diff --git a/selinux-policy.spec b/selinux-policy.spec
index 98744f7f..b8d25bd7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit ded2cf077576e3a3ab20263ff3b07b2a5b397ca1
+%global commit 2eb41b7bd9949fae4421e2590e4dda01c5b43fc5
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.27
+Version: 38.28
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -814,6 +814,16 @@ exit 0
 %endif
 
 %changelog
+* Fri Sep 15 2023 Zdenek Pytela <zpytela@redhat.com> - 38.28-1
+- Allow sssd domain transition on passkey_child execution conditionally
+- Allow login_userdomain watch lnk_files in /usr
+- Allow login_userdomain watch video4linux devices
+- Change systemd-network-generator transition to include class file
+- Revert "Change file transition for systemd-network-generator"
+- Allow nm-dispatcher winbind plugin read/write samba var files
+- Allow systemd-networkd write to cgroup files
+- Allow kdump create and use its memfd: objects
+
 * Thu Aug 31 2023 Zdenek Pytela <zpytela@redhat.com> - 38.27-1
 - Allow fedora-third-party get generic filesystem attributes
 - Allow sssd use usb devices conditionally
diff --git a/sources b/sources
index f92fec88..7e4a284a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-ded2cf0.tar.gz) = dcaeefca9f57a7751a02d6952adeb4d9a4112076b0a8b7200988e636ca0ed86782f3213d2e964796b5ea56e23fd7c2d86209fae1eb3c109fbcd54298418dc439
-SHA512 (container-selinux.tgz) = a2721dbe15dde3918bc299d355a279028911dee3d37192bf35ba70198fa69e60811f7c47302469cb6cf4084dfd2037b7bf08612678972661eff8e4cdcbd7956b
+SHA512 (selinux-policy-2eb41b7.tar.gz) = ff51f7794093670e0883e88f8464fe2915a2b44650a3d5443bdc2c124a95fd1406472b932adc685eafa688cc7aa5784fde6b568d05095a1741188e12725f11a1
+SHA512 (container-selinux.tgz) = 07de5e93d433eec7cc0030f0ea89c502add10013c258d60997eac3f5ffd4a080cbc9268273c1de38a6c2dcedbf24ddfd8aaa8cb7579e62a4c04c22135baf1e8f
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4