diff --git a/.gitignore b/.gitignore
index b190dd3..0604ca7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@
 /opendnssec-1.4.1.tar.gz
 /opendnssec-1.4.2.tar.gz
 /opendnssec-1.4.3.tar.gz
+/opendnssec-1.4.4.tar.gz
diff --git a/opendnssec.spec b/opendnssec.spec
index a89b719..dafe027 100644
--- a/opendnssec.spec
+++ b/opendnssec.spec
@@ -3,7 +3,7 @@
 
 Summary: DNSSEC key and zone management software
 Name: opendnssec
-Version: 1.4.3
+Version: 1.4.4
 Release: 1%{?prever}%{?dist}
 License: BSD
 Url: http://www.opendnssec.org/
@@ -38,6 +38,8 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
 
 %prep
 %setup -q -n %{name}-%{version}%{?prever}
+# bump default policy ZSK keysize to 2048
+sed -i "s/1024/2048/" conf/kasp.xml.in
 
 %build
 export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"
@@ -80,7 +82,7 @@ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods
 %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec
-%doc NEWS README LICENSE
+%doc NEWS README.md LICENSE
 %{_mandir}/*/*
 %{_sbindir}/*
 %{_bindir}/*
@@ -95,15 +97,15 @@ useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
 exit 0
 
 %post
-# in case we update any xml conf file
-ods-ksmutil update all ||: >/dev/null 2>/dev/null
-%systemd_post ods-enforcerd.service
-%systemd_post ods-signerd.service
-
 # Initialise a slot on the softhsm on first install
 if [ "$1" -eq 1 ]; then
         softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
 fi
+# in case we update any xml conf file
+ods-ksmutil update all >/dev/null 2>/dev/null ||:
+%systemd_post ods-enforcerd.service
+%systemd_post ods-signerd.service
+
 
 %preun
 %systemd_preun ods-enforcerd.service
@@ -114,8 +116,13 @@ fi
 %systemd_postun_with_restart ods-signerd.service
 
 %changelog
+* Thu Mar 27 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-1
+- Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441)
+- Change the default ZSK policy from 1024 to 2048 bit RSA keys
+- Fix post to be quiet when upgrading opendnssec
+
 * Thu Jan 09 2014 Paul Wouters <pwouters@redhat.com> - 1.4.3-1
-- Updated to 1.4.3i (rhel#1048449) - minor bugfixes, minor feature enhancements
+- Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements
 - rhel#1025985 OpenDNSSEC signer cannot be started due to a typo in service file
 
 * Wed Sep 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.2-1
diff --git a/sources b/sources
index a88abd5..f80ab28 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-009358a5dabca784128752bcf7b8d64f  opendnssec-1.4.3.tar.gz
+2b8f2c6921953c7a1472b54fd6dfe495  opendnssec-1.4.4.tar.gz