diff --git a/.gitignore b/.gitignore
index 4c17e4d..bf39201 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@
 /passt-7c7625ddff10e10a7486622b25e3a66bfcdd6c8b.tar.xz
 /passt-1297ae2873a02b4d6dd7423e49f0970a38977b3a.tar.xz
 /passt-70c0765b49e19b76639908a7686d8f795ba3ed24.tar.xz
+/passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.xz
diff --git a/passt.spec b/passt.spec
index 4b810f5..9654b26 100644
--- a/passt.spec
+++ b/passt.spec
@@ -7,10 +7,11 @@
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
-%global git_hash 70c0765b49e19b76639908a7686d8f795ba3ed24
+%global git_hash dd2349661933c4e9756e524ae9465f38b53b7557
+%global selinuxtype targeted
 
 Name:		passt
-Version:	0^20230310.g70c0765
+Version:	0^20230317.gdd23496
 Release:	1%{?dist}
 Summary:	User-mode networking daemons for virtual machines and namespaces
 License:	AGPLv3+ and BSD
@@ -19,6 +20,7 @@ URL:		https://passt.top/
 Source:		https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
 
 BuildRequires:	gcc, make, checkpolicy, selinux-policy-devel
+Requires:	(%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
 
 %description
 passt implements a translation layer between a Layer-2 network interface and
@@ -66,13 +68,21 @@ install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/p
 install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if
 popd
 
-%post selinux
-semodule -i %{_datadir}/selinux/packages/%{name}/passt.pp 2>/dev/null || :
-semodule -i %{_datadir}/selinux/packages/%{name}/pasta.pp 2>/dev/null || :
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
 
-%preun selinux
-semodule -r passt 2>/dev/null || :
-semodule -r pasta 2>/dev/null || :
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/passt.pp
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/pasta.pp
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+	%selinux_modules_uninstall -s %{selinuxtype} passt
+	%selinux_modules_uninstall -s %{selinuxtype} pasta
+fi
+
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
 
 %files
 %license LICENSES/{AGPL-3.0-or-later.txt,BSD-3-Clause.txt}
@@ -100,6 +110,10 @@ semodule -r pasta 2>/dev/null || :
 %{_datadir}/selinux/devel/include/contrib/pasta.if
 
 %changelog
+* Fri Mar 17 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230317.gdd23496-1
+- Refresh SELinux labels in scriptlets, require -selinux package
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_10.70c0765..2023_03_17.dd23496
+
 * Fri Mar 10 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230310.g70c0765-1
 - Install SELinux interface files to shared include directory
 - Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_09.7c7625d..2023_03_10.70c0765
diff --git a/sources b/sources
index a6212ae..01f5849 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (passt-70c0765b49e19b76639908a7686d8f795ba3ed24.tar.xz) = 8136e0d6c31dbe726300c7c50733d3d862f85b45fe402f657507b55d2f2c45b9238990dd80dd7054303cbb5d55e778ad7bd43ff0745e02ef939b6712d70e7bff
+SHA512 (passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.xz) = 27fce740fb658e4dd1b1aa72f23366aca2327bb4c8c16861951a1de6b3c38717c9406ba0c7946c8f7c95627d29a7bad29b9695ea8e28b930e86e4a3ab3cc2907