From 31f8b1fd4e58a81777ecf0f5c6282f52cfde2f8f Mon Sep 17 00:00:00 2001
From: CoreOS Bot <coreosbot@fedoraproject.org>
Date: Mon, 4 Dec 2023 14:08:04 +0000
Subject: [PATCH] tree: promote changes from testing at
 1c8e2d07af27fd856f6fd0be390d7d583cc56852

---
 ci/buildroot/Dockerfile                       |   2 +-
 fedora-candidate-compose.repo                 |  21 ++
 kola-denylist.yaml                            |  23 +-
 manifest-lock.aarch64.json                    | 205 +++++++++--------
 manifest-lock.overrides.aarch64.yaml          |  59 -----
 manifest-lock.overrides.ppc64le.yaml          |  59 -----
 manifest-lock.overrides.s390x.yaml            |  30 ---
 manifest-lock.overrides.x86_64.yaml           |  65 ------
 manifest-lock.overrides.yaml                  | 168 --------------
 manifest-lock.ppc64le.json                    | 203 +++++++++--------
 manifest-lock.s390x.json                      | 191 ++++++++--------
 manifest-lock.x86_64.json                     | 209 +++++++++---------
 manifests/crun-wasm.yaml                      |   4 -
 manifests/fedora-coreos-base.yaml             |   5 +-
 manifests/fedora-coreos.yaml                  |  14 +-
 manifests/ostree-autoprune.yaml               |  11 -
 manifests/ostree-bls.yaml                     |  10 +
 .../coreos-diskful-generator                  |  36 ++-
 .../coreos-gpt-setup.service                  |  26 +--
 .../coreos-ignition-setup-user.service        |  10 +-
 .../coreos-secex-ignition-decrypt.service     |   7 +-
 .../coreos-teardown-initramfs.sh              |  21 +-
 .../35coreos-ignition/module-setup.sh         |   3 +-
 .../coreos-multipath-wait.target              |   4 +-
 .../coreos-copy-firstboot-network.service     |   5 +-
 .../ignition-ostree-uuid-boot.service         |   9 +-
 tests/kola/binfmt/qemu                        |   2 +-
 tests/kola/butane/grub-users/test.sh          |   8 +-
 tests/kola/containers/quadlet/config.bu       |   2 +-
 tests/kola/containers/quadlet/test.sh         |   2 +-
 tests/kola/docker/basic                       |   2 +-
 tests/kola/ntp/data/ntplib.sh                 |   2 +-
 tests/kola/podman/dns/test.sh                 |   2 +-
 tests/kola/podman/rootless-pasta-networking   |   2 +-
 tests/kola/podman/rootless-systemd            |   2 +-
 tests/kola/rpm-ostree/kernel-replace          |  16 +-
 tests/kola/selinux/podman-tmpfs-context       |   2 +-
 tests/kola/systemd/condition-needs-update     |  64 ++++++
 38 files changed, 610 insertions(+), 896 deletions(-)
 create mode 100644 fedora-candidate-compose.repo
 delete mode 100644 manifest-lock.overrides.aarch64.yaml
 delete mode 100644 manifest-lock.overrides.ppc64le.yaml
 delete mode 100644 manifest-lock.overrides.s390x.yaml
 delete mode 100644 manifest-lock.overrides.x86_64.yaml
 delete mode 100644 manifests/crun-wasm.yaml
 delete mode 100644 manifests/ostree-autoprune.yaml
 create mode 100644 manifests/ostree-bls.yaml
 create mode 100755 tests/kola/systemd/condition-needs-update

diff --git a/ci/buildroot/Dockerfile b/ci/buildroot/Dockerfile
index 01dfa684d7..e80283bf8d 100644
--- a/ci/buildroot/Dockerfile
+++ b/ci/buildroot/Dockerfile
@@ -5,6 +5,6 @@
 #
 # This image is used by CoreOS CI to build software like
 # Ignition, rpm-ostree, ostree, coreos-installer, etc...
-FROM quay.io/fedora/fedora:38
+FROM quay.io/fedora/fedora:39
 COPY . /src
 RUN ./src/install-buildroot.sh && yum clean all && rm /src -rf
diff --git a/fedora-candidate-compose.repo b/fedora-candidate-compose.repo
new file mode 100644
index 0000000000..b408da256f
--- /dev/null
+++ b/fedora-candidate-compose.repo
@@ -0,0 +1,21 @@
+# This yum repo entry represents the latest candidate compose for the given
+# Fedora release. During prep for final release some release blockers and
+# freeze exceptions are actually built in candidate composes first to
+# qualify them before they are promoted to the other repos. In order to pick
+# these packages up ASAP we'll pull from the latest candidate compose
+# as well. Note that if a package doesn't pass testing it will get
+# demoted from a later canddiate compose and never promoted to stable
+# repos. In this case a later bump-lockfile run will revert ot the
+# older NVR package that is currently in the stable repos. This should address:
+# https://github.com/coreos/fedora-coreos-tracker/issues/1602
+
+[fedora-candidate-compose]
+name=Fedora Candidate Compose $releasever - $basearch
+baseurl=https://kojipkgs.fedoraproject.org/compose/$releasever/latest-Fedora-$releasever/compose/Everything/$basearch/os/
+enabled=1
+#metadata_expire=7d
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
+skip_if_unavailable=False
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index ab9a829281..358d018bfb 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -5,35 +5,28 @@
   tracker: https://github.com/coreos/coreos-assembler/pull/1478
 - pattern: podman.workflow
   tracker: https://github.com/coreos/coreos-assembler/pull/1478
-- pattern: ext.config.kdump.crash
-  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1430
-  # snooze: 2023-11-15 (disabled on promotion)
-  # warn: true (disabled on promotion)
-  arches:
-    - aarch64
-  streams:
-    - stable
-    - testing
-    - testing-devel
 - pattern: coreos.ignition.ssh.key
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1553
-  # snooze: 2023-11-15 (disabled on promotion)
+  # snooze: 2023-11-30 (disabled on promotion)
   # warn: true (disabled on promotion)
   platforms:
     - azure
 - pattern: ext.config.docker.basic
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1578
-  # snooze: 2023-11-15 (disabled on promotion)
+  # snooze: 2023-11-30 (disabled on promotion)
   # warn: true (disabled on promotion)
   streams:
     - rawhide
 - pattern: ext.config.kdump.crash
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1588
-  # snooze: 2023-11-15 (disabled on promotion)
+  # snooze: 2023-11-30 (disabled on promotion)
   # warn: true (disabled on promotion)
   arches:
     - ppc64le
   streams:
     - rawhide
-- pattern: ext.config.extensions.package
-  tracker: https://github.com/coreos/fedora-coreos-config/pull/2710#issuecomment-1792771307
+- pattern: pxe-*.ppcfw
+  tracker: https://github.com/coreos/coreos-assembler/issues/3370
+  # nb: testiso doesn't read this, so it's just for consistency
+  arches:
+    - ppc64le
diff --git a/manifest-lock.aarch64.json b/manifest-lock.aarch64.json
index e1e49dfcd5..b6d6368ad5 100644
--- a/manifest-lock.aarch64.json
+++ b/manifest-lock.aarch64.json
@@ -1,22 +1,22 @@
 {
   "packages": {
     "NetworkManager": {
-      "evra": "1:1.44.0-1.fc39.aarch64"
+      "evra": "1:1.44.2-1.fc39.aarch64"
     },
     "NetworkManager-cloud-setup": {
-      "evra": "1:1.44.0-1.fc39.aarch64"
+      "evra": "1:1.44.2-1.fc39.aarch64"
     },
     "NetworkManager-libnm": {
-      "evra": "1:1.44.0-1.fc39.aarch64"
+      "evra": "1:1.44.2-1.fc39.aarch64"
     },
     "NetworkManager-team": {
-      "evra": "1:1.44.0-1.fc39.aarch64"
+      "evra": "1:1.44.2-1.fc39.aarch64"
     },
     "NetworkManager-tui": {
-      "evra": "1:1.44.0-1.fc39.aarch64"
+      "evra": "1:1.44.2-1.fc39.aarch64"
     },
     "WALinuxAgent-udev": {
-      "evra": "2.9.0.4-4.fc39.noarch"
+      "evra": "2.9.1.1-1.fc39.noarch"
     },
     "aardvark-dns": {
       "evra": "1.8.0-1.fc39.aarch64"
@@ -37,10 +37,10 @@
       "evra": "1.25-1.fc39.aarch64"
     },
     "amd-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "attr": {
       "evra": "2.5.1-8.fc39.aarch64"
@@ -64,10 +64,10 @@
       "evra": "11-18.fc39.noarch"
     },
     "bash": {
-      "evra": "5.2.15-5.fc39.aarch64"
+      "evra": "5.2.21-1.fc39.aarch64"
     },
     "bash-color-prompt": {
-      "evra": "0.1-6.fc39.noarch"
+      "evra": "0.2-1.fc39.noarch"
     },
     "bash-completion": {
       "evra": "1:2.11-12.fc39.noarch"
@@ -82,10 +82,10 @@
       "evra": "32:9.18.19-1.fc39.aarch64"
     },
     "bootupd": {
-      "evra": "0.2.11-3.fc39.aarch64"
+      "evra": "0.2.12-2.fc39.aarch64"
     },
     "brcmfmac-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "bsdtar": {
       "evra": "3.7.1-1.fc39.aarch64"
@@ -133,7 +133,7 @@
       "evra": "0.33-3.fc39.noarch"
     },
     "conmon": {
-      "evra": "2:2.1.7-3.fc39.aarch64"
+      "evra": "2:2.1.8-2.fc39.aarch64"
     },
     "console-login-helper-messages": {
       "evra": "0.21.3-6.fc39.noarch"
@@ -187,13 +187,13 @@
       "evra": "3.18-3.fc39.aarch64"
     },
     "crun": {
-      "evra": "1.11-1.fc39.aarch64"
+      "evra": "1.11.1-1.fc39.aarch64"
     },
     "crun-wasm": {
-      "evra": "1.11-1.fc39.aarch64"
+      "evra": "1.11.1-1.fc39.aarch64"
     },
     "crypto-policies": {
-      "evra": "20230731-1.git5ed06e0.fc39.noarch"
+      "evra": "20231113-1.gitb402e82.fc39.noarch"
     },
     "cryptsetup": {
       "evra": "2.6.1-3.fc39.aarch64"
@@ -253,13 +253,13 @@
       "evra": "4.2-7.fc39.aarch64"
     },
     "dracut": {
-      "evra": "059-15.fc39.aarch64"
+      "evra": "059-16.fc39.aarch64"
     },
     "dracut-network": {
-      "evra": "059-15.fc39.aarch64"
+      "evra": "059-16.fc39.aarch64"
     },
     "dracut-squash": {
-      "evra": "059-15.fc39.aarch64"
+      "evra": "059-16.fc39.aarch64"
     },
     "duktape": {
       "evra": "2.7.0-5.fc39.aarch64"
@@ -280,13 +280,13 @@
       "evra": "38-8.fc39.aarch64"
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.189-4.fc39.noarch"
+      "evra": "0.190-1.fc39.noarch"
     },
     "elfutils-libelf": {
-      "evra": "0.189-4.fc39.aarch64"
+      "evra": "0.190-1.fc39.aarch64"
     },
     "elfutils-libs": {
-      "evra": "0.189-4.fc39.aarch64"
+      "evra": "0.190-1.fc39.aarch64"
     },
     "ethtool": {
       "evra": "2:6.5-1.fc39.aarch64"
@@ -328,7 +328,7 @@
       "evra": "1:4.9.0-5.fc39.aarch64"
     },
     "flatpak-session-helper": {
-      "evra": "1.15.4-3.fc39.aarch64"
+      "evra": "1.15.4-4.fc39.aarch64"
     },
     "fmt": {
       "evra": "10.0.0-3.fc39.aarch64"
@@ -358,7 +358,7 @@
       "evra": "3.16.1-1.fc39.aarch64"
     },
     "fwupd": {
-      "evra": "1.9.6-1.fc39.aarch64"
+      "evra": "1.9.7-1.fc39.aarch64"
     },
     "gawk": {
       "evra": "5.2.2-2.fc39.aarch64"
@@ -379,28 +379,28 @@
       "evra": "0.22-2.fc39.aarch64"
     },
     "git-core": {
-      "evra": "2.41.0-2.fc39.aarch64"
+      "evra": "2.42.0-2.fc39.aarch64"
     },
     "glib2": {
-      "evra": "2.78.0-3.fc39.aarch64"
+      "evra": "2.78.1-1.fc39.aarch64"
     },
     "glibc": {
-      "evra": "2.38-7.fc39.aarch64"
+      "evra": "2.38-10.fc39.aarch64"
     },
     "glibc-common": {
-      "evra": "2.38-7.fc39.aarch64"
+      "evra": "2.38-10.fc39.aarch64"
     },
     "glibc-gconv-extra": {
-      "evra": "2.38-7.fc39.aarch64"
+      "evra": "2.38-10.fc39.aarch64"
