diff --git a/kernel.spec b/kernel.spec
index 98b3f50..3ef08bb 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -12,7 +12,7 @@
 # change below to w4T.xzdio):
 %define _binary_payload w3T.xzdio
 
-%global distro_build 519
+%global distro_build 520
 
 # Sign the x86_64 kernel for secure boot authentication
 %ifarch x86_64 aarch64 s390x ppc64le
@@ -38,10 +38,10 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 519.rt7.308.el8
+%define pkgrelease 520.rt7.309.el8
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 519.rt7.308%{?dist}
+%define specrelease 520.rt7.309%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -147,7 +147,7 @@
 # The preempt RT patch level
 %global rttag .rt7
 # realtimeN
-%global rtbuild .308
+%global rtbuild .309
 %define with_doc 0
 %define with_headers 0
 %define with_cross_headers 0
@@ -2698,6 +2698,39 @@ fi
 #
 #
 %changelog
+* Fri Oct 27 2023 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-520.rt7.309.el8]
+- [rt] build kernel-rt-4.18.0-520.rt7.309.el8 [RHEL-5332]
+- kernel/rh_messages.c: move hardware tables to rh_messages.h (Scott Weaver) [2181912]
+- kernel/rh_messages.c: Wire up new calls (Prarit Bhargava) [2181912]
+- drivers/pci: Update rh_messages.c (Prarit Bhargava) [2181912]
+- treewide: Remove mark_driver_deprecated() (Prarit Bhargava) [2181912]
+- treewide: Remove mark_hardware_deprecated() (Prarit Bhargava) [2181912]
+- treewide: Remove mark_driver_unmaintained() (Prarit Bhargava) [2181912]
+- drivers/pci: Remove RHEL-only pci_hw_*() functions (Prarit Bhargava) [2181912]
+- treewide: Remove pci_hw_disabled() calls (Prarit Bhargava) [2181912]
+- treewide: Remove pci_hw_deprecated() calls (Prarit Bhargava) [2181912]
+- treewide: Remove pci_hw_unmaintained() calls (Prarit Bhargava) [2181912]
+- redhat: fix bug/zjira sort in the changelog (Patrick Talbert)
+- blk-mq: enforce op-specific segment limits in blk_insert_cloned_request (Ming Lei) [RHEL-14504]
+- tunnels: fix kasan splat when generating ipv4 pmtu error (Guillaume Nault) [RHEL-14377]
+- net:ipv6: check return value of pskb_trim() (Guillaume Nault) [RHEL-14377]
+- sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() (Guillaume Nault) [RHEL-14377]
+- ipv4: fix null-deref in ipv4_link_failure (Felix Maurer) [RHEL-5427] {CVE-2023-42754}
+- powerpc/perf/hv-24x7: Update domain value check (Michael Petlan) [RHEL-13718]
+- vxlan: Expose helper vxlan_build_gbp_hdr (Izabela Bakollari) [RHEL-12413]
+- vxlan: Remove unused argument from vxlan_build_gbp_hdr( ) and vxlan_build_gpe_hdr( ) (Izabela Bakollari) [RHEL-12413]
+- net: ipv4: fix one memleak in __inet_del_ifa() (Guillaume Nault) [RHEL-14375]
+- ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Guillaume Nault) [RHEL-14375]
+- icmp: guard against too small mtu (Guillaume Nault) [RHEL-14375]
+- ipv6: ping: fix wrong checksum for large frames (Guillaume Nault) [RHEL-14375]
+- net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr (Hangbin Liu) [RHEL-13954]
+- ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Hangbin Liu) [RHEL-13954]
+- ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Hangbin Liu) [RHEL-13954]
+- ipv6/addrconf: fix a potential refcount underflow for idev (Hangbin Liu) [RHEL-13954]
+- icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (Hangbin Liu) [RHEL-13954]
+- ping6: Fix send to link-local addresses with VRF. (Hangbin Liu) [RHEL-13954]
+- ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Hangbin Liu) [RHEL-13954]
+
 * Wed Oct 25 2023 Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-519.rt7.308.el8]
 - [rt] build kernel-rt-4.18.0-519.rt7.308.el8 [RHEL-5332]
 - redhat: remove kabi-rhel810 directory (Prarit Bhargava)
diff --git a/sources b/sources
index f32c734..dbe9dc1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (linux-4.18.0-519.rt7.308.el8.tar.xz) = 3620eefd13b51b5fe572329f6d24420d204c087c5dfd7fd1db666a80e69e6bcaa4ca36382f16d00d9e5906ab4eec89f888be0257a8146df8b3bb7dc35be1bedf
+SHA512 (linux-4.18.0-520.rt7.309.el8.tar.xz) = 78a0613d75a8cc77833b7a2fed7ee46d5ab03a925073f6d2de6c88b53499dacad4e3196812368672a73cfccb5bf051da51ee5a1a4052cc3565f07ac9073e7415