diff --git a/.cockpit.metadata b/.cockpit.metadata
index 246eead..bd39068 100644
--- a/.cockpit.metadata
+++ b/.cockpit.metadata
@@ -1 +1 @@
-bc694f39e4dc50161bfb92b8ec768be9563717d7 SOURCES/cockpit-251.1.tar.xz
+0cad29037cb9fd7c87ceb09f89acbc210e9f884e SOURCES/cockpit-255.tar.xz
diff --git a/.gitignore b/.gitignore
index 11a2dcc..c0d21f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/cockpit-251.1.tar.xz
+SOURCES/cockpit-255.tar.xz
diff --git a/SPECS/cockpit.spec b/SPECS/cockpit.spec
index 4b3bd1f..c9043db 100644
--- a/SPECS/cockpit.spec
+++ b/SPECS/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:        251.1
+Version:        255
 Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
@@ -146,7 +146,7 @@ Requires: cockpit-system
 
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
-Recommends: cockpit-packagekit
+Recommends: (cockpit-packagekit if dnf)
 Suggests: cockpit-pcp
 
 %if 0%{?rhel} == 0
@@ -215,12 +215,14 @@ install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 %endif
 
 # only ship deprecated PatternFly API for stable releases
-%if 0%{?fedora} <= 33 || 0%{?rhel} <= 8
+%if 0%{?rhel} <= 8
     ln -s cockpit.css.gz %{buildroot}/%{_datadir}/cockpit/base1/patternfly.css.gz
 %endif
 
 # Build the package lists for resource packages
-echo '%dir %{_datadir}/cockpit/base1' > base.list
+# cockpit-bridge is the basic dependency for all cockpit-* packages, so centrally own the page directory
+echo '%dir %{_datadir}/cockpit' > base.list
+echo '%dir %{_datadir}/cockpit/base1' >> base.list
 echo '%dir %{_datadir}/cockpit/base1/fonts' >> base.list
 find %{buildroot}%{_datadir}/cockpit/base1 -type f -o -type l >> base.list
 echo '%{_sysconfdir}/cockpit/machines.d' >> base.list
@@ -291,7 +293,7 @@ for libexec in cockpit-askpass cockpit-session cockpit-ws cockpit-tls cockpit-ws
     rm %{buildroot}/%{_libexecdir}/$libexec
 done
 rm -r %{buildroot}/%{_libdir}/security %{buildroot}/%{_sysconfdir}/pam.d %{buildroot}/%{_sysconfdir}/motd.d %{buildroot}/%{_sysconfdir}/issue.d
-rm %{buildroot}/usr/bin/cockpit-bridge %{buildroot}/usr/sbin/remotectl
+rm %{buildroot}/usr/bin/cockpit-bridge
 rm -f %{buildroot}%{_libexecdir}/cockpit-ssh
 rm -f %{buildroot}%{_datadir}/metainfo/cockpit.appdata.xml
 %endif
@@ -356,7 +358,6 @@ troubleshooting, interactive command-line sessions, and more.
 %{_docdir}/cockpit/AUTHORS
 %{_docdir}/cockpit/COPYING
 %{_docdir}/cockpit/README.md
-%dir %{_datadir}/cockpit
 %{_datadir}/metainfo/cockpit.appdata.xml
 %{_datadir}/pixmaps/cockpit.png
 %doc %{_mandir}/man1/cockpit.1.gz
@@ -428,14 +429,11 @@ Provides: cockpit-selinux = %{version}-%{release}
 Provides: cockpit-sosreport = %{version}-%{release}
 Requires: sos
 %endif
-%if 0%{?fedora} >= 29
-# 0.7.0 (actually) supports task cancellation.
-# 0.7.1 fixes tasks never announcing completion.
-Recommends: (reportd >= 0.7.1 if abrt)
+%if 0%{?fedora}
+Recommends: (reportd if abrt)
 %endif
 # NPM modules which are also available as packages
 Provides: bundled(js-jquery) = 3.5.1
-Provides: bundled(xstatic-bootstrap-datepicker-common) = 1.9.0
 Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
@@ -469,7 +467,6 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man5/cockpit.conf.5.gz
 %doc %{_mandir}/man8/cockpit-ws.8.gz
 %doc %{_mandir}/man8/cockpit-tls.8.gz
-%doc %{_mandir}/man8/remotectl.8.gz
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
@@ -493,7 +490,6 @@ authentication via sssd/FreeIPA.
 %{_unitdir}/cockpit-wsinstance-https@.service
 %{_unitdir}/system-cockpithttps.slice
 %{_prefix}/%{__lib}/tmpfiles.d/cockpit-tempfiles.conf
-%{_sbindir}/remotectl
 %{pamdir}/pam_ssh_add.so
 %{pamdir}/pam_cockpit_cert.so
 %{_libexecdir}/cockpit-ws
@@ -718,8 +714,9 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
-* Thu Sep 09 2021 Martin Pitt <mpitt@redhat.com> - 251.1-1
-- Translation updates (rhbz#1961628)
+* Thu Oct 14 2021 Martin Pitt <mpitt@redhat.com> - 255-1
+- Restrict frame embedding to same origin (rhbz#1984902, CVE-2021-3660)
+- kdump: Show "Directory" field for NFS mounts (rbhz#2004041)
 
 * Wed Aug 18 2021 Matej Marusak <mmarusak@redhat.com> - 251-1
 - Logs: Fix layout and add new filtering options (rhbz#1980207)