diff --git a/.cockpit.metadata b/.cockpit.metadata
index 588644d..ef64377 100644
--- a/.cockpit.metadata
+++ b/.cockpit.metadata
@@ -1 +1,2 @@
-0d08a508099e681e36498a91a812459bddf22c18 SOURCES/cockpit-264.2.tar.xz
+850f91c2ee0d90d94c0c013c75c24f49eed5782d SOURCES/cockpit-276.1.tar.xz
+a37e1d6ad4b1b25729682c54ab7e4dcdcfd894a7 SOURCES/cockpit.css.gz
diff --git a/.gitignore b/.gitignore
index f0f86df..dcf3a41 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-SOURCES/cockpit-264.2.tar.xz
+SOURCES/cockpit-276.1.tar.xz
+SOURCES/cockpit.css.gz
diff --git a/SPECS/cockpit.spec b/SPECS/cockpit.spec
index d6f3f89..922c8c1 100644
--- a/SPECS/cockpit.spec
+++ b/SPECS/cockpit.spec
@@ -1,6 +1,3 @@
-# This spec file has been automatically updated
-Version:        264.2
-Release: 1%{?dist}
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
 #
@@ -27,9 +24,9 @@ Release: 1%{?dist}
 # Check first cockpit-devel@lists.fedorahosted.org
 #
 
-# earliest base that the subpackages work on; the instances of this get computed/updated
-# by tools/gen-spec-dependencies during "make dist", but keep a hardcoded fallback
-%define required_base 122
+# earliest base that the subpackages work on; this is still required as long as
+# we maintain the basic/optional split, then it can be replaced with just %{version}.
+%define required_base 266
 
 # we generally want CentOS packages to be like RHEL; special cases need to check %{centos} explicitly
 %if 0%{?centos}
@@ -52,15 +49,17 @@ Summary:        Web Console for Linux servers
 License:        LGPLv2+
 URL:            https://cockpit-project.org/
 
-Source0:        https://github.com/cockpit-project/cockpit/releases/download/264.2/cockpit-264.2.tar.xz
+Version:        276.1
+Release:        1%{?dist}
+Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
+Source1:        cockpit.css.gz
 
 # in RHEL 8 the source package is duplicated: cockpit (building basic packages like cockpit-{bridge,system})
 # and cockpit-appstream (building optional packages like cockpit-{pcp})
-# This split does not apply to EPEL/COPR.
+# This split does not apply to EPEL/COPR nor packit c8s builds, only to our own
+# image-prepare rhel-8-Y builds (which will disable build_all).
 # In Fedora ELN/RHEL 9+ there is just one source package, which ships rpms in both BaseOS and AppStream
-# We also provide an override mechanism if you want to build all packages.
-%define build_all 0
-%if 0%{?rhel} == 8 && 0%{?epel} == 0 && !%{build_all}
+%if 0%{?rhel} == 8 && 0%{?epel} == 0 && !0%{?build_all}
 
 %if "%{name}" == "cockpit"
 %define build_basic 1
@@ -90,7 +89,13 @@ BuildRequires: pam-devel
 BuildRequires: autoconf automake
 BuildRequires: make
 BuildRequires: /usr/bin/python3
+%if 0%{?rhel} && 0%{?rhel} <= 8
+# RHEL 8's gettext does not yet have metainfo.its
 BuildRequires: gettext >= 0.19.7
+BuildRequires: libappstream-glib-devel
+%else
+BuildRequires: gettext >= 0.21
+%endif
 %if 0%{?build_basic}
 BuildRequires: libssh-devel >= 0.8.5
 %endif
@@ -145,7 +150,7 @@ Recommends: (cockpit-networkmanager if NetworkManager)
 Suggests: cockpit-selinux
 %endif
 %if 0%{?rhel} && 0%{?centos} == 0
-Recommends: subscription-manager-cockpit
+Requires: subscription-manager-cockpit
 %endif
 
