt21.3 linux-%{KVERREL}
+%setup -q -n kernel-5.14.0-4.rt21.4.el9 -c
+mv linux-5.14.0-4.rt21.4.el9 linux-%{KVERREL}
 
 cd linux-%{KVERREL}
 cp -a %{SOURCE1} .
@@ -3086,6 +3086,27 @@ fi
 #
 #
 %changelog
+* Thu Sep 23 2021 Juri Lelli <juri.lelli@redhat.com> [5.14-4.rt21.4.el9]
+- Drivers: hv: vmbus: Fix kernel crash upon unbinding a device from uio_hv_generic driver (Vitaly Kuznetsov) [1999535]
+- ipc: replace costly bailout check in sysvipc_find_ipc() (Rafael Aquini) [1987130 2003270] {CVE-2021-3669}
+- redhat/configs: Disable CONFIG_DRM_VMWGFX on aarch64 (Michel Dänzer) [1996993]
+- redhat: set USE_DIST_IN_SOURCE=1 for 9.0-beta (Jan Stancek)
+- redhat: add option to use DIST tag in sources (Jan Stancek)
+- CI: Enable notification messages for RHEL9 (Veronika Kabatova)
+- CI: Enable private pipelines for RT branches (Veronika Kabatova)
+- CI: Remove ARK leftovers (Veronika Kabatova)
+- redhat: add *-matched meta packages to rpminspect emptyrpm config (Herton R. Krzesinski)
+- gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [1988451]
+- gfs2: don't stop reads while withdraw in progress (Bob Peterson) [1988451]
+- gfs2: Mark journal inodes as "don't cache" (Bob Peterson) [1988451]
+- cgroup/cpuset: Avoid memory migration when nodemasks match (Waiman Long) [1980430]
+- cgroup/cpuset: Enable memory migration for cpuset v2 (Waiman Long) [1980430]
+- iscsi_ibft: Fix isa_bus_to_virt not working under ARM (Maurizio Lombardi) [1963801]
+- x86/setup: Explicitly include acpi.h (Maurizio Lombardi) [1963801]
+- iscsi_ibft: fix warning in reserve_ibft_region() (Maurizio Lombardi) [1963801]
+- iscsi_ibft: fix crash due to KASLR physical memory remapping (Maurizio Lombardi) [1963801]
+- redhat: fix chronological order in the changelog file (Herton R. Krzesinski)
+
 * Mon Sep 20 2021 Juri Lelli <juri.lelli@redhat.com> [5.14-3.rt21.3]
 - redhat: Fix lasttag for kernel-rt (Juri Lelli)
 - misc/pvpanic-pci: Allow automatic loading (Eric Auger) [1977192]
diff --git a/rpminspect.yaml b/rpminspect.yaml
index e540fbd..f62742a 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -5,6 +5,9 @@ emptyrpm:
     expected_empty:
         - kernel
         - kernel-debug
+        - kernel-debug-devel-matched
+        - kernel-devel-matched
         - kernel-lpae
         - kernel-zfcpdump
+        - kernel-zfcpdump-devel-matched
         - kernel-zfcpdump-modules
diff --git a/sources b/sources
index ccba05b..66e1e39 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (kernel-abi-whitelists-5.13.0-1.tar.bz2) = ceba454e1f590c1e4ef4115a75463ae3ac2c2aa7ec85fa14a2669d666c421483a38225ee19d7d72b4ac7032375741408b23543e43588538c80161ec0cf57051c
-SHA512 (linux-5.14.0-3.rt21.3.tar.xz) = 8d4d39cc8f5b1eded5f43f18f32b606097c96568316d3554c72e64bfd39174e26e0be726ba496d7d1f3acd73252a45381202c122b62c2ca2dea24953023432f2
-SHA512 (kernel-abi-stablelists-5.14.0-3.tar.bz2) = e7469d1efc7fa50742df29742a05b46f035b60bbcf25c666eb88184622e5296aaab1790777570742114ce3aaf4eb3ebda6173010e2ef4c04da40531cf6a30151
-SHA512 (kernel-kabi-dw-5.14.0-3.tar.bz2) = c901529aff636abbc2aa5f289ec098a2a29c8507aa81ee649d1104592b8abad9f495db0e947dc36a84e043708a47373de35156b40b252281ef747f06e19ed914
+SHA512 (linux-5.14.0-4.rt21.4.el9.tar.xz) = 3e2ffe365b57e4d1a03b43e4c0f77a429e83f8765c38b287a67ed2f3ce89eabbde6bbd219b003d962e963fd4412e2cbf48d426a260093d63fd4ca0a2207f1186
+SHA512 (kernel-abi-stablelists-5.14.0-4.tar.bz2) = 64c64d82a249464f32f3b03b882130f3efef7e26df87d31f77ebb08f61d336e3badc1d4f08f552280558772496f41ba3126c6263397cdaad3aaed14d78b8fd36
+SHA512 (kernel-kabi-dw-5.14.0-4.tar.bz2) = c901529aff636abbc2aa5f289ec098a2a29c8507aa81ee649d1104592b8abad9f495db0e947dc36a84e043708a47373de35156b40b252281ef747f06e19ed914