diff --git a/SPECS/systemtap.spec b/SPECS/systemtap.spec
index 3db2b67..166092d 100644
--- a/SPECS/systemtap.spec
+++ b/SPECS/systemtap.spec
@@ -77,7 +77,7 @@
 
 Name: %{?scl_prefix}systemtap
 Version: 4.1
-Release: 7%{?dist}
+Release: 9%{?dist}
 # for version, see also configure.ac
 
 
@@ -824,6 +824,8 @@ test -e %{_localstatedir}/log/stap-server/log || {
 %else
     /sbin/chkconfig --add %{?scl_prefix}stap-server
 %endif
+
+restorecon -R %{_scl_root}  # rhbz1570639, rhbz1694939
 exit 0
 
 %triggerin client -- systemtap-server
@@ -1232,6 +1234,12 @@ done
 
 # PRERELEASE
 %changelog
+* Tue Mar 10 2020 Frank Ch. Eigler <fche@redhat.com> - 4.1-9
+- bz1570639: run restorecon -R more broadly.
+
+* Fri Jan 24 2020 Stan Cox <scox@redhat.com> - 4.1-8
+- bz1694939: devtoolset-8-systemtap-server AVC
+
 * Tue Oct 22 2019 Frank Ch. Eigler <fche@redhat.com> - 4.1-7
 - bz1763156, bz1763157: disable dyninst builds on all but x86-64