diff --git a/.gitignore b/.gitignore
index 0fec55c..3c2aa2a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/subscription-manager-1.28.21.tar.gz
-SOURCES/subscription-manager-cockpit-1.28.21.tar.gz
+SOURCES/subscription-manager-1.28.28.tar.gz
+SOURCES/subscription-manager-cockpit-1.28.28.tar.gz
diff --git a/.subscription-manager.metadata b/.subscription-manager.metadata
index b7bf27f..c76738d 100644
--- a/.subscription-manager.metadata
+++ b/.subscription-manager.metadata
@@ -1,2 +1,2 @@
-bbcd2275dde3177abcf5feaac4191437b028076e SOURCES/subscription-manager-1.28.21.tar.gz
-11f637b8f9da946858a1720a80db65265f464dbe SOURCES/subscription-manager-cockpit-1.28.21.tar.gz
+508a506483c7e6454e3b898489c40896227c9d59 SOURCES/subscription-manager-1.28.28.tar.gz
+179f0e65324800141f3dd652518d3a91c451309a SOURCES/subscription-manager-cockpit-1.28.28.tar.gz
diff --git a/README.debrand b/README.debrand
deleted file mode 100644
index 01c46d2..0000000
--- a/README.debrand
+++ /dev/null
@@ -1,2 +0,0 @@
-Warning: This package was configured for automatic debranding, but the changes
-failed to apply.
diff --git a/SPECS/subscription-manager.spec b/SPECS/subscription-manager.spec
index 5da32e3..4719d15 100644
--- a/SPECS/subscription-manager.spec
+++ b/SPECS/subscription-manager.spec
@@ -248,8 +248,8 @@
 %global use_rhsm_icons 0%{use_cockpit} || 0%{use_rhsm_gtk}
 
 Name: subscription-manager
-Version: 1.28.21
-Release: 2%{?dist}
+Version: 1.28.28
+Release: 1%{?dist}
 Summary: Tools and libraries for subscription and repository management
 %if 0%{?suse_version}
 Group:   Productivity/Networking/System
@@ -716,8 +716,9 @@ BuildArch: noarch
 Requires: subscription-manager
 Requires: cockpit-bridge
 Requires: cockpit-shell
-Requires: cockpit-ws
 Requires: rhsm-icons
+# Used by desktop UI, but not necessary for web UI
+Recommends: cockpit-ws
 
 %description -n subscription-manager-cockpit
 Subscription Manager Cockpit UI
@@ -1403,7 +1404,7 @@ fi
 %endif
 
 # Make all entitlement certificates and keys files readable by group and other
-chmod go+r /etc/pki/entitlement/*.pem || true
+find /etc/pki/entitlement -mindepth 1 -maxdepth 1 -name '*.pem' | xargs --no-run-if-empty chmod go+r
 
 if [ -x /bin/dbus-send ] ; then
     dbus-send --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig > /dev/null 2>&1 || :
@@ -1490,10 +1491,199 @@ gtk-update-icon-cache -f %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
-* Thu Aug 19 2021 Christopher Snyder <csnyder@redhat.com> 1.28.21-2
-- 1922151: Revert "hwprobe.py: Fix counting cores per cpu for Fujitsu A64FX CPU"
+* Tue Feb 15 2022 Christopher Snyder <csnyder@redhat.com> 1.28.28-1
+- Revert "1887600: Use updated cert with SHA-256 algorithm"
+  (csnyder@redhat.com)
+- environments: fix usage of injection (ptoscano@redhat.com)
+
+* Mon Feb 14 2022 Christopher Snyder <csnyder@redhat.com> 1.28.27-1
+- Update translation files (noreply@weblate.org)
+- 1887600: Use updated cert with SHA-256 algorithm (jhnidek@redhat.com)
+- 2046516: register: do not check environments w/ activation keys
+  (ptoscano@redhat.com)
+- No-op refactor of RegisterCommand._process_environments()
+  (ptoscano@redhat.com)
+- environments: fix list for account in env-less org (ptoscano@redhat.com)
+- 1994056: Multiple environment capability (wpoteat@redhat.com)
+
+* Thu Feb 10 2022 Christopher Snyder <csnyder@redhat.com> 1.28.26-1
+- 2049441: [1.28] Cockpit registration dialog: enable insights by default
+  (jhnidek@redhat.com)
+- Reverting disabling AutoAttach() and PoolAttach() in SCA mode
+  (jhnidek@redhat.com)
+- 2046302: Apply Conscious language initiative changes (mhorky@redhat.com)
+- ENT-4671: Improve debug logging to stdout (mhorky@redhat.com)
+- Fix indentation of ProductStatus. (jhnidek@redhat.com)
+- 2028969: Do not try to load compliance status from cache (jhnidek@redhat.com)
+- Fixed last bits related to updated D-Bus Register method.
