diff --git a/.gitignore b/.gitignore
index 6ce4b40..437d144 100644
--- a/.gitignore
+++ b/.gitignore
@@ -117,3 +117,4 @@
 /rpm-ostree-2023.3.tar.xz
 /rpm-ostree-2023.4.tar.xz
 /rpm-ostree-2023.5.tar.xz
+/ostree-ext.vendor.tar.gz
diff --git a/0001-main-Update-ostree-ext-add-provisional-repair-entryp.patch b/0001-main-Update-ostree-ext-add-provisional-repair-entryp.patch
new file mode 100644
index 0000000..bec3be8
--- /dev/null
+++ b/0001-main-Update-ostree-ext-add-provisional-repair-entryp.patch
@@ -0,0 +1,64 @@
+From 53fb8c7cb7075e4ecda4564f3a17af84ad4a2e32 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Fri, 21 Jul 2023 15:21:00 -0400
+Subject: [PATCH] main: Update ostree-ext, add provisional-repair entrypoint
+
+This updates us to vendor the provisional-repair code.  One can
+now run `ostree provisional-repair` directly.
+
+(Yes, it's very confusing how in rpm-ostree, we vendor the ostree-ext
+ source, and then install a wrapper symlink which tells the main
+ (C) `ostree` binary to call back into us... but it's how the
+ `ostree container` stuff has been working for a long time)
+---
+ Cargo.lock             | 4 ++--
+ Makefile-rpm-ostree.am | 1 +
+ rust/src/main.rs       | 4 +++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 5ae6366a..c6826a4d 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1775,9 +1775,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ostree-ext"
+-version = "0.11.1"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a690495144c18cb333a67a2ec61dd008831710bbd37804cfa79ab93b51146a6f"
++checksum = "8511513a60fa0c20a84ba8d30255286687c848bec21d24cd3dd4d16ecf48123b"
+ dependencies = [
+  "anyhow",
+  "async-compression 0.3.15",
+diff --git a/Makefile-rpm-ostree.am b/Makefile-rpm-ostree.am
+index 2ef84f83..be80a6d7 100644
+--- a/Makefile-rpm-ostree.am
++++ b/Makefile-rpm-ostree.am
+@@ -132,6 +132,7 @@ install-rpmostree-hook:
+ 	install -m 0755 -t $(DESTDIR)$(bindir) rpm-ostree
+ 	install -d -m 0755 $(ostreeextdir)
+ 	ln -Tsr -f $(DESTDIR)$(bindir)/rpm-ostree $(ostreeextdir)/ostree-ima-sign 
++	ln -Tsr -f $(DESTDIR)$(bindir)/rpm-ostree $(ostreeextdir)/ostree-provisional-repair 
+ 	ln -Tsr -f $(DESTDIR)$(bindir)/rpm-ostree $(ostreeextdir)/ostree-container
+ INSTALL_EXEC_HOOKS += install-rpmostree-hook
+ 
+diff --git a/rust/src/main.rs b/rust/src/main.rs
+index 9088c5f0..569cf094 100644
+--- a/rust/src/main.rs
++++ b/rust/src/main.rs
+@@ -53,7 +53,9 @@ async fn dispatch_ostree_ext(args: Vec<String>) -> Result<i32> {
+ /// Dispatch multicall binary to relevant logic, based on callname from `argv[0]`.
+ async fn dispatch_multicall(callname: String, args: Vec<String>) -> Result<i32> {
+     match callname.as_str() {
+-        "ostree-container" | "ostree-ima-sign" => dispatch_ostree_ext(args).await,
++        "ostree-container" | "ostree-ima-sign" | "ostree-provisional-repair" => {
++            dispatch_ostree_ext(args).await
++        }
+         _ => inner_async_main(args).await, // implicitly includes "rpm-ostree"
+     }
+ }
+-- 
+2.40.1
+
diff --git a/rpm-ostree.spec b/rpm-ostree.spec
index 1983bb4..a689efb 100644
--- a/rpm-ostree.spec
+++ b/rpm-ostree.spec
@@ -3,24 +3,30 @@
 
 Summary: Hybrid image/package system
 Name: rpm-ostree
+# NOTE WHEN BUMPING RELEASE, REMOVE SOURCE1 BELOW
 Version: 2023.5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: LGPLv2+
 URL: https://github.com/coreos/rpm-ostree
 # This tarball is generated via "cd packaging && make -f Makefile.dist-packaging dist-snapshot"
 # in the upstream git.  It also contains vendored Rust sources.
 Source0: https://github.com/coreos/rpm-ostree/releases/download/v%{version}/rpm-ostree-%{version}.tar.xz
+# Updated vendor bits for the below patch; REMOVE THIS when updating
+Source1: ostree-ext.vendor.tar.gz
+
+# Backport https://github.com/coreos/rpm-ostree/pull/4510
+# which is really just a backport of:
+#  - https://github.com/ostreedev/ostree-rs-ext/pull/504/commits/abc8ed660843b3ad85e72c0002996dabd61778dd
+#  - https://github.com/ostreedev/ostree-rs-ext/pull/505/commits/389a6184883136752a7ff08013b70c929b4df9db
+# BUT see also above Source1
+Patch0: 0001-main-Update-ostree-ext-add-provisional-repair-entryp.patch
 
 ExclusiveArch: %{rust_arches}
 
 BuildRequires: make
-%if 0%{?rhel} && !0%{?eln}
-BuildRequires: rust-toolset
-%else
 BuildRequires: rust-packaging
 BuildRequires: cargo
 BuildRequires: rust
-%endif
 
 # Enable ASAN + UBSAN
 %bcond_with sanitizers
@@ -161,6 +167,7 @@ The %{name}-devel package includes the header files for %{name}-libs.
 
 %prep
 %autosetup -Sgit -n %{name}-%{version}
+tar xvf %{SOURCE1}
 %if 0%{?__isa_bits} == 32
 sed -ie 's,^lto = true,lto = false,' Cargo.toml
 %endif
@@ -241,6 +248,10 @@ $PYTHON autofiles.py > files.devel \
 %files devel -f files.devel
 
 %changelog
+* Fri Jul 21 2023 Colin Walters <walters@verbum.org> - 2023.5-2
+- Backport https://github.com/coreos/rpm-ostree/pull/4510
+  Related: rhbz#2224081
+
 * Thu Jun 22 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.5-1
 - https://github.com/coreos/rpm-ostree/releases/tag/v2023.5
   Resolves: rhbz#2216811
diff --git a/sources b/sources
index 99b2e87..5745858 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rpm-ostree-2023.5.tar.xz) = 3b37fad7ab51b2371fb982b74559f9d5dd5dd09891bd779d828f93ab1f319374445b333c70cf7057605594a296d366aae5b4bf5bbb2081c49d463e7b76ced723
+SHA512 (ostree-ext.vendor.tar.gz) = 690fb58edb02fb7268b27d3e18be3174ba13660b0f3a025ce381b1aeb661389f25d5d30050b89b063266aa7c1c8b0589d763dff2162fabdb87d4ebaee2c066df