diff --git a/samba.spec b/samba.spec
index 5f15124..d0e4218 100644
--- a/samba.spec
+++ b/samba.spec
@@ -139,7 +139,7 @@
 %endif
 
 %if 0%{?fedora} || 0%{?rhel} >= 9
-%bcond_without gpupdate
+%bcond_with gpupdate
 %else
 %bcond_with gpupdate
 %endif
@@ -147,7 +147,7 @@
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
 %global samba_version 4.19.4
-%global baserelease 102
+%global baserelease 103
 # This should be rc1 or %%nil
 %global pre_release %nil
 
@@ -4473,6 +4473,9 @@ fi
 %endif
 
 %changelog
+* Mon Feb 19 2024 Andreas Schneider <asn@redhat.com> - 4.19.5-103
+- related: RHEL-2109 - Disable support for certificate auto enrollment
+
 * Tue Jan 30 2024 Andreas Schneider <asn@redhat.com> - 4.19.4-102
 - resolves: RHEL-22157 - Don't require NDES for samba-gpupdate
 - resolves: RHEL-20897 - Fix site name fetching for samba-gpupdate