diff --git a/modules-targeted-contrib.conf b/modules-targeted-contrib.conf
index 1a35591..367f29d 100644
--- a/modules-targeted-contrib.conf
+++ b/modules-targeted-contrib.conf
@@ -2705,3 +2705,10 @@ mptcpd = module
 # rshim
 #
 rshim = module
+
+# Layer: contrib
+# Module: keyutils
+#
+# keyutils
+#
+keyutils = module
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 7631604..acbd370 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit 98619aa5ab8e1adf058c1d17c562750d2e7a1e36
+%global commit fe62ff64ca224f40cffb1ebe12e282a6d101e2b9
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.6
+Version: 38.7
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -813,6 +813,18 @@ exit 0
 %endif
 
 %changelog
+* Wed Feb 08 2023 Zdenek Pytela <zpytela@redhat.com> - 38.7-1
+- Allowing snapper to create snapshots of /home/ subvolume/partition
+- Add boolean qemu-ga to run unconfined script
+- Label systemd-journald feature LogNamespace
+- Add none file context for polyinstantiated tmp dirs
+- Allow certmonger read the contents of the sysfs filesystem
+- Add journalctl the sys_resource capability
+- Allow nm-dispatcher plugins read generic files in /proc
+- Add initial policy for the /usr/sbin/request-key helper
+- Additional support for rpmdb_migrate
+- Add the keyutils module
+
 * Mon Jan 30 2023 Zdenek Pytela <zpytela@redhat.com> - 38.6-1
 - Boolean: allow qemu-ga read ssh home directory
 - Allow kernel_t to read/write all sockets
diff --git a/sources b/sources
index 9dfc111..155b3ed 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-98619aa.tar.gz) = b91450b42adae2c9c71e5652a3830abf7fccf4adf32a9895a02563ef792e72d36a68b15bb2a7bc60b8b0ff5ff69683fd2601d89f3a557b1e6f3a301d702e90bd
-SHA512 (container-selinux.tgz) = 84ffa946d6e1a86bc1d67de3ec1815265ad27402ec90fac378bcaa511bc326ad7ba2623c5d80702d3a1bd3d3bb8fc4c231fd757a138b894a265901e030aca871
+SHA512 (selinux-policy-fe62ff6.tar.gz) = 175f8fdb9954b032dbb24668b3df77a423bd49b26b502b547e2a11dcb85999a14249a2cb9222aab641d07eb1532bcb8984565fb5232b519f46c176aff34865ff
+SHA512 (container-selinux.tgz) = 54093a9a8a524e13388ecfc55679121fe18a3588c655fb7d326b226a21ae0b6dbc1aa9cb5ad10ab6149bd88326b2312c3522d22f41c8be151b68ab9a08d31bbe
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4