     },
     "glibc-minimal-langpack": {
-      "evra": "2.38-7.fc39.aarch64"
+      "evra": "2.38-10.fc39.aarch64"
     },
     "gmp": {
       "evra": "1:6.2.1-5.fc39.aarch64"
     },
     "gnupg2": {
-      "evra": "2.4.3-2.fc39.aarch64"
+      "evra": "2.4.3-4.fc39.aarch64"
     },
     "gnutls": {
       "evra": "3.8.1-1.fc39.aarch64"
@@ -415,16 +415,16 @@
       "evra": "3.11-3.fc39.aarch64"
     },
     "grub2-common": {
-      "evra": "1:2.06-104.fc39.noarch"
+      "evra": "1:2.06-109.fc39.noarch"
     },
     "grub2-efi-aa64": {
-      "evra": "1:2.06-104.fc39.aarch64"
+      "evra": "1:2.06-109.fc39.aarch64"
     },
     "grub2-tools": {
-      "evra": "1:2.06-104.fc39.aarch64"
+      "evra": "1:2.06-109.fc39.aarch64"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-104.fc39.aarch64"
+      "evra": "1:2.06-109.fc39.aarch64"
     },
     "gvisor-tap-vsock-gvforwarder": {
       "evra": "6:0.7.1-1.fc39.aarch64"
@@ -442,7 +442,7 @@
       "evra": "57-2.fc39.aarch64"
     },
     "intel-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-2.fc39.aarch64"
@@ -514,16 +514,16 @@
       "evra": "2.6.3-1.fc39.noarch"
     },
     "kernel": {
-      "evra": "6.5.9-300.fc39.aarch64"
+      "evra": "6.5.11-300.fc39.aarch64"
     },
     "kernel-core": {
-      "evra": "6.5.9-300.fc39.aarch64"
+      "evra": "6.5.11-300.fc39.aarch64"
     },
     "kernel-modules": {
-      "evra": "6.5.9-300.fc39.aarch64"
+      "evra": "6.5.11-300.fc39.aarch64"
     },
     "kernel-modules-core": {
-      "evra": "6.5.9-300.fc39.aarch64"
+      "evra": "6.5.11-300.fc39.aarch64"
     },
     "kexec-tools": {
       "evra": "2.0.27-2.fc39.aarch64"
@@ -544,7 +544,7 @@
       "evra": "0.9.5-2.fc39.aarch64"
     },
     "krb5-libs": {
-      "evra": "1.21.2-1.fc39.aarch64"
+      "evra": "1.21.2-2.fc39.aarch64"
     },
     "less": {
       "evra": "633-2.fc39.aarch64"
@@ -627,9 +627,6 @@
     "libfido2": {
       "evra": "1.13.0-3.fc39.aarch64"
     },
-    "libgcab1": {
-      "evra": "1.6-2.fc39.aarch64"
-    },
     "libgcc": {
       "evra": "13.2.1-4.fc39.aarch64"
     },
@@ -643,7 +640,7 @@
       "evra": "238-2.fc39.aarch64"
     },
     "libgusb": {
-      "evra": "0.4.6-2.fc39.aarch64"
+      "evra": "0.4.8-1.fc39.aarch64"
     },
     "libibverbs": {
       "evra": "46.0-4.fc39.aarch64"
@@ -658,7 +655,7 @@
       "evra": "1.3.1-54.fc39.aarch64"
     },
     "libipa_hbac": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "libjcat": {
       "evra": "0.1.14-2.fc39.aarch64"
@@ -709,19 +706,19 @@
       "evra": "1.0.1-24.fc39.aarch64"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-1.rc3.fc39.aarch64"
+      "evra": "1:2.6.3-2.rc3.fc39.aarch64"
     },
     "libnftnl": {
       "evra": "1.2.6-2.fc39.aarch64"
     },
     "libnghttp2": {
-      "evra": "1.55.1-2.fc39.aarch64"
+      "evra": "1.55.1-4.fc39.aarch64"
     },
     "libnl3": {
-      "evra": "3.8.0-1.fc39.aarch64"
+      "evra": "3.8.0-2.fc39.aarch64"
     },
     "libnl3-cli": {
-      "evra": "3.8.0-1.fc39.aarch64"
+      "evra": "3.8.0-2.fc39.aarch64"
     },
     "libnsl2": {
       "evra": "2.0.0-6.fc39.aarch64"
@@ -778,7 +775,7 @@
       "evra": "2.39.2-1.fc39.aarch64"
     },
     "libsmbclient": {
-      "evra": "2:4.19.0-1.fc39.aarch64"
+      "evra": "2:4.19.2-1.fc39.aarch64"
     },
     "libsolv": {
       "evra": "0.7.25-1.fc39.aarch64"
@@ -787,16 +784,16 @@
       "evra": "1.47.0-2.fc39.aarch64"
     },
     "libsss_certmap": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "libsss_idmap": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "libsss_nss_idmap": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "libsss_sudo": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "libstdc++": {
       "evra": "13.2.1-4.fc39.aarch64"
@@ -817,7 +814,7 @@
       "evra": "0.15.0-1.fc39.aarch64"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc2.fc39.aarch64"
+      "evra": "1.3.4-0.fc39.aarch64"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-7.fc39.aarch64"
@@ -844,7 +841,7 @@
       "evra": "0.3.2-6.fc39.aarch64"
     },
     "libwbclient": {
-      "evra": "2:4.19.0-1.fc39.aarch64"
+      "evra": "2:4.19.2-1.fc39.aarch64"
     },
     "libxcrypt": {
       "evra": "4.4.36-2.fc39.aarch64"
@@ -865,10 +862,10 @@
       "evra": "2.5.1-36.fc39.aarch64"
     },
     "linux-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-2.fc39.aarch64"
@@ -910,7 +907,7 @@
       "evra": "4.2.0-3.fc39.aarch64"
     },
     "mt7xxx-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nano": {
       "evra": "7.2-4.fc39.aarch64"
@@ -940,7 +937,7 @@
       "evra": "0.52.23-4.fc39.aarch64"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-1.rc3.fc39.aarch64"
+      "evra": "1:2.6.3-2.rc3.fc39.aarch64"
     },
     "nftables": {
       "evra": "1:1.0.7-3.fc39.aarch64"
@@ -958,10 +955,10 @@
       "evra": "2.0.16-3.fc39.aarch64"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nvme-cli": {
-      "evra": "2.5-4.fc39.aarch64"
+      "evra": "2.6-1.fc39.aarch64"
     },
     "oniguruma": {
       "evra": "6.9.9-1.fc39.aarch64"
@@ -988,22 +985,22 @@
       "evra": "1.81-4.fc39.aarch64"
     },
     "ostree": {
-      "evra": "2023.6-1.fc39.aarch64"
+      "evra": "2023.7-2.fc39.aarch64"
     },
     "ostree-libs": {
-      "evra": "2023.6-1.fc39.aarch64"
+      "evra": "2023.7-2.fc39.aarch64"
     },
     "p11-kit": {
-      "evra": "0.25.0-2.fc39.aarch64"
+      "evra": "0.25.3-1.fc39.aarch64"
     },
     "p11-kit-trust": {
-      "evra": "0.25.0-2.fc39.aarch64"
+      "evra": "0.25.3-1.fc39.aarch64"
     },
     "pam": {
-      "evra": "1.5.3-2.fc39.aarch64"
+      "evra": "1.5.3-3.fc39.aarch64"
     },
     "pam-libs": {
-      "evra": "1.5.3-2.fc39.aarch64"
+      "evra": "1.5.3-3.fc39.aarch64"
     },
     "passt": {
       "evra": "0^20231004.gf851084-1.fc39.aarch64"
@@ -1033,13 +1030,13 @@
       "evra": "1.9.5-2.fc39.aarch64"
     },
     "podman": {
-      "evra": "5:4.7.0-1.fc39.aarch64"
+      "evra": "5:4.7.2-1.fc39.aarch64"
     },
     "podman-plugins": {
-      "evra": "5:4.7.0-1.fc39.aarch64"
+      "evra": "5:4.7.2-1.fc39.aarch64"
     },
     "policycoreutils": {
-      "evra": "3.5-7.fc39.aarch64"
+      "evra": "3.5-8.fc39.aarch64"
     },
     "polkit": {
       "evra": "123-1.fc39.aarch64"
@@ -1054,7 +1051,7 @@
       "evra": "1.19-3.fc39.aarch64"
     },
     "procps-ng": {
-      "evra": "4.0.3-4.fc39.aarch64"
+      "evra": "4.0.3-5.fc39.aarch64"
     },
     "protobuf-c": {
       "evra": "1.4.1-5.fc39.aarch64"
@@ -1066,13 +1063,13 @@
       "evra": "20230812-1.fc39.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:8.1.0-1.fc39.aarch64"
+      "evra": "2:8.1.1-1.fc39.aarch64"
     },
     "readline": {
       "evra": "8.2-4.fc39.aarch64"
     },
     "realtek-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc39.1.aarch64"
@@ -1102,22 +1099,22 @@
       "evra": "2:1.1.8-1.fc39.aarch64"
     },
     "samba-client-libs": {
-      "evra": "2:4.19.0-1.fc39.aarch64"
+      "evra": "2:4.19.2-1.fc39.aarch64"
     },
     "samba-common": {
-      "evra": "2:4.19.0-1.fc39.noarch"
+      "evra": "2:4.19.2-1.fc39.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.19.0-1.fc39.aarch64"
+      "evra": "2:4.19.2-1.fc39.aarch64"
     },
     "sed": {
       "evra": "4.8-14.fc39.aarch64"
     },
     "selinux-policy": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "setup": {
       "evra": "2.14.4-1.fc39.noarch"
@@ -1129,10 +1126,10 @@
       "evra": "1.46-6.fc39.aarch64"
     },
     "shadow-utils": {
-      "evra": "2:4.14.0-1.fc39.aarch64"
+      "evra": "2:4.14.0-2.fc39.aarch64"
     },
     "shadow-utils-subid": {
-      "evra": "2:4.14.0-1.fc39.aarch64"
+      "evra": "2:4.14.0-2.fc39.aarch64"
     },
     "shared-mime-info": {
       "evra": "2.2-4.fc39.aarch64"
@@ -1144,7 +1141,7 @@
       "evra": "1:1.13.3-1.fc39.aarch64"
     },
     "slang": {
-      "evra": "2.3.3-3.fc38.aarch64"
+      "evra": "2.3.3-4.fc39.aarch64"
     },
     "slirp4netns": {
       "evra": "1.2.2-1.fc39.aarch64"
@@ -1168,31 +1165,31 @@
       "evra": "0.1.4-4.fc39.aarch64"
     },
     "sssd-ad": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-client": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-common": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-common-pac": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-ipa": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-krb5": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-krb5-common": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-ldap": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "sssd-nfs-idmap": {
-      "evra": "2.9.2-1.fc39.aarch64"
+      "evra": "2.9.2-3.fc39.aarch64"
     },
     "stalld": {
       "evra": "1.16-4.fc39.aarch64"
@@ -1225,7 +1222,7 @@
       "evra": "1.32-1.fc39.aarch64"
     },
     "toolbox": {
-      "evra": "0.0.99.4-3.fc39.aarch64"
+      "evra": "0.0.99.4-5.fc39.aarch64"
     },
     "tpm2-tools": {
       "evra": "5.5-4.fc39.aarch64"
@@ -1246,13 +1243,13 @@
       "evra": "2.39.2-1.fc39.aarch64"
     },
     "vim-data": {
-      "evra": "2:9.0.2048-1.fc39.noarch"
+      "evra": "2:9.0.2105-1.fc39.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.2048-1.fc39.aarch64"
+      "evra": "2:9.0.2105-1.fc39.aarch64"
     },
     "wasmedge-rt": {
-      "evra": "0.13.3-1.fc39.aarch64"
+      "evra": "0.13.4-1.fc39.aarch64"
     },
     "which": {
       "evra": "2.21-40.fc39.aarch64"
@@ -1279,7 +1276,7 @@
       "evra": "1.3.2-1.fc39.aarch64"
     },
     "zincati": {
-      "evra": "0.0.26-2.fc39.aarch64"
+      "evra": "0.0.25-6.fc39.aarch64"
     },
     "zlib": {
       "evra": "1.2.13-4.fc39.aarch64"
@@ -1292,16 +1289,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-11-01T00:00:00Z",
+    "generated": "2023-11-19T00:00:00Z",
     "rpmmd_repos": {
-      "fedora-coreos-pool": {
-        "generated": "2023-11-01T00:48:11Z"
+      "fedora": {
+        "generated": "2023-11-01T00:12:29Z"
       },
-      "fedora-next": {
-        "generated": "2023-11-01T09:45:21Z"
+      "fedora-coreos-pool": {
+        "generated": "2023-11-18T23:11:26Z"
       },
-      "fedora-next-updates": {
-        "generated": "2018-02-20T19:13:29Z"
+      "fedora-updates": {
+        "generated": "2023-11-19T01:15:53Z"
       }
     }
   }
diff --git a/manifest-lock.overrides.aarch64.yaml b/manifest-lock.overrides.aarch64.yaml
deleted file mode 100644
index b41b52d6f9..0000000000
--- a/manifest-lock.overrides.aarch64.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-# This lockfile should be used to pin to a package version (`type: pin`) or to
-# fast-track packages ahead of Bodhi (`type: fast-track`). Fast-tracked
-# packages will automatically be removed once they are in the stable repos.
