diff --git a/.gitignore b/.gitignore
index 78aef59..f9ffba8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
 SOURCES/container-selinux.tgz
-SOURCES/selinux-policy-4c3b7d3.tar.gz
-SOURCES/selinux-policy-contrib-88b9517.tar.gz
+SOURCES/selinux-policy-0fdab31.tar.gz
+SOURCES/selinux-policy-contrib-4beb213.tar.gz
diff --git a/.selinux-policy.metadata b/.selinux-policy.metadata
index ce71b76..38532f1 100644
--- a/.selinux-policy.metadata
+++ b/.selinux-policy.metadata
@@ -1,3 +1,3 @@
-b15953440b924d21a81e4df79fdcb10f679c8aa5 SOURCES/container-selinux.tgz
-afa5826493350e51e548487a403baabf15b7e9cf SOURCES/selinux-policy-4c3b7d3.tar.gz
-2ed837b3ac267d90ad8854a8b138b97e5b643793 SOURCES/selinux-policy-contrib-88b9517.tar.gz
+a810a49ab0aa8e61bfcee594ad56807758cf2ad5 SOURCES/container-selinux.tgz
+7a2a9dda6f2b41c7c43cbf48d6ac20d4973608ad SOURCES/selinux-policy-0fdab31.tar.gz
+45d3dbd0265f43953376baacdbc070a566eb429b SOURCES/selinux-policy-contrib-4beb213.tar.gz
diff --git a/SPECS/selinux-policy.spec b/SPECS/selinux-policy.spec
index c81f803..e6d79f5 100644
--- a/SPECS/selinux-policy.spec
+++ b/SPECS/selinux-policy.spec
@@ -1,11 +1,11 @@
 # github repo with selinux-policy base sources
 %global git0 https://github.com/fedora-selinux/selinux-policy
-%global commit0 4c3b7d30413032b45585248983844f2e1a32c6db
+%global commit0 0fdab319c4d575686903933c72efcad405402514
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 # github repo with selinux-policy contrib sources
 %global git1 https://github.com/fedora-selinux/selinux-policy-contrib
-%global commit1 88b951795c1c83534a369b1aec29d35c37049e05
+%global commit1 4beb213356f6020d4ea6635dda6842cef88fb357
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
 %define distro redhat
@@ -29,7 +29,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.14.3
-Release: 63%{?dist}
+Release: 64%{?dist}
 License: GPLv2+
 Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
 Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
@@ -715,6 +715,19 @@ exit 0
 %endif
 
 %changelog
+* Wed Feb 17 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
+- Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
+Resolves: rhbz#1874527
+Resolves: rhbz#1877044
+- Allow rhsmcertd bind tcp sockets to a generic node
+Resolves: rhbz#1923985
+- Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
+Resolves: rhbz#1889542
+- Allow strongswan start using swanctl method
+Resolves: rhbz#1889542
+- Allow systemd-importd manage machines.lock file
+Resolves: rhbz#1788055
+
 * Thu Feb 11 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
 - Allow rtkit_daemon_t domain set process nice value in user namespaces
 Resolves: rhbz#1910507