 %prep
@@ -167,20 +172,7 @@ Recommends: subscription-manager-cockpit
 %make_build
 
 %check
-exec 2>&1
-# HACK: Fedora koji builders are very slow, unreliable, and inaccessible for debugging; https://github.com/cockpit-project/cockpit/issues/13909
-%if 0%{?fedora} >= 0
-%ifarch s390x
-%define testsuite_fail || true
-%endif
-%endif
-# HACK: RHEL i686 builders hang after running all tests; not a supported architecture, so don't bother
-%if 0%{?rhel} >= 8
-%ifarch i686
-%define testsuite_skip #
-%endif
-%endif
-%{?testsuite_skip} make -j4 check %{?testsuite_fail}
+make -j$(nproc) check
 
 %install
 %make_install
@@ -190,16 +182,14 @@ install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
 rm -f %{buildroot}/%{_libdir}/cockpit/*.so
 install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 
-# only ship deprecated PatternFly API for stable releases
-%if 0%{?rhel} <= 8
-    ln -s cockpit.css.gz %{buildroot}/%{_datadir}/cockpit/base1/patternfly.css.gz
-%endif
+# RHEL 8 specific backwards compat API
+install -m 644 %{SOURCE1} %{buildroot}%{_datadir}/cockpit/base1/
+ln -s cockpit.css.gz %{buildroot}%{_datadir}/cockpit/base1/patternfly.css.gz
 
 # Build the package lists for resource packages
 # cockpit-bridge is the basic dependency for all cockpit-* packages, so centrally own the page directory
 echo '%dir %{_datadir}/cockpit' > base.list
 echo '%dir %{_datadir}/cockpit/base1' >> base.list
-echo '%dir %{_datadir}/cockpit/base1/fonts' >> base.list
 find %{buildroot}%{_datadir}/cockpit/base1 -type f -o -type l >> base.list
 echo '%{_sysconfdir}/cockpit/machines.d' >> base.list
 echo %{buildroot}%{_datadir}/polkit-1/actions/org.cockpit-project.cockpit-bridge.policy >> base.list
@@ -259,7 +249,7 @@ for pkg in base1 branding motd kdump networkmanager selinux shell sosreport ssh 
     rm -r %{buildroot}/%{_datadir}/cockpit/$pkg
     rm -f %{buildroot}/%{_datadir}/metainfo/org.cockpit-project.cockpit-${pkg}.metainfo.xml
 done
-for data in doc locale man pixmaps polkit-1; do
+for data in doc man pixmaps polkit-1; do
     rm -r %{buildroot}/%{_datadir}/$data
 done
 for lib in systemd tmpfiles.d; do
@@ -289,13 +279,7 @@ rm -f %{buildroot}/%{_prefix}/share/metainfo/org.cockpit-project.cockpit-storage
 
 sed -i "s|%{buildroot}||" *.list
 
-%if 0%{?suse_version}
-# remove brandings with stale symlinks. Means they don't match
-# the distro.
-pushd %{buildroot}/%{_datadir}/cockpit/branding
-find -L * -type l -printf "%H\n" | sort -u | xargs rm -rv
-popd
-%else
+%if ! 0%{?suse_version}
 %global _debugsource_packages 1
 %global _debuginfo_subpackages 0
 
@@ -314,10 +298,6 @@ rm -f %{buildroot}%{_datadir}/metainfo/org.cockpit-project.cockpit-selinux.metai
 rm -f %{buildroot}%{_datadir}/pixmaps/cockpit-sosreport.png
 %endif
 
-%if 0%{?build_basic}
-%find_lang cockpit
-%endif
-
 # -------------------------------------------------------------------------------
 # Basic Sub-packages
 
