diff --git a/selinux-policy.spec b/selinux-policy.spec
index b28fc75..0aa41aa 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit 2cdf4e71dc3557b4a87b1430edffcddc82e5d835
+%global commit dc98c54983569572791d0237989110a29ed7faa4
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 40.15
+Version: 40.16
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -824,6 +824,21 @@ exit 0
 %endif
 
 %changelog
+* Tue Apr 09 2024 Zdenek Pytela <zpytela@redhat.com> - 40.16-1
+- Allow keyutils-dns-resolver connect to the system log service
+- Allow qemu-ga read vm sysctls
+- postfix: allow qmgr to delete mails in bounce/ directory
+- policy: support pidfs
+- Confine selinux-autorelabel-generator.sh
+- Allow logwatch_mail_t read/write to init over a unix stream socket
+- Allow logwatch read logind sessions files
+- files_dontaudit_getattr_tmpfs_files allowed the access and didn't dontaudit it
+- files_dontaudit_mounton_modules_object allowed the access and didn't dontaudit it
+- Allow NetworkManager the sys_ptrace capability in user namespace
+- dontaudit execmem for modemmanager
+- Allow dhcpcd use unix_stream_socket
+- Allow dhcpc read /run/netns files
+
 * Fri Mar 15 2024 Zdenek Pytela <zpytela@redhat.com> - 40.15-1
 - Update mmap_rw_file_perms to include the lock permission
 - Allow plymouthd log during shutdown
diff --git a/sources b/sources
index 0ff7dc2..147d8a9 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-2cdf4e7.tar.gz) = bdf76d0847301bcec2e86ffc78fc04e67fc9d59467f6f1d2cdb2fddded9c27252b070557f108e22d973321c9eb74a250d731ea5974bdf590bb95e78ddf9949cd
+SHA512 (selinux-policy-dc98c54.tar.gz) = b9f2b1d99e41fc4d72a519ce98209b498a26a8375317331253ea234bf98c62da20d9e74bdd14f4f14da0f9958e012802ca578b1e0a59e57932f505490c92bc20
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4
-SHA512 (container-selinux.tgz) = f9b2b8e299ed78453e84d480b17a00057f3dcbb70bf5397f99640b2addb785ef37cc663e20eaee1c6ab932b890eb96177677c8ffb61ee20993b1ec56f533b1d9
+SHA512 (container-selinux.tgz) = f6483571ea0a0291563c67f8bfbf45fc56ebe7a56486ce15fc24225ac8df22c8b75542967d46b9da43d4ff506142aaec2fa86ea19c90c07605c1b20fd210eb83