diff --git a/.cockpit-appstream.metadata b/.cockpit-appstream.metadata
index 095c874..faee019 100644
--- a/.cockpit-appstream.metadata
+++ b/.cockpit-appstream.metadata
@@ -1,2 +1,2 @@
-0cad29037cb9fd7c87ceb09f89acbc210e9f884e SOURCES/cockpit-255.tar.xz
-dbacb61398e16f1434c69bad73a19a0dca27c89d SOURCES/cockpit-machines-254.tar.xz
+cb512e9b1bf87e415d07ae6d1b2d2c267c4b6df1 SOURCES/cockpit-259.tar.xz
+3cc9fa3f1fa4a0f637c0bc37949b17402741914d SOURCES/cockpit-machines-258.1.tar.xz
diff --git a/.gitignore b/.gitignore
index 88b751c..dbc04a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/cockpit-255.tar.xz
-SOURCES/cockpit-machines-254.tar.xz
+SOURCES/cockpit-259.tar.xz
+SOURCES/cockpit-machines-258.1.tar.xz
diff --git a/SPECS/cockpit-appstream.spec b/SPECS/cockpit-appstream.spec
index 2fb7be7..830163d 100644
--- a/SPECS/cockpit-appstream.spec
+++ b/SPECS/cockpit-appstream.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        255
+Version:        259
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -35,7 +35,7 @@ Release: 1%{?dist}
 # by tools/gen-spec-dependencies during "make dist", but keep a hardcoded fallback
 %define required_base 122
 
-%define machines_version 254
+%define machines_version 258.1
 
 # we generally want CentOS packages to be like RHEL; special cases need to check %{centos} explicitly
 %if 0%{?centos}
@@ -84,8 +84,8 @@ Source1:        https://github.com/cockpit-project/cockpit-machines/releases/dow
 %define build_optional 1
 %endif
 
-# Ship custom SELinux policy only in Fedora and RHEL-9 onward
-%if 0%{?rhel} >= 9 || 0%{?fedora}
+# Ship custom SELinux policy (but not for cockpit-appstream)
+%if "%{name}" == "cockpit"
 %define selinuxtype targeted
 %define with_selinux 1
 %define selinux_policy_version %(rpm --quiet -q selinux-policy && rpm -q --queryformat "%{V}-%{R}" selinux-policy || echo 1)
@@ -297,7 +297,7 @@ done
 for lib in systemd tmpfiles.d; do
     rm -r %{buildroot}/%{_prefix}/%{__lib}/$lib
 done
-for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
+for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-wsinstance-factory cockpit-client cockpit-client.ui cockpit-desktop cockpit-certificate-helper cockpit-certificate-ensure; do
     rm %{buildroot}/%{_libexecdir}/$libexec
 done
 rm -r %{buildroot}/%{_libdir}/security %{buildroot}/%{_sysconfdir}/pam.d %{buildroot}/%{_sysconfdir}/motd.d %{buildroot}/%{_sysconfdir}/issue.d
@@ -441,7 +441,6 @@ Requires: sos
 Recommends: (reportd if abrt)
 %endif
 # NPM modules which are also available as packages
-Provides: bundled(js-jquery) = 3.5.1
 Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
@@ -463,6 +462,11 @@ Conflicts: firewalld < 0.6.0-1
 Recommends: sscg >= 2.3
 Recommends: system-logos
 Suggests: sssd-dbus
+# for cockpit-desktop
+Suggests: python3
+
+# prevent hard python3 dependency for cockpit-desktop, it falls back to other browsers
+%global __requires_exclude_from ^%{_libexecdir}/cockpit-client$
 
 %description ws
 The Cockpit Web Service listens on the network, and authenticates users.
@@ -503,6 +507,8 @@ authentication via sssd/FreeIPA.
 %{_libexecdir}/cockpit-ws
 %{_libexecdir}/cockpit-wsinstance-factory
 %{_libexecdir}/cockpit-tls
+%{_libexecdir}/cockpit-client
+%{_libexecdir}/cockpit-client.ui
 %{_libexecdir}/cockpit-desktop
 %{_libexecdir}/cockpit-certificate-ensure
 %{_libexecdir}/cockpit-certificate-helper
@@ -530,7 +536,7 @@ fi
 
 %post ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -561,7 +567,7 @@ fi
 
 %postun ws
 %if 0%{?with_selinux}
-if %{_sbindir}/selinuxenabled 2>/dev/null; then
+if [ -x %{_sbindir}/selinuxenabled ]; then
     %selinux_modules_uninstall -s %{selinuxtype} %{name}
     %selinux_relabel_post -s %{selinuxtype}
 fi
@@ -747,6 +753,13 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Tue Dec 14 2021 Martin Pitt <mpitt@redhat.com> - 259-1
+- Use official VDO LVM API
+
+* Fri Nov 12 2021 Katerina Koukiou <kkoukiou@redhat.com> - 257-1
+- Machines: Now officially supported on Arch Linux (https://archlinux.org/)
+- Machines: Support selecting between consoles of the same type
+
 * Thu Oct 14 2021 Martin Pitt <mpitt@redhat.com> - 255-1
 - Machines: Parse supported disk bus types from domcapabities (rhbz#1862779)
 - Machines: Stop exposing unattended installation option for ISO installation