-#
-# IMPORTANT: YAML comments *will not* be preserved. All `pin` overrides *must*
-# include a URL in the `metadata.reason` key. Overrides of type `fast-track`
-# *should* include a Bodhi update URL in the `metadata.bodhi` key and a URL
-# in the `metadata.reason` key, though it's acceptable to omit a `reason`
-# for FCOS-specific packages (ignition, afterburn, etc.).
-
-packages:
-  crun-wasm:
-    evra: 1.11-1.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0a1f1f38a9
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-common:
-    evra: 1:2.06-104.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-efi-aa64:
-    evra: 1:2.06-104.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools:
-    evra: 1:2.06-104.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools-minimal:
-    evra: 1:2.06-104.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libatomic:
-    evra: 13.2.1-4.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libgcc:
-    evra: 13.2.1-4.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libstdc++:
-    evra: 13.2.1-4.fc39.aarch64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
diff --git a/manifest-lock.overrides.ppc64le.yaml b/manifest-lock.overrides.ppc64le.yaml
deleted file mode 100644
index bd7c860b73..0000000000
--- a/manifest-lock.overrides.ppc64le.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-# This lockfile should be used to pin to a package version (`type: pin`) or to
-# fast-track packages ahead of Bodhi (`type: fast-track`). Fast-tracked
-# packages will automatically be removed once they are in the stable repos.
-#
-# IMPORTANT: YAML comments *will not* be preserved. All `pin` overrides *must*
-# include a URL in the `metadata.reason` key. Overrides of type `fast-track`
-# *should* include a Bodhi update URL in the `metadata.bodhi` key and a URL
-# in the `metadata.reason` key, though it's acceptable to omit a `reason`
-# for FCOS-specific packages (ignition, afterburn, etc.).
-
-packages:
-  grub2-common:
-    evra: 1:2.06-104.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-ppc64le:
-    evra: 1:2.06-104.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-ppc64le-modules:
-    evra: 1:2.06-104.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools:
-    evra: 1:2.06-104.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools-minimal:
-    evra: 1:2.06-104.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libatomic:
-    evra: 13.2.1-4.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libgcc:
-    evra: 13.2.1-4.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libstdc++:
-    evra: 13.2.1-4.fc39.ppc64le
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
diff --git a/manifest-lock.overrides.s390x.yaml b/manifest-lock.overrides.s390x.yaml
deleted file mode 100644
index aeae81f80e..0000000000
--- a/manifest-lock.overrides.s390x.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# This lockfile should be used to pin to a package version (`type: pin`) or to
-# fast-track packages ahead of Bodhi (`type: fast-track`). Fast-tracked
-# packages will automatically be removed once they are in the stable repos.
-#
-# IMPORTANT: YAML comments *will not* be preserved. All `pin` overrides *must*
-# include a URL in the `metadata.reason` key. Overrides of type `fast-track`
-# *should* include a Bodhi update URL in the `metadata.bodhi` key and a URL
-# in the `metadata.reason` key, though it's acceptable to omit a `reason`
-# for FCOS-specific packages (ignition, afterburn, etc.).
-
-
-packages:
-  libatomic:
-    evra: 13.2.1-4.fc39.s390x
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libgcc:
-    evra: 13.2.1-4.fc39.s390x
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libstdc++:
-    evra: 13.2.1-4.fc39.s390x
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
diff --git a/manifest-lock.overrides.x86_64.yaml b/manifest-lock.overrides.x86_64.yaml
deleted file mode 100644
index 3286d33224..0000000000
--- a/manifest-lock.overrides.x86_64.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-# This lockfile should be used to pin to a package version (`type: pin`) or to
-# fast-track packages ahead of Bodhi (`type: fast-track`). Fast-tracked
-# packages will automatically be removed once they are in the stable repos.
-#
-# IMPORTANT: YAML comments *will not* be preserved. All `pin` overrides *must*
-# include a URL in the `metadata.reason` key. Overrides of type `fast-track`
-# *should* include a Bodhi update URL in the `metadata.bodhi` key and a URL
-# in the `metadata.reason` key, though it's acceptable to omit a `reason`
-# for FCOS-specific packages (ignition, afterburn, etc.).
-
-packages:
-  crun-wasm:
-    evra: 1.11-1.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0a1f1f38a9
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-common:
-    evra: 1:2.06-104.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-efi-x64:
-    evra: 1:2.06-104.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-pc:
-    evra: 1:2.06-104.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-pc-modules:
-    evra: 1:2.06-104.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools:
-    evra: 1:2.06-104.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  grub2-tools-minimal:
-    evra: 1:2.06-104.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f46483e5b5
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libgcc:
-    evra: 13.2.1-4.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libstdc++:
-    evra: 13.2.1-4.fc39.x86_64
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1c6c5ebe1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
diff --git a/manifest-lock.overrides.yaml b/manifest-lock.overrides.yaml
index 66e90a866d..5fb815abff 100644
--- a/manifest-lock.overrides.yaml
+++ b/manifest-lock.overrides.yaml
@@ -9,179 +9,11 @@
 # for FCOS-specific packages (ignition, afterburn, etc.).
 
 packages:
-  aardvark-dns:
-    evr: 1.8.0-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d97c0821fa
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  bind-libs:
-    evr: 32:9.18.19-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b4acb0f7c6
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  bind-license:
-    evra: 32:9.18.19-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b4acb0f7c6
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  bind-utils:
-    evr: 32:9.18.19-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b4acb0f7c6
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  container-selinux:
-    evra: 2:2.224.0-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b1dc756a08
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
   containerd:
     evr: 1.6.19-2.fc39
     metadata:
       reason: https://github.com/coreos/fedora-coreos-tracker/issues/1578
       type: pin
-  crun:
-    evr: 1.11-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0a1f1f38a9
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  fwupd:
-    evr: 1.9.6-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-e629516951
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  google-compute-engine-guest-configs-udev:
-    evra: 20230929.00-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-4e6f9b9b1a
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  gvisor-tap-vsock-gvforwarder:
-    evr: 6:0.7.1-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-817ed9e906
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  kernel:
-    evr: 6.5.9-300.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-cfd46a8051
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  kernel-core:
-    evr: 6.5.9-300.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-cfd46a8051
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  kernel-modules:
-    evr: 6.5.9-300.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-cfd46a8051
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  kernel-modules-core:
-    evr: 6.5.9-300.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-cfd46a8051
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libnet:
-    evr: 1.3-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-bd2629d771
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  libsolv:
-    evr: 0.7.25-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-741a85e537
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  netavark:
-    evr: 1.8.0-2.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-45ddc00341
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  oniguruma:
-    evr: 6.9.9-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-2060e8fdb9
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  passt:
-    evr: 0^20231004.gf851084-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d7f3eb64c1
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  passt-selinux:
-    evra: 0^20231004.gf851084-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d7f3eb64c1
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  rpm-ostree:
-    evr: 2023.8-2.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-2628cc885c
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  rpm-ostree-libs:
-    evr: 2023.8-2.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-2628cc885c
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  selinux-policy:
-    evra: 39.1-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-24872e50a0
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  selinux-policy-targeted:
-    evra: 39.1-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-24872e50a0
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  skopeo:
-    evr: 1:1.13.3-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-35b56210f0
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  slirp4netns:
-    evr: 1.2.2-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-3b0f23654b
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  vim-data:
-    evra: 2:9.0.2048-1.fc39.noarch
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1976197889
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  vim-minimal:
-    evr: 2:9.0.2048-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-1976197889
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
-  zchunk-libs:
-    evr: 1.3.2-1.fc39
-    metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-14ee3e26c2
