diff --git a/selinux-policy.spec b/selinux-policy.spec
index b0d9cac0..0e2db7a7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit 314824e712082037c78523ac083298d881b4deb2
+%global commit 0e5ae1efcd03e355ed2ca413f89a20682c1e25d7
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.1.24
+Version: 38.1.25
 Release: 1%{?dist}
 License: GPLv2+
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -809,6 +809,18 @@ exit 0
 %endif
 
 %changelog
+* Fri Oct 20 2023 Zdenek Pytela <zpytela@redhat.com> - 38.1.25-1
+- Add map_read map_write to kernel_prog_run_bpf
+Resolves: RHEL-2653
+- Allow sysadm_t read nsfs files
+Resolves: RHEL-5146
+- Dontaudit keepalived setattr on keepalived_unconfined_script_exec_t
+Resolves: RHEL-14029
+- Allow system_mail_t manage exim spool files and dirs
+Resolves: RHEL-14110
+- Label /run/pcsd.socket with cluster_var_run_t
+Resolves: RHEL-1664
+
 * Fri Sep 29 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.24-1
 - Allow cupsd_t to use bpf capability
 Resolves: RHEL-3633
diff --git a/sources b/sources
index abd25a03..728bd039 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-314824e.tar.gz) = b3fd388bf22eababe1af6968e04504d127d0f099dda2991a2f6cdd99d5ba79dfcfed9e42c9ffd9261be484635dc587c863758c95d05d70721f5eb1099bbaa17e
-SHA512 (container-selinux.tgz) = a35b4c8710f87119271433b47dd859e9e731a716d73003d537b0defd395d57c7342c2630ad2aab2623bcd12134f20638c4d36c2f13c4c024fc137285f0154f41
+SHA512 (selinux-policy-0e5ae1e.tar.gz) = 21bbea2aa2d9f416df4773699657b948937b21bbe0ea111e3db9fcfacbf382314239bf80ea7fd1f2731749924d81a3ef159ed3afd7b260d12d13d5c5f3e4ed50
+SHA512 (container-selinux.tgz) = 919adbea22528a329c8a0c4568abffcf561c413c2c603952f924b71c822a6060254a824d3a916f0d6901d2ac96ca4d2f27b8f8910dc0f5859ee63cb5ecc1027d
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4