diff --git a/selinux-policy.spec b/selinux-policy.spec
index a419f08..41d5abd 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit 306088dc784022ef519542b1b0f9fc42e3ec2d8d
+%global commit 5fcfdfa3694ff9f045dfc069b6be9af9c7bfaaea
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.1.28
+Version: 38.1.29
 Release: 1%{?dist}
 License: GPLv2+
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -809,6 +809,26 @@ exit 0
 %endif
 
 %changelog
+* Thu Dec 14 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.29-1
+- Add init_explicit_domain() interface
+Resolves: RHEL-18219
+- Allow dovecot_auth_t connect to postgresql using UNIX socket
+Resolves: RHEL-16850
+- Allow keepalived_t to use sys_ptrace of cap_userns
+Resolves: RHEL-17156
+- Make `bootc` be `install_exec_t`
+Resolves: RHEL-19199
+- Add support for chronyd-restricted
+Resolves: RHEL-18219
+- Label /dev/vas with vas_device_t
+Resolves: RHEL-17336
+- Allow gpsd use /dev/gnss devices
+Resolves: RHEL-16676
+- Allow sendmail manage its runtime files
+Resolves: RHEL-15175
+- Add support for syslogd unconfined scripts
+Resolves: RHEL-11174
+
 * Thu Nov 30 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.28-1
 - Create interface selinux_watch_config and add it to SELinux users
 Resolves: RHEL-1555
diff --git a/sources b/sources
index 2067ee0..ad02de2 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-306088d.tar.gz) = 05bbbb2b5fc84d195d711ff4710db3c8c1ce6a7a8a77d8e24d02faf993c9d0f4ac9544e11ecf0fe45e051c25709810561f60f35d0643c6a3876a218ba4e558a0
-SHA512 (container-selinux.tgz) = 73503171e20bd8f9d9af1e988552b7962e97b91a4c9af7c8d02b7c2f5f275baee4ac6de8d1fef768ca3706bdff4161ef9525fb627e5be89d34a6f2cebc3bb502
+SHA512 (selinux-policy-5fcfdfa.tar.gz) = bd06aad9afede8341e952326f41dd82ed6117a5e5349698446482497795d7544a3d2f3f7c3af9e04f82c030ff991de8e0c70d4ebf498547053c4d0137b858fed
+SHA512 (container-selinux.tgz) = dd6a2013469cb4adc9177190dc62efa6f033238402cf54e002fa9b9d5ead80e5c775d8b3d6fa57e5e1c20586c28a7868868e1cf40cda4b1bbcaf1736f706f122
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4