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1490#issuecomment-1720020468
-      type: fast-track
   zincati:
     evr: 0.0.25-6.fc39
     metadata:
diff --git a/manifest-lock.ppc64le.json b/manifest-lock.ppc64le.json
index 7412ffc66b..4aa6245200 100644
--- a/manifest-lock.ppc64le.json
+++ b/manifest-lock.ppc64le.json
@@ -1,22 +1,22 @@
 {
   "packages": {
     "NetworkManager": {
-      "evra": "1:1.44.0-1.fc39.ppc64le"
+      "evra": "1:1.44.2-1.fc39.ppc64le"
     },
     "NetworkManager-cloud-setup": {
-      "evra": "1:1.44.0-1.fc39.ppc64le"
+      "evra": "1:1.44.2-1.fc39.ppc64le"
     },
     "NetworkManager-libnm": {
-      "evra": "1:1.44.0-1.fc39.ppc64le"
+      "evra": "1:1.44.2-1.fc39.ppc64le"
     },
     "NetworkManager-team": {
-      "evra": "1:1.44.0-1.fc39.ppc64le"
+      "evra": "1:1.44.2-1.fc39.ppc64le"
     },
     "NetworkManager-tui": {
-      "evra": "1:1.44.0-1.fc39.ppc64le"
+      "evra": "1:1.44.2-1.fc39.ppc64le"
     },
     "WALinuxAgent-udev": {
-      "evra": "2.9.0.4-4.fc39.noarch"
+      "evra": "2.9.1.1-1.fc39.noarch"
     },
     "aardvark-dns": {
       "evra": "1.8.0-1.fc39.ppc64le"
@@ -37,10 +37,10 @@
       "evra": "1.25-1.fc39.ppc64le"
     },
     "amd-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "attr": {
       "evra": "2.5.1-8.fc39.ppc64le"
@@ -64,10 +64,10 @@
       "evra": "11-18.fc39.noarch"
     },
     "bash": {
-      "evra": "5.2.15-5.fc39.ppc64le"
+      "evra": "5.2.21-1.fc39.ppc64le"
     },
     "bash-color-prompt": {
-      "evra": "0.1-6.fc39.noarch"
+      "evra": "0.2-1.fc39.noarch"
     },
     "bash-completion": {
       "evra": "1:2.11-12.fc39.noarch"
@@ -85,7 +85,7 @@
       "evra": "32:9.18.19-1.fc39.ppc64le"
     },
     "brcmfmac-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "bsdtar": {
       "evra": "3.7.1-1.fc39.ppc64le"
@@ -133,7 +133,7 @@
       "evra": "0.33-3.fc39.noarch"
     },
     "conmon": {
-      "evra": "2:2.1.7-3.fc39.ppc64le"
+      "evra": "2:2.1.8-2.fc39.ppc64le"
     },
     "console-login-helper-messages": {
       "evra": "0.21.3-6.fc39.noarch"
@@ -187,10 +187,10 @@
       "evra": "3.18-3.fc39.ppc64le"
     },
     "crun": {
-      "evra": "1.11-1.fc39.ppc64le"
+      "evra": "1.11.1-1.fc39.ppc64le"
     },
     "crypto-policies": {
-      "evra": "20230731-1.git5ed06e0.fc39.noarch"
+      "evra": "20231113-1.gitb402e82.fc39.noarch"
     },
     "cryptsetup": {
       "evra": "2.6.1-3.fc39.ppc64le"
@@ -250,13 +250,13 @@
       "evra": "4.2-7.fc39.ppc64le"
     },
     "dracut": {
-      "evra": "059-15.fc39.ppc64le"
+      "evra": "059-16.fc39.ppc64le"
     },
     "dracut-network": {
-      "evra": "059-15.fc39.ppc64le"
+      "evra": "059-16.fc39.ppc64le"
     },
     "dracut-squash": {
-      "evra": "059-15.fc39.ppc64le"
+      "evra": "059-16.fc39.ppc64le"
     },
     "duktape": {
       "evra": "2.7.0-5.fc39.ppc64le"
@@ -268,13 +268,13 @@
       "evra": "1.47.0-2.fc39.ppc64le"
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.189-4.fc39.noarch"
+      "evra": "0.190-1.fc39.noarch"
     },
     "elfutils-libelf": {
-      "evra": "0.189-4.fc39.ppc64le"
+      "evra": "0.190-1.fc39.ppc64le"
     },
     "elfutils-libs": {
-      "evra": "0.189-4.fc39.ppc64le"
+      "evra": "0.190-1.fc39.ppc64le"
     },
     "ethtool": {
       "evra": "2:6.5-1.fc39.ppc64le"
@@ -316,7 +316,7 @@
       "evra": "1:4.9.0-5.fc39.ppc64le"
     },
     "flatpak-session-helper": {
-      "evra": "1.15.4-3.fc39.ppc64le"
+      "evra": "1.15.4-4.fc39.ppc64le"
     },
     "fstrm": {
       "evra": "0.6.1-8.fc39.ppc64le"
@@ -343,7 +343,7 @@
       "evra": "3.16.1-1.fc39.ppc64le"
     },
     "fwupd": {
-      "evra": "1.9.6-1.fc39.ppc64le"
+      "evra": "1.9.7-1.fc39.ppc64le"
     },
     "gawk": {
       "evra": "5.2.2-2.fc39.ppc64le"
@@ -364,28 +364,28 @@
       "evra": "0.22-2.fc39.ppc64le"
     },
     "git-core": {
-      "evra": "2.41.0-2.fc39.ppc64le"
+      "evra": "2.42.0-2.fc39.ppc64le"
     },
     "glib2": {
-      "evra": "2.78.0-3.fc39.ppc64le"
+      "evra": "2.78.1-1.fc39.ppc64le"
     },
     "glibc": {
-      "evra": "2.38-7.fc39.ppc64le"
+      "evra": "2.38-10.fc39.ppc64le"
     },
     "glibc-common": {
-      "evra": "2.38-7.fc39.ppc64le"
+      "evra": "2.38-10.fc39.ppc64le"
     },
     "glibc-gconv-extra": {
-      "evra": "2.38-7.fc39.ppc64le"
+      "evra": "2.38-10.fc39.ppc64le"
     },
     "glibc-minimal-langpack": {
-      "evra": "2.38-7.fc39.ppc64le"
+      "evra": "2.38-10.fc39.ppc64le"
     },
     "gmp": {
       "evra": "1:6.2.1-5.fc39.ppc64le"
     },
     "gnupg2": {
-      "evra": "2.4.3-2.fc39.ppc64le"
+      "evra": "2.4.3-4.fc39.ppc64le"
     },
     "gnutls": {
       "evra": "3.8.1-1.fc39.ppc64le"
@@ -397,19 +397,19 @@
       "evra": "3.11-3.fc39.ppc64le"
     },
     "grub2-common": {
-      "evra": "1:2.06-104.fc39.noarch"
+      "evra": "1:2.06-109.fc39.noarch"
     },
     "grub2-ppc64le": {
-      "evra": "1:2.06-104.fc39.ppc64le"
+      "evra": "1:2.06-109.fc39.ppc64le"
     },
     "grub2-ppc64le-modules": {
-      "evra": "1:2.06-104.fc39.noarch"
+      "evra": "1:2.06-109.fc39.noarch"
     },
     "grub2-tools": {
-      "evra": "1:2.06-104.fc39.ppc64le"
+      "evra": "1:2.06-109.fc39.ppc64le"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-104.fc39.ppc64le"
+      "evra": "1:2.06-109.fc39.ppc64le"
     },
     "gvisor-tap-vsock-gvforwarder": {
       "evra": "6:0.7.1-1.fc39.ppc64le"
@@ -427,7 +427,7 @@
       "evra": "57-2.fc39.ppc64le"
     },
     "intel-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-2.fc39.ppc64le"
@@ -499,16 +499,16 @@
       "evra": "2.6.3-1.fc39.noarch"
     },
     "kernel": {
-      "evra": "6.5.9-300.fc39.ppc64le"
+      "evra": "6.5.11-300.fc39.ppc64le"
     },
     "kernel-core": {
-      "evra": "6.5.9-300.fc39.ppc64le"
+      "evra": "6.5.11-300.fc39.ppc64le"
     },
     "kernel-modules": {
-      "evra": "6.5.9-300.fc39.ppc64le"
+      "evra": "6.5.11-300.fc39.ppc64le"
     },
     "kernel-modules-core": {
-      "evra": "6.5.9-300.fc39.ppc64le"
+      "evra": "6.5.11-300.fc39.ppc64le"
     },
     "kexec-tools": {
       "evra": "2.0.27-2.fc39.ppc64le"
@@ -529,7 +529,7 @@
       "evra": "0.9.5-2.fc39.ppc64le"
     },
     "krb5-libs": {
-      "evra": "1.21.2-1.fc39.ppc64le"
+      "evra": "1.21.2-2.fc39.ppc64le"
     },
     "less": {
       "evra": "633-2.fc39.ppc64le"
@@ -612,9 +612,6 @@
     "libfido2": {
       "evra": "1.13.0-3.fc39.ppc64le"
     },
-    "libgcab1": {
-      "evra": "1.6-2.fc39.ppc64le"
-    },
     "libgcc": {
       "evra": "13.2.1-4.fc39.ppc64le"
     },
@@ -628,7 +625,7 @@
       "evra": "238-2.fc39.ppc64le"
     },
     "libgusb": {
-      "evra": "0.4.6-2.fc39.ppc64le"
+      "evra": "0.4.8-1.fc39.ppc64le"
     },
     "libibverbs": {
       "evra": "46.0-4.fc39.ppc64le"
@@ -643,7 +640,7 @@
       "evra": "1.3.1-54.fc39.ppc64le"
     },
     "libipa_hbac": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "libjcat": {
       "evra": "0.1.14-2.fc39.ppc64le"
@@ -694,19 +691,19 @@
       "evra": "1.0.1-24.fc39.ppc64le"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-1.rc3.fc39.ppc64le"
+      "evra": "1:2.6.3-2.rc3.fc39.ppc64le"
     },
     "libnftnl": {
       "evra": "1.2.6-2.fc39.ppc64le"
     },
     "libnghttp2": {
-      "evra": "1.55.1-2.fc39.ppc64le"
+      "evra": "1.55.1-4.fc39.ppc64le"
     },
     "libnl3": {
-      "evra": "3.8.0-1.fc39.ppc64le"
+      "evra": "3.8.0-2.fc39.ppc64le"
     },
     "libnl3-cli": {
-      "evra": "3.8.0-1.fc39.ppc64le"
+      "evra": "3.8.0-2.fc39.ppc64le"
     },
     "libnsl2": {
       "evra": "2.0.0-6.fc39.ppc64le"
@@ -769,7 +766,7 @@
       "evra": "2.39.2-1.fc39.ppc64le"
     },
     "libsmbclient": {
-      "evra": "2:4.19.0-1.fc39.ppc64le"
+      "evra": "2:4.19.2-1.fc39.ppc64le"
     },
     "libsolv": {
       "evra": "0.7.25-1.fc39.ppc64le"
@@ -778,16 +775,16 @@
       "evra": "1.47.0-2.fc39.ppc64le"
     },
     "libsss_certmap": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "libsss_idmap": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "libsss_nss_idmap": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "libsss_sudo": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "libstdc++": {
       "evra": "13.2.1-4.fc39.ppc64le"
@@ -808,7 +805,7 @@
       "evra": "0.15.0-1.fc39.ppc64le"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc2.fc39.ppc64le"
+      "evra": "1.3.4-0.fc39.ppc64le"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-7.fc39.ppc64le"
@@ -835,7 +832,7 @@
       "evra": "0.3.2-6.fc39.ppc64le"
     },
     "libwbclient": {
-      "evra": "2:4.19.0-1.fc39.ppc64le"
+      "evra": "2:4.19.2-1.fc39.ppc64le"
     },
     "libxcrypt": {
       "evra": "4.4.36-2.fc39.ppc64le"
@@ -856,10 +853,10 @@
       "evra": "2.5.1-36.fc39.ppc64le"
     },
     "linux-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-2.fc39.ppc64le"
@@ -898,7 +895,7 @@
       "evra": "4.2.0-3.fc39.ppc64le"
     },
     "mt7xxx-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nano": {
       "evra": "7.2-4.fc39.ppc64le"
@@ -928,7 +925,7 @@
       "evra": "0.52.23-4.fc39.ppc64le"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-1.rc3.fc39.ppc64le"
+      "evra": "1:2.6.3-2.rc3.fc39.ppc64le"
     },
     "nftables": {
       "evra": "1:1.0.7-3.fc39.ppc64le"
@@ -946,10 +943,10 @@
       "evra": "2.0.16-3.fc39.ppc64le"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nvme-cli": {
-      "evra": "2.5-4.fc39.ppc64le"
+      "evra": "2.6-1.fc39.ppc64le"
     },
     "oniguruma": {
       "evra": "6.9.9-1.fc39.ppc64le"
@@ -976,25 +973,25 @@
       "evra": "1.81-4.fc39.ppc64le"
     },
     "ostree": {
-      "evra": "2023.6-1.fc39.ppc64le"
+      "evra": "2023.7-2.fc39.ppc64le"
     },
     "ostree-grub2": {
-      "evra": "2023.6-1.fc39.ppc64le"
+      "evra": "2023.7-2.fc39.ppc64le"
     },
     "ostree-libs": {
-      "evra": "2023.6-1.fc39.ppc64le"
+      "evra": "2023.7-2.fc39.ppc64le"
     },
     "p11-kit": {
-      "evra": "0.25.0-2.fc39.ppc64le"
+      "evra": "0.25.3-1.fc39.ppc64le"
     },
     "p11-kit-trust": {
-      "evra": "0.25.0-2.fc39.ppc64le"
+      "evra": "0.25.3-1.fc39.ppc64le"
     },
     "pam": {
-      "evra": "1.5.3-2.fc39.ppc64le"
+      "evra": "1.5.3-3.fc39.ppc64le"
     },
     "pam-libs": {
-      "evra": "1.5.3-2.fc39.ppc64le"