@@ -393,23 +373,21 @@ Provides: cockpit-tuned = %{version}-%{release}
 Provides: cockpit-users = %{version}-%{release}
 Obsoletes: cockpit-dashboard < %{version}-%{release}
 %if 0%{?rhel}
-Provides: cockpit-networkmanager = %{version}-%{release}
 Requires: NetworkManager >= 1.6
-Provides: cockpit-kdump = %{version}-%{release}
 Requires: kexec-tools
-Recommends: (sudo or polkit)
+Requires: sos
+Requires: sudo
 Recommends: PackageKit
-Recommends: NetworkManager-team
 Recommends: setroubleshoot-server >= 3.3.3
+Suggests: NetworkManager-team
+Provides: cockpit-kdump = %{version}-%{release}
+Provides: cockpit-networkmanager = %{version}-%{release}
 Provides: cockpit-selinux = %{version}-%{release}
 Provides: cockpit-sosreport = %{version}-%{release}
-Requires: sos
 %endif
 %if 0%{?fedora}
 Recommends: (reportd if abrt)
 %endif
-# NPM modules which are also available as packages
-Provides: bundled(xstatic-patternfly-common) = 3.59.5
 
 %description system
 This package contains the Cockpit shell and system configuration interfaces.
@@ -440,7 +418,7 @@ The Cockpit Web Service listens on the network, and authenticates users.
 If sssd-dbus is installed, you can enable client certificate/smart card
 authentication via sssd/FreeIPA.
 
-%files ws -f cockpit.lang -f static.list
+%files ws -f static.list
 %doc %{_mandir}/man1/cockpit-desktop.1.gz
 %doc %{_mandir}/man5/cockpit.conf.5.gz
 %doc %{_mandir}/man8/cockpit-ws.8.gz
@@ -536,8 +514,8 @@ fi
 
 %package kdump
 Summary: Cockpit user interface for kernel crash dumping
-Requires: cockpit-bridge >= 122
-Requires: cockpit-shell >= 122
+Requires: cockpit-bridge >= %{required_base}
+Requires: cockpit-shell >= %{required_base}
 Requires: kexec-tools
 BuildArch: noarch
 
@@ -549,8 +527,8 @@ The Cockpit component for configuring kernel crash dumping.
 
 %package sosreport
 Summary: Cockpit user interface for diagnostic reports
-Requires: cockpit-bridge >= 122
-Requires: cockpit-shell >= 122
+Requires: cockpit-bridge >= %{required_base}
+Requires: cockpit-shell >= %{required_base}
 Requires: sos
 BuildArch: noarch
 
@@ -564,8 +542,8 @@ sosreport tool.
 
 %package networkmanager
 Summary: Cockpit user interface for networking, using NetworkManager
-Requires: cockpit-bridge >= 186
-Requires: cockpit-shell >= 186
+Requires: cockpit-bridge >= %{required_base}
+Requires: cockpit-shell >= %{required_base}
 Requires: NetworkManager >= 1.6
 # Optional components
 Recommends: NetworkManager-team
@@ -582,8 +560,8 @@ The Cockpit component for managing networking.  This package uses NetworkManager
 
 %package selinux
 Summary: Cockpit SELinux package
-Requires: cockpit-bridge >= 122
-Requires: cockpit-shell >= 122
+Requires: cockpit-bridge >= %{required_base}
+Requires: cockpit-shell >= %{required_base}
 Requires: setroubleshoot-server >= 3.3.3
 BuildArch: noarch
 
@@ -613,10 +591,10 @@ Dummy package from building optional packages only; never install or publish me.
 
 %package -n cockpit-storaged
 Summary: Cockpit user interface for storage, using udisks
-Requires: cockpit-shell >= 186
-Requires: udisks2 >= 2.6
-Recommends: udisks2-lvm2 >= 2.6
-Recommends: udisks2-iscsi >= 2.6
+Requires: cockpit-shell >= %{required_base}
+Requires: udisks2 >= 2.9
+Recommends: udisks2-lvm2 >= 2.9
+Recommends: udisks2-iscsi >= 2.9
 Recommends: device-mapper-multipath
 Recommends: clevis-luks
 Requires: %{__python3}
@@ -650,7 +628,7 @@ These files are not required for running Cockpit.
 
 %package -n cockpit-pcp
 Summary: Cockpit PCP integration
-Requires: cockpit-bridge >= 238.1.1
+Requires: cockpit-bridge >= %{required_base}
 Requires: pcp
 
 %description -n cockpit-pcp
@@ -666,7 +644,7 @@ systemctl reload-or-try-restart pmlogger
 %package -n cockpit-packagekit
 Summary: Cockpit user interface for packages
 BuildArch: noarch
-Requires: cockpit-bridge >= 186
+Requires: cockpit-bridge >= %{required_base}
 Requires: PackageKit
 Recommends: python3-tracer
 # HACK: https://bugzilla.redhat.com/show_bug.cgi?id=1800468
@@ -683,13 +661,45 @@ via PackageKit.
 
