diff --git a/.gitignore b/.gitignore
index 979b7e9..83978f5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -125,3 +125,4 @@
 /rpm-ostree-2023.12.tar.xz
 /rpm-ostree-2024.1.tar.xz
 /rpm-ostree-2024.2.tar.xz
+/rpm-ostree-2024.3.tar.xz
diff --git a/0001-cliwrap-rpm-mark-eval-E-as-safe.patch b/0001-cliwrap-rpm-mark-eval-E-as-safe.patch
new file mode 100644
index 0000000..ae137d0
--- /dev/null
+++ b/0001-cliwrap-rpm-mark-eval-E-as-safe.patch
@@ -0,0 +1,56 @@
+From d02993e30078db2a04820065ccbf22bd56d0d064 Mon Sep 17 00:00:00 2001
+From: Jonathan Lebon <jonathan@jlebon.com>
+Date: Thu, 22 Feb 2024 14:44:50 -0500
+Subject: [PATCH] cliwrap/rpm: mark `--eval`/`-E` as safe
+
+This is sometimes used in scripts to query aspects of the host system.
+E.g. this is used by Fedora's pkg-config:
+
+https://src.fedoraproject.org/rpms/pkgconf/blob/95c0bbee/f/pkg-config.in#_6
+
+This in turn gets hit by kdump which runs dracut which has modules that
+runs `pkgconf` to query some directory paths.
+---
+ rust/src/cliwrap/rpm.rs | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/rust/src/cliwrap/rpm.rs b/rust/src/cliwrap/rpm.rs
+index c6ed5901..3332f76c 100644
+--- a/rust/src/cliwrap/rpm.rs
++++ b/rust/src/cliwrap/rpm.rs
+@@ -19,6 +19,12 @@ fn new_rpm_app() -> Command {
+                 .long("version")
+                 .action(clap::ArgAction::Version),
+         )
++        .arg(
++            Arg::new("eval")
++                .long("eval")
++                .short('E')
++                .action(clap::ArgAction::Set),
++        )
+         .arg(
+             Arg::new("package")
+                 .help("package")
+@@ -130,6 +136,19 @@ mod tests {
+         Ok(())
+     }
+ 
++    #[test]
++    fn test_eval() -> Result<()> {
++        assert_eq!(
++            disposition(SystemHostType::OstreeHost, &["-E", "%{_target_cpu}"])?,
++            RunDisposition::Ok
++        );
++        assert_eq!(
++            disposition(SystemHostType::OstreeHost, &["--eval=%{_target_cpu}}"])?,
++            RunDisposition::Ok
++        );
++        Ok(())
++    }
++
+     #[test]
+     fn test_query_file() -> Result<()> {
+         assert_eq!(
+-- 
+2.43.2
+
diff --git a/rpm-ostree.spec b/rpm-ostree.spec
index a0fa6c2..516dc3d 100644
--- a/rpm-ostree.spec
+++ b/rpm-ostree.spec
@@ -3,7 +3,7 @@
 
 Summary: Hybrid image/package system
 Name: rpm-ostree
-Version: 2024.2
+Version: 2024.3
 Release: 1%{?dist}
 License: LGPLv2+
 URL: https://github.com/coreos/rpm-ostree
@@ -11,6 +11,8 @@ URL: https://github.com/coreos/rpm-ostree
 # in the upstream git.  It also contains vendored Rust sources.
 Source0: https://github.com/coreos/rpm-ostree/releases/download/v%{version}/rpm-ostree-%{version}.tar.xz
 
+Patch0: 0001-cliwrap-rpm-mark-eval-E-as-safe.patch
+
 ExclusiveArch: %{rust_arches}
 
 BuildRequires: make
@@ -237,6 +239,11 @@ $PYTHON autofiles.py > files.devel \
 %files devel -f files.devel
 
 %changelog
+* Sun Feb 25 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.3-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2024.3
+  Backport https://github.com/coreos/rpm-ostree/commit/fe586621e5014d14f92b913338171a02ed29e6cc
+  Resolves: #RHEL-26186
+
 * Wed Jan 24 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.2-1
 - https://github.com/coreos/rpm-ostree/releases/tag/v2024.2
   Resolves: #RHEL-11294
diff --git a/sources b/sources
index 142ee7f..d5f9c64 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rpm-ostree-2024.2.tar.xz) = 7ba2d5679444e91ab5efb093c831b1ac035e9609a4a2bb3d24a50d0b67db8712f42cf6b9e0c8e43b33fcc22e7c3c243ce65b667c3fd419a69da48404ec29a110
+SHA512 (rpm-ostree-2024.3.tar.xz) = 6ec05ab6145a761d8d77fc28a59e88413db3693075ece4364717a6cc751b805c6b7f00a1798f2945a83bfca3309558f55dabb4efa391aacecd0deaedca9fa718