+      "evra": "1.5.3-3.fc39.ppc64le"
     },
     "passt": {
       "evra": "0^20231004.gf851084-1.fc39.ppc64le"
@@ -1024,13 +1021,13 @@
       "evra": "1.9.5-2.fc39.ppc64le"
     },
     "podman": {
-      "evra": "5:4.7.0-1.fc39.ppc64le"
+      "evra": "5:4.7.2-1.fc39.ppc64le"
     },
     "podman-plugins": {
-      "evra": "5:4.7.0-1.fc39.ppc64le"
+      "evra": "5:4.7.2-1.fc39.ppc64le"
     },
     "policycoreutils": {
-      "evra": "3.5-7.fc39.ppc64le"
+      "evra": "3.5-8.fc39.ppc64le"
     },
     "polkit": {
       "evra": "123-1.fc39.ppc64le"
@@ -1051,7 +1048,7 @@
       "evra": "2.7.9-4.fc39.ppc64le"
     },
     "procps-ng": {
-      "evra": "4.0.3-4.fc39.ppc64le"
+      "evra": "4.0.3-5.fc39.ppc64le"
     },
     "protobuf-c": {
       "evra": "1.4.1-5.fc39.ppc64le"
@@ -1063,13 +1060,13 @@
       "evra": "20230812-1.fc39.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:8.1.0-1.fc39.ppc64le"
+      "evra": "2:8.1.1-1.fc39.ppc64le"
     },
     "readline": {
       "evra": "8.2-4.fc39.ppc64le"
     },
     "realtek-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc39.1.ppc64le"
@@ -1099,22 +1096,22 @@
       "evra": "2:1.1.8-1.fc39.ppc64le"
     },
     "samba-client-libs": {
-      "evra": "2:4.19.0-1.fc39.ppc64le"
+      "evra": "2:4.19.2-1.fc39.ppc64le"
     },
     "samba-common": {
-      "evra": "2:4.19.0-1.fc39.noarch"
+      "evra": "2:4.19.2-1.fc39.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.19.0-1.fc39.ppc64le"
+      "evra": "2:4.19.2-1.fc39.ppc64le"
     },
     "sed": {
       "evra": "4.8-14.fc39.ppc64le"
     },
     "selinux-policy": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "servicelog": {
       "evra": "1.1.16-5.fc39.ppc64le"
@@ -1129,10 +1126,10 @@
       "evra": "1.46-6.fc39.ppc64le"
     },
     "shadow-utils": {
-      "evra": "2:4.14.0-1.fc39.ppc64le"
+      "evra": "2:4.14.0-2.fc39.ppc64le"
     },
     "shadow-utils-subid": {
-      "evra": "2:4.14.0-1.fc39.ppc64le"
+      "evra": "2:4.14.0-2.fc39.ppc64le"
     },
     "shared-mime-info": {
       "evra": "2.2-4.fc39.ppc64le"
@@ -1141,7 +1138,7 @@
       "evra": "1:1.13.3-1.fc39.ppc64le"
     },
     "slang": {
-      "evra": "2.3.3-3.fc38.ppc64le"
+      "evra": "2.3.3-4.fc39.ppc64le"
     },
     "slirp4netns": {
       "evra": "1.2.2-1.fc39.ppc64le"
@@ -1162,31 +1159,31 @@
       "evra": "0.1.4-4.fc39.ppc64le"
     },
     "sssd-ad": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-client": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-common": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-common-pac": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-ipa": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-krb5": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-krb5-common": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-ldap": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "sssd-nfs-idmap": {
-      "evra": "2.9.2-1.fc39.ppc64le"
+      "evra": "2.9.2-3.fc39.ppc64le"
     },
     "stalld": {
       "evra": "1.16-4.fc39.ppc64le"
@@ -1219,7 +1216,7 @@
       "evra": "1.32-1.fc39.ppc64le"
     },
     "toolbox": {
-      "evra": "0.0.99.4-3.fc39.ppc64le"
+      "evra": "0.0.99.4-5.fc39.ppc64le"
     },
     "tpm2-tools": {
       "evra": "5.5-4.fc39.ppc64le"
@@ -1240,10 +1237,10 @@
       "evra": "2.39.2-1.fc39.ppc64le"
     },
     "vim-data": {
-      "evra": "2:9.0.2048-1.fc39.noarch"
+      "evra": "2:9.0.2105-1.fc39.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.2048-1.fc39.ppc64le"
+      "evra": "2:9.0.2105-1.fc39.ppc64le"
     },
     "which": {
       "evra": "2.21-40.fc39.ppc64le"
@@ -1270,7 +1267,7 @@
       "evra": "1.3.2-1.fc39.ppc64le"
     },
     "zincati": {
-      "evra": "0.0.26-2.fc39.ppc64le"
+      "evra": "0.0.25-6.fc39.ppc64le"
     },
     "zlib": {
       "evra": "1.2.13-4.fc39.ppc64le"
@@ -1283,16 +1280,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-11-01T00:00:00Z",
+    "generated": "2023-11-19T00:00:00Z",
     "rpmmd_repos": {
-      "fedora-coreos-pool": {
-        "generated": "2023-11-01T00:47:25Z"
+      "fedora": {
+        "generated": "2023-11-01T00:12:28Z"
       },
-      "fedora-next": {
-        "generated": "2023-11-01T09:45:23Z"
+      "fedora-coreos-pool": {
+        "generated": "2023-11-18T23:10:40Z"
       },
-      "fedora-next-updates": {
-        "generated": "2018-02-28T16:06:00Z"
+      "fedora-updates": {
+        "generated": "2023-11-19T01:15:57Z"
       }
     }
   }
diff --git a/manifest-lock.s390x.json b/manifest-lock.s390x.json
index 9818b73c5e..2410692168 100644
--- a/manifest-lock.s390x.json
+++ b/manifest-lock.s390x.json
@@ -1,22 +1,22 @@
 {
   "packages": {
     "NetworkManager": {
-      "evra": "1:1.44.0-1.fc39.s390x"
+      "evra": "1:1.44.2-1.fc39.s390x"
     },
     "NetworkManager-cloud-setup": {
-      "evra": "1:1.44.0-1.fc39.s390x"
+      "evra": "1:1.44.2-1.fc39.s390x"
     },
     "NetworkManager-libnm": {
-      "evra": "1:1.44.0-1.fc39.s390x"
+      "evra": "1:1.44.2-1.fc39.s390x"
     },
     "NetworkManager-team": {
-      "evra": "1:1.44.0-1.fc39.s390x"
+      "evra": "1:1.44.2-1.fc39.s390x"
     },
     "NetworkManager-tui": {
-      "evra": "1:1.44.0-1.fc39.s390x"
+      "evra": "1:1.44.2-1.fc39.s390x"
     },
     "WALinuxAgent-udev": {
-      "evra": "2.9.0.4-4.fc39.noarch"
+      "evra": "2.9.1.1-1.fc39.noarch"
     },
     "aardvark-dns": {
       "evra": "1.8.0-1.fc39.s390x"
@@ -37,10 +37,10 @@
       "evra": "1.25-1.fc39.s390x"
     },
     "amd-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "attr": {
       "evra": "2.5.1-8.fc39.s390x"
@@ -64,10 +64,10 @@
       "evra": "11-18.fc39.noarch"
     },
     "bash": {
-      "evra": "5.2.15-5.fc39.s390x"
+      "evra": "5.2.21-1.fc39.s390x"
     },
     "bash-color-prompt": {
-      "evra": "0.1-6.fc39.noarch"
+      "evra": "0.2-1.fc39.noarch"
     },
     "bash-completion": {
       "evra": "1:2.11-12.fc39.noarch"
@@ -82,7 +82,7 @@
       "evra": "32:9.18.19-1.fc39.s390x"
     },
     "brcmfmac-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "bsdtar": {
       "evra": "3.7.1-1.fc39.s390x"
@@ -130,7 +130,7 @@
       "evra": "0.33-3.fc39.noarch"
     },
     "conmon": {
-      "evra": "2:2.1.7-3.fc39.s390x"
+      "evra": "2:2.1.8-2.fc39.s390x"
     },
     "console-login-helper-messages": {
       "evra": "0.21.3-6.fc39.noarch"
@@ -184,10 +184,10 @@
       "evra": "3.18-3.fc39.s390x"
     },
     "crun": {
-      "evra": "1.11-1.fc39.s390x"
+      "evra": "1.11.1-1.fc39.s390x"
     },
     "crypto-policies": {
-      "evra": "20230731-1.git5ed06e0.fc39.noarch"
+      "evra": "20231113-1.gitb402e82.fc39.noarch"
     },
     "cryptsetup": {
       "evra": "2.6.1-3.fc39.s390x"
@@ -247,13 +247,13 @@
       "evra": "4.2-7.fc39.s390x"
     },
     "dracut": {
-      "evra": "059-15.fc39.s390x"
+      "evra": "059-16.fc39.s390x"
     },
     "dracut-network": {
-      "evra": "059-15.fc39.s390x"
+      "evra": "059-16.fc39.s390x"
     },
     "dracut-squash": {
-      "evra": "059-15.fc39.s390x"
+      "evra": "059-16.fc39.s390x"
     },
     "duktape": {
       "evra": "2.7.0-5.fc39.s390x"
@@ -265,13 +265,13 @@
       "evra": "1.47.0-2.fc39.s390x"
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.189-4.fc39.noarch"
+      "evra": "0.190-1.fc39.noarch"
     },
     "elfutils-libelf": {
-      "evra": "0.189-4.fc39.s390x"
+      "evra": "0.190-1.fc39.s390x"
     },
     "elfutils-libs": {
-      "evra": "0.189-4.fc39.s390x"
+      "evra": "0.190-1.fc39.s390x"
     },
     "ethtool": {
       "evra": "2:6.5-1.fc39.s390x"
@@ -313,7 +313,7 @@
       "evra": "1:4.9.0-5.fc39.s390x"
     },
     "flatpak-session-helper": {
-      "evra": "1.15.4-3.fc39.s390x"
+      "evra": "1.15.4-4.fc39.s390x"
     },
     "fstrm": {
       "evra": "0.6.1-8.fc39.s390x"
@@ -340,7 +340,7 @@
       "evra": "3.16.1-1.fc39.s390x"
     },
     "fwupd": {
-      "evra": "1.9.6-1.fc39.s390x"
+      "evra": "1.9.7-1.fc39.s390x"
     },
     "gawk": {
       "evra": "5.2.2-2.fc39.s390x"
@@ -352,28 +352,28 @@
       "evra": "1.0.9-6.fc39.s390x"
     },
     "git-core": {
-      "evra": "2.41.0-2.fc39.s390x"
+      "evra": "2.42.0-2.fc39.s390x"
     },
     "glib2": {
-      "evra": "2.78.0-3.fc39.s390x"
+      "evra": "2.78.1-1.fc39.s390x"
     },
     "glibc": {
-      "evra": "2.38-7.fc39.s390x"
+      "evra": "2.38-10.fc39.s390x"
     },
     "glibc-common": {
-      "evra": "2.38-7.fc39.s390x"
+      "evra": "2.38-10.fc39.s390x"
     },
     "glibc-gconv-extra": {
-      "evra": "2.38-7.fc39.s390x"
+      "evra": "2.38-10.fc39.s390x"
     },
     "glibc-minimal-langpack": {
-      "evra": "2.38-7.fc39.s390x"
+      "evra": "2.38-10.fc39.s390x"
     },
     "gmp": {
       "evra": "1:6.2.1-5.fc39.s390x"
     },
     "gnupg2": {
-      "evra": "2.4.3-2.fc39.s390x"
+      "evra": "2.4.3-4.fc39.s390x"
     },
     "gnutls": {
       "evra": "3.8.1-1.fc39.s390x"
@@ -400,7 +400,7 @@
       "evra": "57-2.fc39.s390x"
     },
     "intel-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-2.fc39.s390x"
@@ -469,16 +469,16 @@
       "evra": "2.6.3-1.fc39.noarch"
     },
     "kernel": {
-      "evra": "6.5.9-300.fc39.s390x"
+      "evra": "6.5.11-300.fc39.s390x"
     },
     "kernel-core": {
-      "evra": "6.5.9-300.fc39.s390x"
+      "evra": "6.5.11-300.fc39.s390x"
     },
     "kernel-modules": {
-      "evra": "6.5.9-300.fc39.s390x"
+      "evra": "6.5.11-300.fc39.s390x"
     },
     "kernel-modules-core": {
-      "evra": "6.5.9-300.fc39.s390x"
+      "evra": "6.5.11-300.fc39.s390x"
     },
     "kexec-tools": {
       "evra": "2.0.27-2.fc39.s390x"
@@ -499,7 +499,7 @@
       "evra": "0.9.5-2.fc39.s390x"
     },
     "krb5-libs": {
-      "evra": "1.21.2-1.fc39.s390x"
+      "evra": "1.21.2-2.fc39.s390x"
     },
     "less": {
       "evra": "633-2.fc39.s390x"
@@ -582,9 +582,6 @@
     "libfido2": {
       "evra": "1.13.0-3.fc39.s390x"
     },
-    "libgcab1": {
-      "evra": "1.6-2.fc39.s390x"
-    },
     "libgcc": {
       "evra": "13.2.1-4.fc39.s390x"
     },
@@ -598,7 +595,7 @@
       "evra": "238-2.fc39.s390x"
     },
     "libgusb": {
-      "evra": "0.4.6-2.fc39.s390x"
+      "evra": "0.4.8-1.fc39.s390x"
     },
     "libibverbs": {
       "evra": "46.0-4.fc39.s390x"
@@ -613,7 +610,7 @@
       "evra": "1.3.1-54.fc39.s390x"
     },