+  (jhnidek@redhat.com)
+- Refactoring of temporary disablement of dir watchers. (jhnidek@redhat.com)
+- Ignore enable_content option in RegisterWithActivationKeys()
+  (jhnidek@redhat.com)
+- Use benefits of enable_content in cockpit plugin. (jhnidek@redhat.com)
+- Added enable_content option to Register() D-Bus method (jhnidek@redhat.com)
+- Added refresh() method to entitlement service (jhnidek@redhat.com)
+- Fixed issue with status cache (jhnidek@redhat.com)
+- Add information about content access mode to consumer (jhnidek@redhat.com)
+- cockpit: fix system installation of subscription-manager
+  (ptoscano@redhat.com)
+- New extraction for translatable strings (ptoscano@redhat.com)
+- Adding permissive coverage publishing (jmolet@redhat.com)
+- WIP: try to not use junit('coverage.xml') (jhnidek@redhat.com)
+- 2024573: [1.28] Do not delete cache of content_access during refresh
+  (jhnidek@redhat.com)
+
+* Thu Jan 06 2022 Christopher Snyder <csnyder@redhat.com> 1.28.25-1
+- syspurpose: handle users w/o organizations (ptoscano@redhat.com)
+- service-level: drop useless check (ptoscano@redhat.com)
+- 2037902: consider user-specified --org in any case (ptoscano@redhat.com)
+- 2037901: Fix organizations hint in syspurpose commands (mhorky@redhat.com)
+- 2037901: Only hint organizations if it's needed (mhorky@redhat.com)
+- 2037901: Show available organizations before asking for input
+  (mhorky@redhat.com)
+- cache: fix typo in debug message (ptoscano@redhat.com)
+- 2017795: Disallowed attaching using D-Bus in SCA mode (jhnidek@redhat.com)
+- 2017795: Disallowed attaching pool in SCA mode: (jhnidek@redhat.com)
+- Extended D-Bus API - syspurpose methods; ENT-2373 (jhnidek@redhat.com)
+- 2029384: Fix bash autocompletion (mhorky@redhat.com)
+- Try to use --forked for all unit tests. (jhnidek@redhat.com)
+- Updates to cherry pick for pytest (wpoteat@redhat.com)
+- test: rename tests to default pytest filename pattern (ptoscano@redhat.com)
+- Use pytest --forked for D-Bus unit tests (jhnidek@redhat.com)
+- Added cleanup for one patcher; fixed some comments. (jhnidek@redhat.com)
+- Remove i-notify watchers on the end of the loop (jhnidek@redhat.com)
+- Remove outdated comments from the coverage Jenkins job (mhorky@redhat.com)
+- ENT-4252: Migrate from nose to pytest (mhorky@redhat.com)
+- Remove PyXML leftovers (ptoscano@redhat.com)
+- 2024589: fix format of HTTP-date headers (ptoscano@redhat.com)
+- connection: move HTTP-date formatting to own helper (ptoscano@redhat.com)
+- Ensure datetime.timezone.utc objects for parsed UTC dates
+  (ptoscano@redhat.com)
+- Cockpit plugin: display syspurpose card without attributes
+  (jhnidek@redhat.com)
+- 2000326: Fixed partially subscribed product in Cockpit plugin
+  (jhnidek@redhat.com)
+- Update translation files (noreply@weblate.org)
+- 2024930: build: fix build on 'build' target (ptoscano@redhat.com)
+- Add 8.6 releaser (csnyder@redhat.com)
+- 2023392: libdnf: respect environment CFLAGS (ptoscano@redhat.com)
+
+* Thu Nov 18 2021 Christopher Snyder <csnyder@redhat.com> 1.28.24-1
+- 1995465: Do not use deprecated collections.MutableMapping
+  (jhnidek@redhat.com)
+- connection: recognize proxy errors (ptoscano@redhat.com)
