diff --git a/.cockpit.metadata b/.cockpit.metadata
index c311b8b..080de3a 100644
--- a/.cockpit.metadata
+++ b/.cockpit.metadata
@@ -1 +1 @@
-f4e6636c4cfcfb9377b57ba2bd92424952e1f5cb SOURCES/cockpit-247.tar.xz
+9f554fc9f93250b05d8761af453bac98d67f6451 SOURCES/cockpit-248.tar.xz
diff --git a/.gitignore b/.gitignore
index 7540220..68849fe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/cockpit-247.tar.xz
+SOURCES/cockpit-248.tar.xz
diff --git a/SPECS/cockpit.spec b/SPECS/cockpit.spec
index f78e09c..defd34c 100644
--- a/SPECS/cockpit.spec
+++ b/SPECS/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        247
+Version:        248
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -19,7 +19,7 @@ Release: 1%{?dist}
 #
 
 # This file is maintained at the following location:
-# https://github.com/cockpit-project/cockpit/blob/master/tools/cockpit.spec
+# https://github.com/cockpit-project/cockpit/blob/main/tools/cockpit.spec
 #
 # If you are editing this file in another location, changes will likely
 # be clobbered the next time an automated release is done.
@@ -471,7 +471,6 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man8/cockpit-ws.8.gz
 %doc %{_mandir}/man8/cockpit-tls.8.gz
 %doc %{_mandir}/man8/remotectl.8.gz
-%doc %{_mandir}/man8/pam_cockpit_cert.8.gz
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
@@ -546,6 +545,14 @@ fi
 # firewalld only partially picks up changes to its services files without this
 test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
 
+# check for deprecated PAM config
+if grep --color=auto pam_cockpit_cert {_sysconfdir}/pam.d/cockpit; then
+    echo '**** WARNING:'
+    echo '**** WARNING: pam_cockpit_cert is a no-op and will be removed in a'
+    echo '**** WARNING: future release; remove it from your /etc/pam.d/cockpit.'
+    echo '**** WARNING:'
+fi
+
 %preun ws
 %systemd_preun cockpit.socket cockpit.service
 
@@ -680,7 +687,7 @@ These files are not required for running Cockpit.
 %package -n cockpit-pcp
 Summary: Cockpit PCP integration
 Requires: cockpit-bridge >= 238.1.1
-Requires(post): pcp
+Requires: pcp
 
 %description -n cockpit-pcp
 Cockpit support for reading PCP metrics and loading PCP archives.
@@ -712,6 +719,10 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
+* Thu Jul 08 2021 Martin Pitt <mpitt@redhat.com> - 248-1
+- Metrics: Install missing packages
+- PAM: Deprecate pam_cockpit_cert module
+
 * Wed Jun 23 2021 Katerina Koukiou <kkoukiou@redhat.com> - 247-1
 - Metrics: Enable Grafana client setup