     "libipa_hbac": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "libjcat": {
       "evra": "0.1.14-2.fc39.s390x"
@@ -664,19 +661,19 @@
       "evra": "1.0.1-24.fc39.s390x"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-1.rc3.fc39.s390x"
+      "evra": "1:2.6.3-2.rc3.fc39.s390x"
     },
     "libnftnl": {
       "evra": "1.2.6-2.fc39.s390x"
     },
     "libnghttp2": {
-      "evra": "1.55.1-2.fc39.s390x"
+      "evra": "1.55.1-4.fc39.s390x"
     },
     "libnl3": {
-      "evra": "3.8.0-1.fc39.s390x"
+      "evra": "3.8.0-2.fc39.s390x"
     },
     "libnl3-cli": {
-      "evra": "3.8.0-1.fc39.s390x"
+      "evra": "3.8.0-2.fc39.s390x"
     },
     "libnsl2": {
       "evra": "2.0.0-6.fc39.s390x"
@@ -733,7 +730,7 @@
       "evra": "2.39.2-1.fc39.s390x"
     },
     "libsmbclient": {
-      "evra": "2:4.19.0-1.fc39.s390x"
+      "evra": "2:4.19.2-1.fc39.s390x"
     },
     "libsolv": {
       "evra": "0.7.25-1.fc39.s390x"
@@ -742,16 +739,16 @@
       "evra": "1.47.0-2.fc39.s390x"
     },
     "libsss_certmap": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "libsss_idmap": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "libsss_nss_idmap": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "libsss_sudo": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "libstdc++": {
       "evra": "13.2.1-4.fc39.s390x"
@@ -772,7 +769,7 @@
       "evra": "0.15.0-1.fc39.s390x"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc2.fc39.s390x"
+      "evra": "1.3.4-0.fc39.s390x"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-7.fc39.s390x"
@@ -799,7 +796,7 @@
       "evra": "0.3.2-6.fc39.s390x"
     },
     "libwbclient": {
-      "evra": "2:4.19.0-1.fc39.s390x"
+      "evra": "2:4.19.2-1.fc39.s390x"
     },
     "libxcrypt": {
       "evra": "4.4.36-2.fc39.s390x"
@@ -820,10 +817,10 @@
       "evra": "2.5.1-36.fc39.s390x"
     },
     "linux-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-2.fc39.s390x"
@@ -862,7 +859,7 @@
       "evra": "4.2.0-3.fc39.s390x"
     },
     "mt7xxx-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nano": {
       "evra": "7.2-4.fc39.s390x"
@@ -892,7 +889,7 @@
       "evra": "0.52.23-4.fc39.s390x"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-1.rc3.fc39.s390x"
+      "evra": "1:2.6.3-2.rc3.fc39.s390x"
     },
     "nftables": {
       "evra": "1:1.0.7-3.fc39.s390x"
@@ -907,10 +904,10 @@
       "evra": "2.23.0-1.fc39.s390x"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nvme-cli": {
-      "evra": "2.5-4.fc39.s390x"
+      "evra": "2.6-1.fc39.s390x"
     },
     "oniguruma": {
       "evra": "6.9.9-1.fc39.s390x"
@@ -934,22 +931,22 @@
       "evra": "1:3.1.1-4.fc39.s390x"
     },
     "ostree": {
-      "evra": "2023.6-1.fc39.s390x"
+      "evra": "2023.7-2.fc39.s390x"
     },
     "ostree-libs": {
-      "evra": "2023.6-1.fc39.s390x"
+      "evra": "2023.7-2.fc39.s390x"
     },
     "p11-kit": {
-      "evra": "0.25.0-2.fc39.s390x"
+      "evra": "0.25.3-1.fc39.s390x"
     },
     "p11-kit-trust": {
-      "evra": "0.25.0-2.fc39.s390x"
+      "evra": "0.25.3-1.fc39.s390x"
     },
     "pam": {
-      "evra": "1.5.3-2.fc39.s390x"
+      "evra": "1.5.3-3.fc39.s390x"
     },
     "pam-libs": {
-      "evra": "1.5.3-2.fc39.s390x"
+      "evra": "1.5.3-3.fc39.s390x"
     },
     "passt": {
       "evra": "0^20231004.gf851084-1.fc39.s390x"
@@ -979,13 +976,13 @@
       "evra": "1.9.5-2.fc39.s390x"
     },
     "podman": {
-      "evra": "5:4.7.0-1.fc39.s390x"
+      "evra": "5:4.7.2-1.fc39.s390x"
     },
     "podman-plugins": {
-      "evra": "5:4.7.0-1.fc39.s390x"
+      "evra": "5:4.7.2-1.fc39.s390x"
     },
     "policycoreutils": {
-      "evra": "3.5-7.fc39.s390x"
+      "evra": "3.5-8.fc39.s390x"
     },
     "polkit": {
       "evra": "123-1.fc39.s390x"
@@ -1000,7 +997,7 @@
       "evra": "1.19-3.fc39.s390x"
     },
     "procps-ng": {
-      "evra": "4.0.3-4.fc39.s390x"
+      "evra": "4.0.3-5.fc39.s390x"
     },
     "protobuf-c": {
       "evra": "1.4.1-5.fc39.s390x"
@@ -1012,13 +1009,13 @@
       "evra": "20230812-1.fc39.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:8.1.0-1.fc39.s390x"
+      "evra": "2:8.1.1-1.fc39.s390x"
     },
     "readline": {
       "evra": "8.2-4.fc39.s390x"
     },
     "realtek-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc39.1.s390x"
@@ -1051,22 +1048,22 @@
       "evra": "2:2.29.0-2.fc39.s390x"
     },
     "samba-client-libs": {
-      "evra": "2:4.19.0-1.fc39.s390x"
+      "evra": "2:4.19.2-1.fc39.s390x"
     },
     "samba-common": {
-      "evra": "2:4.19.0-1.fc39.noarch"
+      "evra": "2:4.19.2-1.fc39.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.19.0-1.fc39.s390x"
+      "evra": "2:4.19.2-1.fc39.s390x"
     },
     "sed": {
       "evra": "4.8-14.fc39.s390x"
     },
     "selinux-policy": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "setup": {
       "evra": "2.14.4-1.fc39.noarch"
@@ -1078,10 +1075,10 @@
       "evra": "1.46-6.fc39.s390x"
     },
     "shadow-utils": {
-      "evra": "2:4.14.0-1.fc39.s390x"
+      "evra": "2:4.14.0-2.fc39.s390x"
     },
     "shadow-utils-subid": {
-      "evra": "2:4.14.0-1.fc39.s390x"
+      "evra": "2:4.14.0-2.fc39.s390x"
     },
     "shared-mime-info": {
       "evra": "2.2-4.fc39.s390x"
@@ -1090,7 +1087,7 @@
       "evra": "1:1.13.3-1.fc39.s390x"
     },
     "slang": {
-      "evra": "2.3.3-3.fc38.s390x"
+      "evra": "2.3.3-4.fc39.s390x"
     },
     "slirp4netns": {
       "evra": "1.2.2-1.fc39.s390x"
@@ -1111,31 +1108,31 @@
       "evra": "0.1.4-4.fc39.s390x"
     },
     "sssd-ad": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-client": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-common": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-common-pac": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-ipa": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-krb5": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-krb5-common": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-ldap": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "sssd-nfs-idmap": {
-      "evra": "2.9.2-1.fc39.s390x"
+      "evra": "2.9.2-3.fc39.s390x"
     },
     "stalld": {
       "evra": "1.16-4.fc39.s390x"
@@ -1168,7 +1165,7 @@
       "evra": "1.32-1.fc39.s390x"
     },
     "toolbox": {
-      "evra": "0.0.99.4-3.fc39.s390x"
+      "evra": "0.0.99.4-5.fc39.s390x"
     },
     "tpm2-tools": {
       "evra": "5.5-4.fc39.s390x"
@@ -1192,10 +1189,10 @@
       "evra": "2.6.1-3.fc39.s390x"
     },
     "vim-data": {
-      "evra": "2:9.0.2048-1.fc39.noarch"
+      "evra": "2:9.0.2105-1.fc39.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.2048-1.fc39.s390x"
+      "evra": "2:9.0.2105-1.fc39.s390x"
     },
     "which": {
       "evra": "2.21-40.fc39.s390x"
@@ -1222,7 +1219,7 @@
       "evra": "1.3.2-1.fc39.s390x"
     },
     "zincati": {
-      "evra": "0.0.26-2.fc39.s390x"
+      "evra": "0.0.25-6.fc39.s390x"
     },
     "zlib": {
       "evra": "1.2.13-4.fc39.s390x"
@@ -1235,16 +1232,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-11-01T00:00:00Z",
+    "generated": "2023-11-19T00:00:00Z",
     "rpmmd_repos": {
-      "fedora-coreos-pool": {
-        "generated": "2023-11-01T00:48:36Z"
+      "fedora": {
+        "generated": "2023-11-01T00:12:19Z"
       },
-      "fedora-next": {
-        "generated": "2023-11-01T09:45:14Z"
+      "fedora-coreos-pool": {
+        "generated": "2023-11-18T23:11:17Z"
       },
-      "fedora-next-updates": {
-        "generated": "2018-02-28T16:06:49Z"
+      "fedora-updates": {
+        "generated": "2023-11-19T01:16:01Z"
       }
     }
   }
diff --git a/manifest-lock.x86_64.json b/manifest-lock.x86_64.json
index 46dabf5098..364fe790e7 100644
--- a/manifest-lock.x86_64.json
+++ b/manifest-lock.x86_64.json
@@ -1,22 +1,22 @@
 {
   "packages": {
     "NetworkManager": {
-      "evra": "1:1.44.0-1.fc39.x86_64"
+      "evra": "1:1.44.2-1.fc39.x86_64"
     },
     "NetworkManager-cloud-setup": {
-      "evra": "1:1.44.0-1.fc39.x86_64"
+      "evra": "1:1.44.2-1.fc39.x86_64"
     },
     "NetworkManager-libnm": {
-      "evra": "1:1.44.0-1.fc39.x86_64"
+      "evra": "1:1.44.2-1.fc39.x86_64"
     },
     "NetworkManager-team": {
-      "evra": "1:1.44.0-1.fc39.x86_64"
+      "evra": "1:1.44.2-1.fc39.x86_64"
     },
     "NetworkManager-tui": {
-      "evra": "1:1.44.0-1.fc39.x86_64"
+      "evra": "1:1.44.2-1.fc39.x86_64"
     },
     "WALinuxAgent-udev": {
-      "evra": "2.9.0.4-4.fc39.noarch"
+      "evra": "2.9.1.1-1.fc39.noarch"
     },
     "aardvark-dns": {
       "evra": "1.8.0-1.fc39.x86_64"
@@ -37,10 +37,10 @@
       "evra": "1.25-1.fc39.x86_64"
     },
     "amd-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "attr": {
       "evra": "2.5.1-8.fc39.x86_64"
@@ -64,10 +64,10 @@
       "evra": "11-18.fc39.noarch"
     },
     "bash": {
-      "evra": "5.2.15-5.fc39.x86_64"
+      "evra": "5.2.21-1.fc39.x86_64"
     },
     "bash-color-prompt": {
-      "evra": "0.1-6.fc39.noarch"
+      "evra": "0.2-1.fc39.noarch"
     },
     "bash-completion": {
       "evra": "1:2.11-12.fc39.noarch"
@@ -82,10 +82,10 @@
       "evra": "32:9.18.19-1.fc39.x86_64"
     },
     "bootupd": {
-      "evra": "0.2.11-3.fc39.x86_64"
+      "evra": "0.2.12-2.fc39.x86_64"
     },
     "brcmfmac-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "bsdtar": {
       "evra": "3.7.1-1.fc39.x86_64"
@@ -133,7 +133,7 @@
       "evra": "0.33-3.fc39.noarch"
     },
     "conmon": {
-      "evra": "2:2.1.7-3.fc39.x86_64"
+      "evra": "2:2.1.8-2.fc39.x86_64"
     },
     "console-login-helper-messages": {
       "evra": "0.21.3-6.fc39.noarch"
@@ -187,13 +187,13 @@
       "evra": "3.18-3.fc39.x86_64"
     },
     "crun": {
-      "evra": "1.11-1.fc39.x86_64"
+      "evra": "1.11.1-1.fc39.x86_64"
     },
     "crun-wasm": {
-      "evra": "1.11-1.fc39.x86_64"
+      "evra": "1.11.1-1.fc39.x86_64"
     },
     "crypto-policies": {
-      "evra": "20230731-1.git5ed06e0.fc39.noarch"
+      "evra": "20231113-1.gitb402e82.fc39.noarch"
     },
     "cryptsetup": {
       "evra": "2.6.1-3.fc39.x86_64"
@@ -253,13 +253,13 @@
       "evra": "4.2-7.fc39.x86_64"
     },
     "dracut": {
-      "evra": "059-15.fc39.x86_64"
+      "evra": "059-16.fc39.x86_64"
     },
     "dracut-network": {
-      "evra": "059-15.fc39.x86_64"
+      "evra": "059-16.fc39.x86_64"