+- 2020284: handle server-side consumer deletion in syspurpose commands
   (ptoscano@redhat.com)
 
+* Thu Nov 11 2021 Christopher Snyder <csnyder@redhat.com> 1.28.23-1
+- 2021982: Fix syspurpose bash completion (mhorky@redhat.com)
+- New extraction for translatable strings (ptoscano@redhat.com)
+- syspurpose: remove redundant _() (ptoscano@redhat.com)
+- syspurpose: translate more UI strings (ptoscano@redhat.com)
+- syspurpose: include argparse string in message catalog (ptoscano@redhat.com)
+- 1719690: Update to message formatting (wpoteat@redhat.com)
+- cockpit: port subscriptions info icons to PF4 icons (kkoukiou@redhat.com)
+- cockpit: translate some untranslated aria-labels (kkoukiou@redhat.com)
+- cockpit: Port Po2JSONPlugin to webpack 5 (kkoukiou@redhat.com)
+- cockpit: stop including PF3 - it's not used anymore (kkoukiou@redhat.com)
+- cockpit: port Insights dialog remaining non PF4 parts (kkoukiou@redhat.com)
+- cockpit: port subscriptions register dialog to Patternfly 4
+  (kkoukiou@redhat.com)
+- cockpit: port spinners to PF4 spinners (kkoukiou@redhat.com)
+- cockpit: replace custom Revealer component with 'ExpandableSection' from PF4
+  (kkoukiou@redhat.com)
+- cockpit: replace pficon and fa classes with svgs form react-icons
+  (kkoukiou@redhat.com)
+- cockpit: remove jquery unused dependency (kkoukiou@redhat.com)
+- cockpit: patternfly is a normal dependency - not just dev
+  (kkoukiou@redhat.com)
+- cockpit: update patternfly modules and explicitely specify react-icons
+  dependency (kkoukiou@redhat.com)
+- cockpit: clean up package.json from unused dependencies and move to webpack 5
+  (kkoukiou@redhat.com)
+- webpack: Use relative resolve path for npm 7 compatibility
+  (kkoukiou@redhat.com)
+- cockpit: Stop using a custom Select, use the one from PF instead
+  (kkoukiou@redhat.com)
+- cockpit: checkout Cockpit's PF/React/build library instead of keeping a
+  direct copy of it locally (kkoukiou@redhat.com)
+- 1979323: Cockpit - do not show red red icon in SCA mode (jhnidek@redhat.com)
+- New D-Bus method GetOrg() (jhnidek@redhat.com)
+- cockpit: Test also system purpose (mmarusak@redhat.com)
+- cockpit: Use current PF4 components and design (mmarusak@redhat.com)
+- test: Update cockpit test/common library (mmarusak@redhat.com)
+- cockpit: Update babel (mmarusak@redhat.com)
+- cockpit: Sync lib/patternfly with Cockpit (mmarusak@redhat.com)
+- cockpit: Use PF4 based empty state (mmarusak@redhat.com)
+- cockpit: Drop uglification (mmarusak@redhat.com)
+- cockpit: Add `standard-jsx` eslint plugin (mmarusak@redhat.com)
+- cockpit: Use 'noreferrer' for external links (mmarusak@redhat.com)
+- cockpit: Remove loaders for .es6 files (mmarusak@redhat.com)
+- cockpit: Add package-lock.json to .gitignore (mmarusak@redhat.com)
+- cockpit: Lower cockpit-ws dependency to Recommends (martin@piware.de)
+- test: Robustify and trim down cockpit-ws installation (martin@piware.de)
+- 1859529: Remove proxy server test as it is unnecessary (wpoteat@redhat.com)
+- 2015173: chmod /etc/pki/entitlement/*.pem only when existing
+  (ptoscano@redhat.com)
+- Fix redundant API calls to Candlepin (hyu@redhat.com)
+- 2014646: fix rhn-migrate-classic-to-rhsm & its tests for argparse
+  (ptoscano@redhat.com)
