diff --git a/selinux-policy.spec b/selinux-policy.spec
index 4e28e2c..43529a0 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit 10f97f8f911402735ec67cc4704c4061999bd949
+%global commit d98adbe88460ae672b4c26472f6de6729db8e680
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.20
+Version: 38.21
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -814,6 +814,20 @@ exit 0
 %endif
 
 %changelog
+* Thu Jul 13 2023 Zdenek Pytela <zpytela@redhat.com> - 38.21-1
+- Make systemd_tmpfiles_t MLS trusted for lowering the level of files
+- Revert "Allow insights client map cache_home_t"
+- Allow nfsidmapd connect to systemd-machined over a unix socket
+- Allow snapperd connect to kernel over a unix domain stream socket
+- Allow virt_qemu_ga_t create .ssh dir with correct label
+- Allow targetd read network sysctls
+- Set the abrt_handle_event boolean to on
+- Permit kernel_t to change the user identity in object contexts
+- Allow insights client map cache_home_t
+- Label /usr/sbin/mariadbd with mysqld_exec_t
+- Trim changelog so that it starts at F37 time
+- Define equivalency for /run/systemd/generator.early
+
 * Thu Jun 29 2023 Zdenek Pytela <zpytela@redhat.com> - 38.20-1
 - Allow httpd tcp connect to redis port conditionally
 - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
diff --git a/sources b/sources
index c0d18a9..123ca9d 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (selinux-policy-10f97f8.tar.gz) = 8bfac2f650e1e6e58a5eae3759a2aa7df7d5b5d953993aa6b618df7a6d4d39f54f9528f4e6cc2b511d64a4873591895211a6741987f0c246823d7a4c65473128
+SHA512 (selinux-policy-d98adbe.tar.gz) = d473b70985b7c160c2e93d49ba3340fe01db71970bbc2eeae801ecb8f1412248035a3449e5527c79c556854a67f52e0584c85159b5b753d93c3e92f2300f22bb
+SHA512 (container-selinux.tgz) = babfd4b589e2fdd6999ca33bfa871de6a2bae47d4098e71e1450d0ec23acf8a720347a36138adde6f7f7cf5aaa68abee5c85840b351a6752eca6d51dd539e06c
 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4
-SHA512 (container-selinux.tgz) = 23214fe5f085ac5d39ca1719b7e7fcb63bf8481565562aef5b2fa45650e7f516d060b207ef8b5c44f3af0039d3e3f0de01afeb2ea59d6ff08fbd34665b3d5e70