     },
     "dracut-squash": {
-      "evra": "059-15.fc39.x86_64"
+      "evra": "059-16.fc39.x86_64"
     },
     "duktape": {
       "evra": "2.7.0-5.fc39.x86_64"
@@ -280,13 +280,13 @@
       "evra": "38-8.fc39.x86_64"
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.189-4.fc39.noarch"
+      "evra": "0.190-1.fc39.noarch"
     },
     "elfutils-libelf": {
-      "evra": "0.189-4.fc39.x86_64"
+      "evra": "0.190-1.fc39.x86_64"
     },
     "elfutils-libs": {
-      "evra": "0.189-4.fc39.x86_64"
+      "evra": "0.190-1.fc39.x86_64"
     },
     "ethtool": {
       "evra": "2:6.5-1.fc39.x86_64"
@@ -328,7 +328,7 @@
       "evra": "1:4.9.0-5.fc39.x86_64"
     },
     "flatpak-session-helper": {
-      "evra": "1.15.4-3.fc39.x86_64"
+      "evra": "1.15.4-4.fc39.x86_64"
     },
     "fmt": {
       "evra": "10.0.0-3.fc39.x86_64"
@@ -358,7 +358,7 @@
       "evra": "3.16.1-1.fc39.x86_64"
     },
     "fwupd": {
-      "evra": "1.9.6-1.fc39.x86_64"
+      "evra": "1.9.7-1.fc39.x86_64"
     },
     "gawk": {
       "evra": "5.2.2-2.fc39.x86_64"
@@ -379,28 +379,28 @@
       "evra": "0.22-2.fc39.x86_64"
     },
     "git-core": {
-      "evra": "2.41.0-2.fc39.x86_64"
+      "evra": "2.42.0-2.fc39.x86_64"
     },
     "glib2": {
-      "evra": "2.78.0-3.fc39.x86_64"
+      "evra": "2.78.1-1.fc39.x86_64"
     },
     "glibc": {
-      "evra": "2.38-7.fc39.x86_64"
+      "evra": "2.38-10.fc39.x86_64"
     },
     "glibc-common": {
-      "evra": "2.38-7.fc39.x86_64"
+      "evra": "2.38-10.fc39.x86_64"
     },
     "glibc-gconv-extra": {
-      "evra": "2.38-7.fc39.x86_64"
+      "evra": "2.38-10.fc39.x86_64"
     },
     "glibc-minimal-langpack": {
-      "evra": "2.38-7.fc39.x86_64"
+      "evra": "2.38-10.fc39.x86_64"
     },
     "gmp": {
       "evra": "1:6.2.1-5.fc39.x86_64"
     },
     "gnupg2": {
-      "evra": "2.4.3-2.fc39.x86_64"
+      "evra": "2.4.3-4.fc39.x86_64"
     },
     "gnutls": {
       "evra": "3.8.1-1.fc39.x86_64"
@@ -415,22 +415,22 @@
       "evra": "3.11-3.fc39.x86_64"
     },
     "grub2-common": {
-      "evra": "1:2.06-104.fc39.noarch"
+      "evra": "1:2.06-109.fc39.noarch"
     },
     "grub2-efi-x64": {
-      "evra": "1:2.06-104.fc39.x86_64"
+      "evra": "1:2.06-109.fc39.x86_64"
     },
     "grub2-pc": {
-      "evra": "1:2.06-104.fc39.x86_64"
+      "evra": "1:2.06-109.fc39.x86_64"
     },
     "grub2-pc-modules": {
-      "evra": "1:2.06-104.fc39.noarch"
+      "evra": "1:2.06-109.fc39.noarch"
     },
     "grub2-tools": {
-      "evra": "1:2.06-104.fc39.x86_64"
+      "evra": "1:2.06-109.fc39.x86_64"
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.06-104.fc39.x86_64"
+      "evra": "1:2.06-109.fc39.x86_64"
     },
     "gvisor-tap-vsock-gvforwarder": {
       "evra": "6:0.7.1-1.fc39.x86_64"
@@ -448,7 +448,7 @@
       "evra": "57-2.fc39.x86_64"
     },
     "intel-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-2.fc39.x86_64"
@@ -520,16 +520,16 @@
       "evra": "2.6.3-1.fc39.noarch"
     },
     "kernel": {
-      "evra": "6.5.9-300.fc39.x86_64"
+      "evra": "6.5.11-300.fc39.x86_64"
     },
     "kernel-core": {
-      "evra": "6.5.9-300.fc39.x86_64"
+      "evra": "6.5.11-300.fc39.x86_64"
     },
     "kernel-modules": {
-      "evra": "6.5.9-300.fc39.x86_64"
+      "evra": "6.5.11-300.fc39.x86_64"
     },
     "kernel-modules-core": {
-      "evra": "6.5.9-300.fc39.x86_64"
+      "evra": "6.5.11-300.fc39.x86_64"
     },
     "kexec-tools": {
       "evra": "2.0.27-2.fc39.x86_64"
@@ -550,7 +550,7 @@
       "evra": "0.9.5-2.fc39.x86_64"
     },
     "krb5-libs": {
-      "evra": "1.21.2-1.fc39.x86_64"
+      "evra": "1.21.2-2.fc39.x86_64"
     },
     "less": {
       "evra": "633-2.fc39.x86_64"
@@ -630,9 +630,6 @@
     "libfido2": {
       "evra": "1.13.0-3.fc39.x86_64"
     },
-    "libgcab1": {
-      "evra": "1.6-2.fc39.x86_64"
-    },
     "libgcc": {
       "evra": "13.2.1-4.fc39.x86_64"
     },
@@ -646,7 +643,7 @@
       "evra": "238-2.fc39.x86_64"
     },
     "libgusb": {
-      "evra": "0.4.6-2.fc39.x86_64"
+      "evra": "0.4.8-1.fc39.x86_64"
     },
     "libibverbs": {
       "evra": "46.0-4.fc39.x86_64"
@@ -661,7 +658,7 @@
       "evra": "1.3.1-54.fc39.x86_64"
     },
     "libipa_hbac": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "libjcat": {
       "evra": "0.1.14-2.fc39.x86_64"
@@ -712,19 +709,19 @@
       "evra": "1.0.1-24.fc39.x86_64"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-1.rc3.fc39.x86_64"
+      "evra": "1:2.6.3-2.rc3.fc39.x86_64"
     },
     "libnftnl": {
       "evra": "1.2.6-2.fc39.x86_64"
     },
     "libnghttp2": {
-      "evra": "1.55.1-2.fc39.x86_64"
+      "evra": "1.55.1-4.fc39.x86_64"
     },
     "libnl3": {
-      "evra": "3.8.0-1.fc39.x86_64"
+      "evra": "3.8.0-2.fc39.x86_64"
     },
     "libnl3-cli": {
-      "evra": "3.8.0-1.fc39.x86_64"
+      "evra": "3.8.0-2.fc39.x86_64"
     },
     "libnsl2": {
       "evra": "2.0.0-6.fc39.x86_64"
@@ -781,7 +778,7 @@
       "evra": "2.39.2-1.fc39.x86_64"
     },
     "libsmbclient": {
-      "evra": "2:4.19.0-1.fc39.x86_64"
+      "evra": "2:4.19.2-1.fc39.x86_64"
     },
     "libsolv": {
       "evra": "0.7.25-1.fc39.x86_64"
@@ -790,16 +787,16 @@
       "evra": "1.47.0-2.fc39.x86_64"
     },
     "libsss_certmap": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "libsss_idmap": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "libsss_nss_idmap": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "libsss_sudo": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "libstdc++": {
       "evra": "13.2.1-4.fc39.x86_64"
@@ -820,7 +817,7 @@
       "evra": "0.15.0-1.fc39.x86_64"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc2.fc39.x86_64"
+      "evra": "1.3.4-0.fc39.x86_64"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-7.fc39.x86_64"
@@ -847,7 +844,7 @@
       "evra": "0.3.2-6.fc39.x86_64"
     },
     "libwbclient": {
-      "evra": "2:4.19.0-1.fc39.x86_64"
+      "evra": "2:4.19.2-1.fc39.x86_64"
     },
     "libxcrypt": {
       "evra": "4.4.36-2.fc39.x86_64"
@@ -868,10 +865,10 @@
       "evra": "2.5.1-36.fc39.x86_64"
     },
     "linux-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-2.fc39.x86_64"
@@ -904,7 +901,7 @@
       "evra": "4.2-6.fc39.x86_64"
     },
     "microcode_ctl": {
-      "evra": "2:2.1-57.fc39.x86_64"
+      "evra": "2:2.1-58.fc39.x86_64"
     },
     "moby-engine": {
       "evra": "24.0.5-1.fc39.x86_64"
@@ -916,7 +913,7 @@
       "evra": "4.2.0-3.fc39.x86_64"
     },
     "mt7xxx-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nano": {
       "evra": "7.2-4.fc39.x86_64"
@@ -946,7 +943,7 @@
       "evra": "0.52.23-4.fc39.x86_64"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-1.rc3.fc39.x86_64"
+      "evra": "1:2.6.3-2.rc3.fc39.x86_64"
     },
     "nftables": {
       "evra": "1:1.0.7-3.fc39.x86_64"
@@ -964,10 +961,10 @@
       "evra": "2.0.16-3.fc39.x86_64"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "nvme-cli": {
-      "evra": "2.5-4.fc39.x86_64"
+      "evra": "2.6-1.fc39.x86_64"
     },
     "oniguruma": {
       "evra": "6.9.9-1.fc39.x86_64"
@@ -994,22 +991,22 @@
       "evra": "1.81-4.fc39.x86_64"
     },
     "ostree": {
-      "evra": "2023.6-1.fc39.x86_64"
+      "evra": "2023.7-2.fc39.x86_64"
     },
     "ostree-libs": {
-      "evra": "2023.6-1.fc39.x86_64"
+      "evra": "2023.7-2.fc39.x86_64"
     },
     "p11-kit": {
-      "evra": "0.25.0-2.fc39.x86_64"
+      "evra": "0.25.3-1.fc39.x86_64"
     },
     "p11-kit-trust": {
-      "evra": "0.25.0-2.fc39.x86_64"
+      "evra": "0.25.3-1.fc39.x86_64"
     },
     "pam": {
-      "evra": "1.5.3-2.fc39.x86_64"
+      "evra": "1.5.3-3.fc39.x86_64"
     },
     "pam-libs": {
-      "evra": "1.5.3-2.fc39.x86_64"
+      "evra": "1.5.3-3.fc39.x86_64"
     },
     "passt": {
       "evra": "0^20231004.gf851084-1.fc39.x86_64"
@@ -1039,13 +1036,13 @@
       "evra": "1.9.5-2.fc39.x86_64"
     },
     "podman": {
-      "evra": "5:4.7.0-1.fc39.x86_64"
+      "evra": "5:4.7.2-1.fc39.x86_64"
     },
     "podman-plugins": {
-      "evra": "5:4.7.0-1.fc39.x86_64"
+      "evra": "5:4.7.2-1.fc39.x86_64"
     },
     "policycoreutils": {
-      "evra": "3.5-7.fc39.x86_64"
+      "evra": "3.5-8.fc39.x86_64"
     },
     "polkit": {
       "evra": "123-1.fc39.x86_64"
@@ -1060,7 +1057,7 @@
       "evra": "1.19-3.fc39.x86_64"
     },
     "procps-ng": {
-      "evra": "4.0.3-4.fc39.x86_64"
+      "evra": "4.0.3-5.fc39.x86_64"
     },
     "protobuf-c": {
       "evra": "1.4.1-5.fc39.x86_64"
@@ -1075,7 +1072,7 @@
       "evra": "8.2-4.fc39.x86_64"
     },
     "realtek-firmware": {
-      "evra": "20230919-1.fc39.noarch"
+      "evra": "20231111-1.fc39.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc39.1.x86_64"
@@ -1105,22 +1102,22 @@
       "evra": "2:1.1.8-1.fc39.x86_64"
     },
     "samba-client-libs": {
-      "evra": "2:4.19.0-1.fc39.x86_64"
+      "evra": "2:4.19.2-1.fc39.x86_64"
     },
     "samba-common": {
-      "evra": "2:4.19.0-1.fc39.noarch"
+      "evra": "2:4.19.2-1.fc39.noarch"
     },
     "samba-common-libs": {
-      "evra": "2:4.19.0-1.fc39.x86_64"
+      "evra": "2:4.19.2-1.fc39.x86_64"
     },
     "sed": {
       "evra": "4.8-14.fc39.x86_64"
     },
     "selinux-policy": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.29-1.fc39.noarch"
+      "evra": "39.1-1.fc39.noarch"
     },
     "setup": {
       "evra": "2.14.4-1.fc39.noarch"
@@ -1132,10 +1129,10 @@
       "evra": "1.46-6.fc39.x86_64"
     },
     "shadow-utils": {
-      "evra": "2:4.14.0-1.fc39.x86_64"
+      "evra": "2:4.14.0-2.fc39.x86_64"
     },
     "shadow-utils-subid": {
-      "evra": "2:4.14.0-1.fc39.x86_64"
+      "evra": "2:4.14.0-2.fc39.x86_64"
     },
     "shared-mime-info": {
       "evra": "2.2-4.fc39.x86_64"
@@ -1147,7 +1144,7 @@
       "evra": "1:1.13.3-1.fc39.x86_64"
     },
     "slang": {
-      "evra": "2.3.3-3.fc38.x86_64"
+      "evra": "2.3.3-4.fc39.x86_64"
     },
     "slirp4netns": {
       "evra": "1.2.2-1.fc39.x86_64"
@@ -1171,31 +1168,31 @@
       "evra": "0.1.4-4.fc39.x86_64"
     },
