diff --git a/.gitignore b/.gitignore
index e3250282..aeec377d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -410,3 +410,4 @@ serefpolicy*
 /selinux-policy-d63d681.tar.gz
 /selinux-policy-aa4c070.tar.gz
 /selinux-policy-contrib-84cf0f5.tar.gz
+/selinux-policy-contrib-7c1c105.tar.gz
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 39bacda3..6b795a09 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -5,7 +5,7 @@
 
 # github repo with selinux-policy contrib sources
 %global git1 https://github.com/fedora-selinux/selinux-policy-contrib
-%global commit1 84cf0f5cf648b7ff7047af65ecee908d4293bfb0
+%global commit1 7c1c105c839013b090b342c05fe1d4c686e8426c
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
 %define distro redhat
@@ -29,7 +29,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.14.5
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPLv2+
 Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
 Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
@@ -787,6 +787,10 @@ exit 0
 %endif
 
 %changelog
+* Wed Oct 09 2019 Lukas Vrabec <lvrabec@redhat.com> - 3.14.5-8
+- Update apache and pkcs policies to make active opencryptoki rules
+- Allow ipa_ods_exporter_t domain to read krb5_keytab files BZ(1759884)
+
 * Wed Oct 09 2019 Lukas Vrabec <lvrabec@redhat.com> - 3.14.5-7
 - Revert "nova.fc: fix duplicated slash"
 - Introduce new bolean httpd_use_opencryptoki
diff --git a/sources b/sources
index 3568b1e8..ed065702 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
+SHA512 (selinux-policy-contrib-7c1c105.tar.gz) = 82b55f6af644d16c19d2bc5c5624b2e1f8e8cdd441207f376ce443c40c3d572892d33b594afa546c8f2a00032db4fdf1bee60bb64ac1936d03c1d6b783d60f3d
 SHA512 (selinux-policy-aa4c070.tar.gz) = d8ac4aa13531b2ddd30a3f1eddad3e77cdd5f955d0960b7d40e52e7bbd667428c2dd13be1b4b3559dcd6c36eec7e05d349b5de7141910f44e16233fba7a9ddb2
-SHA512 (selinux-policy-contrib-84cf0f5.tar.gz) = 3191ad0e26a25001bb25412ceb8987299421ece7fd8c14c1ffdcb4664d604abe1ca64dfb8a6eaec107fb9f8959fca4d24eb720ecf34cd9b7a545423cf5d52346
-SHA512 (container-selinux.tgz) = 9ea48fe013912947d06903e1dfbe61b4f8dfae932e2cd565533f07bd683d3f6c74f110c4236bff208839c201e07589c2cec3c08ae796c09eb0e7b5e25544fcb2
+SHA512 (container-selinux.tgz) = 22d31bb46183e98a4ca2c59c266edd6f963cc2463b344519312e435b14e828b95087956172f20fafe2918cf2d4e3580479ee34b80eafa6f0d6bcebead334f9a9
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4