 # The changelog is automatically generated and merged
 %changelog
-* Fri Sep 23 2022 Martin Pitt <mpitt@redhat.com> - 264.2-1
-- login: Use valid selectors when testing for :is() / :where() support (rhbz#2129055)
-- Don't run sudo without explicit request (rhbz#2129058)
-
-* Thu Mar 03 2022 Martin Pitt <mpitt@redhat.com> - 264.1-1
-- metrics: Fix link construction for user services
-- Translation updates (rhbz#2016998)
+* Thu Sep 15 2022 Martin Pitt <mpitt@redhat.com> - 276.1-1
+- login: Use valid selectors when testing for :is() / :where() support (rhbz#2126044)
+
+* Mon Sep 12 2022 Martin Pitt <mpitt@redhat.com> - 276-1
+- Translation updates (rhbz#2062692)
+
+* Thu Aug 25 2022 Matej Marusak <mmarusak@redhat.com> - 275-1
+- shell: Support for alternatives to sudo (rhbz#2091034)
+
+* Thu Jul 21 2022 Martin Pitt <mpitt@redhat.com> - 273-2
+- Re-disable BaseOS package builds
+
+* Thu Jul 21 2022 Martin Pitt <mpitt@redhat.com> - 273-1
+ - Metrics: Display CPU temperature
+ - Networking: Suggest netmask and gateway addresses
+ - Software Updates: Optionally reboot after updating
+ - cockpit/ws container: Support modern SSH keys
+
+* Wed Jun 29 2022 Martin Pitt <mpitt@redhat.com> - 272-2
+  - No-change rebuild due to brew confusion
+
+* Thu Jun 23 2022 Matej Marusak <mmarusak@redhat.com> - 272-1
+ - Firewall: Edit custom services
+ - Services: Pin services as favorites
+ - Login: Dark mode
+
+* Wed May 25 2022 Martin Pitt <mpitt@redhat.com> - 270-1
+ - Services: User-created timer deletion
+ - System Diagnostics: Working with diagnostic reports has been improved
+
+* Mon May 16 2022 Matej Marusak <mmarusak@redhat.com> - 269-1
+ - Kdump: Show journal when service fails (rhbz#2062297)
+ - Parse /proc/cpuinfo on s390x (rhbz#2069552)
+ - bridge: Default "init-superuser" to "none" (rhbz#2071938)
+ - Animate new rows in lists
+ - Crypto policies support
+ - Metrics: Show busiest CPU core
+ - Metrics: Show Podman containers in top CPU and memory lists
+ - Standardize on SI-based units for data sizes and rates
 
 * Fri Feb 25 2022 Martin Pitt <mpitt@redhat.com> - 264-1
  - Metrics: Improve layout on small resolutions
@@ -706,7 +716,7 @@ via PackageKit.
 * Tue Jan 25 2022 Matej Marusak <mmarusak@redhat.com> - 261-1
 - shell: Allow adding keys with passphrase
 
-* Fri Jan 04 2022 Martin Pitt <mpitt@redhat.com> - 260-1
+* Tue Jan 04 2022 Martin Pitt <mpitt@redhat.com> - 260-1
 - Certificate login validation (rhbz#1992620, CVE-2021-3698)
 - Client: Show previously used hosts
 - Client: Support port specification
@@ -751,7 +761,7 @@ via PackageKit.
 - Polish of the Services page
 - Updated translations
 
-* Mon May 12 2021 Katerina Koukiou <kkoukiou@redhat.com> - 244.1-1
+* Wed May 12 2021 Katerina Koukiou <kkoukiou@redhat.com> - 244.1-1
 - Shell: sudo is invoked only when explicitly requested
 - Dynamically manage motd/issue symlinks in package scripts (rhbz#1876848)