+- cockpit: Move from obsolete node-sass to Dart sass (martin@piware.de)
+- cockpit: wait 5 seconds for candlepin at first (ptoscano@redhat.com)
+- cockpit: use the self-signed key in mock-insights (ptoscano@redhat.com)
+- 1989955: use /proc/device-tree/ibm,partition-uuid on POWER LPARs
+  (ptoscano@redhat.com)
+- facts: prepare _get_devicetree_uuid() for multiple files
+  (ptoscano@redhat.com)
+- facts: refactor device-tree parts of VirtUuidCollector (ptoscano@redhat.com)
+- build: pin flake8 to < 4 (ptoscano@redhat.com)
+- Translated using Weblate (Korean) (simmon@nplob.com)
+- Translated using Weblate (Korean) (simmon@nplob.com)
+- Translated using Weblate (Spanish) (ehespinosa57@gmail.com)
+- ENT-4289: Drop Sphinx (mhorky@redhat.com)
+
+* Thu Sep 23 2021 Christopher Snyder <csnyder@redhat.com> 1.28.22-1
+- 1924338: [1.28] list prints no status and dates in SCA mode
+  (jhnidek@redhat.com)
+- Update translation files (noreply@weblate.org)
+- New extraction for translatable strings (ptoscano@redhat.com)
+- 2000867: syspurpose: show deprecation notices (ptoscano@redhat.com)
+- build: switch to os.makedirs(..., exist_ok=True) (ptoscano@redhat.com)
+- build: call create_dest_dir() only when running callback
+  (ptoscano@redhat.com)
+- [1.28] 1859157: Display better error message on incorrect --org
+  (mhorky@redhat.com)
+- Add 'syspurpose' to list of commands in manpage (mhorky@redhat.com)
+- 1974641: Fix tab completion with multiple optional commands
+  (mhorky@redhat.com)
+- 1975552: add '[SUBMODULE]' in syspurpose usage string (ptoscano@redhat.com)
+- 1975552: remove extra '[OPTIONS]' from syspurpose usage string (#2682)
+  (ptoscano@redhat.com)
+- 2000883: move syspurpose subcommands within the 'syspurpose' command
+  (ptoscano@redhat.com)
+- Rename internal variable for syspurpose --show (ptoscano@redhat.com)
+- Drop command name from args when parsing them (ptoscano@redhat.com)
+- 1983144: More useful feedback on unknown argument (mhorky@redhat.com)
+- repos: document order of --enable & --disable (ptoscano@redhat.com)
+- 1984133: repos: respect order of --enable & --disable (ptoscano@redhat.com)
+- 1953069: bash: fix listing of config options (#2609) (ptoscano@redhat.com)
+- 1952879: extract messages from argparse instead of optparse
+  (ptoscano@redhat.com)
+- Replace optparse with argparse (wpoteat@redhat.com)
+- Fixup syspurpose module help text / bash completion (csnyder@redhat.com)
+- Added new syspurpose command; ENT-3060 (jhnidek@redhat.com)
+- [1.28] ENT-4228: Format rhsmlib exception (mhorky@redhat.com)
+- [1.28] ENT-4228: Always format restlib exceptions (mhorky@redhat.com)
+- Update exception handling (mhorky@redhat.com)
+- 1983074: Remove invalid log level (mhorky@redhat.com)
+- adding timoeout to jenkins pipeline (#2585) (jmolet@redhat.com)
+- [1.28] 1976240: Improve HTTP code/message reporting in error strings
+  (mhorky@redhat.com)
+- [1.28] 1859569: Abort on invalid username/token argument in syspurpose
+  (mhorky@redhat.com)
+- [1.28] ENT-4168: Unify description of --org in syspurpose subcommands
+  (mhorky@redhat.com)
+
 * Wed Aug 18 2021 Christopher Snyder <csnyder@redhat.com> 1.28.21-1
 - Updated translations from weblate
 - 1922151: Add /var/cache/cloud-what to python3-cloud-what RPM.