     "sssd-ad": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-client": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-common": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-common-pac": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-ipa": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-krb5": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-krb5-common": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-ldap": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "sssd-nfs-idmap": {
-      "evra": "2.9.2-1.fc39.x86_64"
+      "evra": "2.9.2-3.fc39.x86_64"
     },
     "stalld": {
       "evra": "1.16-4.fc39.x86_64"
@@ -1228,7 +1225,7 @@
       "evra": "1.32-1.fc39.x86_64"
     },
     "toolbox": {
-      "evra": "0.0.99.4-3.fc39.x86_64"
+      "evra": "0.0.99.4-5.fc39.x86_64"
     },
     "tpm2-tools": {
       "evra": "5.5-4.fc39.x86_64"
@@ -1249,13 +1246,13 @@
       "evra": "2.39.2-1.fc39.x86_64"
     },
     "vim-data": {
-      "evra": "2:9.0.2048-1.fc39.noarch"
+      "evra": "2:9.0.2105-1.fc39.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.2048-1.fc39.x86_64"
+      "evra": "2:9.0.2105-1.fc39.x86_64"
     },
     "wasmedge-rt": {
-      "evra": "0.13.3-1.fc39.x86_64"
+      "evra": "0.13.4-1.fc39.x86_64"
     },
     "which": {
       "evra": "2.21-40.fc39.x86_64"
@@ -1282,7 +1279,7 @@
       "evra": "1.3.2-1.fc39.x86_64"
     },
     "zincati": {
-      "evra": "0.0.26-2.fc39.x86_64"
+      "evra": "0.0.25-6.fc39.x86_64"
     },
     "zlib": {
       "evra": "1.2.13-4.fc39.x86_64"
@@ -1295,16 +1292,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-11-01T00:00:00Z",
+    "generated": "2023-11-19T00:00:00Z",
     "rpmmd_repos": {
-      "fedora-coreos-pool": {
-        "generated": "2023-11-01T00:48:16Z"
+      "fedora": {
+        "generated": "2023-11-01T00:12:39Z"
       },
-      "fedora-next": {
-        "generated": "2023-11-01T09:45:36Z"
+      "fedora-coreos-pool": {
+        "generated": "2023-11-18T23:12:59Z"
       },
-      "fedora-next-updates": {
-        "generated": "2018-02-20T19:18:14Z"
+      "fedora-updates": {
+        "generated": "2023-11-19T01:16:05Z"
       }
     }
   }
diff --git a/manifests/crun-wasm.yaml b/manifests/crun-wasm.yaml
deleted file mode 100644
index e9700c6bdc..0000000000
--- a/manifests/crun-wasm.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-# for podman experimentation:
-# https://github.com/coreos/fedora-coreos-tracker/issues/1375
-packages:
-  - crun-wasm wasmedge-rt
diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index 8a4f83f3d9..f81e687999 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -174,14 +174,16 @@ packages:
 #   - Include this on non-x86_64 FCOS images to allow access to the large
 #     inventory of containers only built for x86_64.
 #     https://github.com/coreos/fedora-coreos-tracker/issues/1237
-#
 # - google-compute-engine-guest-configs-udev
 #   - Add this package on x86_64 and aarch64 (the two architectures
 #     GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494
 #     This should be moved to a shared manifest when RHEL has this package.
+# - crun-wasm wasmedge-rt
+#   - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375
 packages-x86_64:
   - irqbalance
   - google-compute-engine-guest-configs-udev
+  - crun-wasm wasmedge-rt
 packages-ppc64le:
   - irqbalance
   - librtas
@@ -192,6 +194,7 @@ packages-aarch64:
   - irqbalance
   - qemu-user-static-x86
   - google-compute-engine-guest-configs-udev
+  - crun-wasm wasmedge-rt
 packages-s390x:
   - qemu-user-static-x86
 
diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index 2115a986d1..77be73f3f1 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -23,19 +23,9 @@ conditional-include:
   - if: basearch != "s390x"
     # And remove some cruft from grub2
     include: grub2-removals.yaml
-  - if: basearch == "ppc64le"
-    # Need OSTree autopruning on ppc64le (because kernels aren't compressed)
-    # until we increase the size of /boot.
-    # https://github.com/coreos/fedora-coreos-tracker/issues/1247#issuecomment-1355314761
-    # https://github.com/coreos/fedora-coreos-tracker/issues/1495#issuecomment-1561765705
-    include: ostree-autoprune.yaml
   - if:
-      - basearch == "aarch64"
-      - releasever >= 39
-    # In F39+ we will stop removing the qcom dtb files and thus we'll leverage OSTree autopruning
-    # so that we don't run into https://github.com/coreos/fedora-coreos-tracker/issues/1464
-    # again. OSTree autopruning is new so we're selectively enabling it before making it the default.
-    include: ostree-autoprune.yaml
+      - releasever >= 40
+    include: ostree-bls.yaml
   - if:
       - basearch == "aarch64"
       - releasever == 38
diff --git a/manifests/ostree-autoprune.yaml b/manifests/ostree-autoprune.yaml
deleted file mode 100644
index 44f3b4d370..0000000000
--- a/manifests/ostree-autoprune.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Enable OSTree autopruning to help with /boot size constraints
-# https://github.com/coreos/fedora-coreos-tracker/issues/1495
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/systemd/system/ostree-finalize-staged.service.d
-    cat <<'EOF' > /usr/lib/systemd/system/ostree-finalize-staged.service.d/ostree-autoprune.conf
-    [Service]
-    # https://github.com/coreos/fedora-coreos-tracker/issues/1495
-    Environment=OSTREE_SYSROOT_OPTS=early-prune
-    EOF
diff --git a/manifests/ostree-bls.yaml b/manifests/ostree-bls.yaml
new file mode 100644
index 0000000000..5d99cf7316
--- /dev/null
+++ b/manifests/ostree-bls.yaml
@@ -0,0 +1,10 @@
+# Enable fixed OSTree grub2 naming
+# https://github.com/ostreedev/ostree/pull/3007
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    mkdir -p /usr/lib/systemd/system/ostree-finalize-staged.service.d
+    cat <<'EOF' > /usr/lib/systemd/system/ostree-finalize-staged.service.d/ostree-bls-naming.conf
+    [Service]
+    Environment=OSTREE_SYSROOT_OPTS=bootloader-naming-2
+    EOF
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
index e7d1d688c3..51d61cbc30 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
@@ -13,6 +13,7 @@ set -e
 exec 1>/dev/kmsg; exec 2>&1
 
 UNIT_DIR="${1:-/tmp}"
+EARLY_DIR="${2:-/tmp}"
 
 IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)"
 cmdline_arg() {
@@ -84,17 +85,37 @@ if ! $(cmdline_bool 'ignition.firstboot' 0); then
     exit 0
 fi
 
-# coreos-ignition-setup-user.service should depend on the boot device node
-# only on diskful boots
+# coreos-ignition-setup-user.service and `coreos-copy-firstboot-network.service`
+# should depend on the boot device node only on diskful boots
 mkdir -p "${UNIT_DIR}/coreos-ignition-setup-user.service.d"
+mkdir -p "${UNIT_DIR}/coreos-copy-firstboot-network.service.d"
 cat > "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" <<EOF
 [Unit]
 Requires=dev-disk-by\x2dlabel-boot.device
 After=dev-disk-by\x2dlabel-boot.device
-
-Requires=coreos-gpt-setup.service
-After=coreos-gpt-setup.service
 EOF
+cp "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" \
+    "${UNIT_DIR}/coreos-copy-firstboot-network.service.d/diskful.conf"
+
+# If booting from iSCSI, then we need networking first before we
+# can see the bootfs. This has some implications.
+if test -n "$(cmdline_arg rd.iscsi.firmware)" || test -n "$(cmdline_arg netroot)"; then
+    mkdir -p "${EARLY_DIR}/ignition-complete.target.requires"
+
+    # In the injected Ignition config case, `coreos-ignition-setup-user.service`
+    # can't "pass" the config to `ignition-fetch-offline.service`. So we neuter
+    # the latter so that `ignition-fetch.service` (which runs after networking
+    # comes up) can pick it up instead.
+    ln -sf /dev/null "${EARLY_DIR}/ignition-complete.target.requires/ignition-fetch-offline.service"
+    # activate ignition-fetch.service
+    mkdir -p /run/ignition
+    touch /run/ignition/neednet
+
+    # With iSCSI, configuring networking via kargs is a hard requirement
+    # since it can't be picked up from the bootfs (i.e. injected via
+    # `--copy-network`). So neuter `coreos-copy-firstboot-network.service`.
+    ln -sf /dev/null "${EARLY_DIR}/ignition-complete.target.requires/coreos-copy-firstboot-network.service"
+fi
 
 # create symlink for udev rule
 mkdir -p /run/udev/rules.d/
@@ -124,4 +145,9 @@ StandardOutput=null
 StandardError=null
 EOF
     done
+
+    # This one is done dynamically because it hard Requires a device to appear
+    # and if it's always part of the transaction, systemd will want the device
+    # to appear regardless of ConditionPathExists.
+    add_requires coreos-secex-ignition-decrypt.service ignition-diskful.target
 fi
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.service
index f14f2e72f5..629bb60f49 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.service
@@ -1,31 +1,25 @@
 [Unit]
 Description=Generate New UUID For Boot Disk GPT
 ConditionPathExists=/etc/initrd-release
-DefaultDependencies=no
-Before=local-fs-pre.target systemd-fsck-root.service
+Before=systemd-fsck-root.service
 Before=ignition-diskful.target
-Wants=systemd-udevd.service
-After=systemd-udevd.service
 
-# This unit must be the first to run when the disk holding the root partition
-# becomes available. To avoid relying on the name of the root partition which
-# is different between RHCOS LUKS setup and current FCOS setup, we wait for the
-# partition labeled 'boot' to become available. This is reliable as we don't
-# have any plan to support re-provisioning/re-writing the /boot partition,
-#
-# This is the only unit where it is safe to wait only on a specific disk label
-# as this will call udevadm settle after the GPT setup. Units that requires the
-# boot and root partitions to be available should order themselves after this
-# unit.
+# Have some ordering with this service since it also wants to access the bootfs.
+# We run after it since that service runs early and is skipped if we're on
+# iSCSI, but we still run.
+After=coreos-copy-firstboot-network.service
+
 Requires=dev-disk-by\x2dlabel-boot.device
 After=dev-disk-by\x2dlabel-boot.device
+
 # And since the boot device may be on multipath; optionally wait for it to
 # appear via the dynamic target.
-After=coreos-multipath-wait.target
+After=coreos-unique-boot.service
+Before=ignition-ostree-uuid-boot.service
 
 # Run before services that use device nodes, preventing them from racing
 # with udev activity generated by sgdisk
-Before=coreos-ignition-setup-user.service ignition-disks.service
+Before=ignition-kargs.service
 
 OnFailure=emergency.target
 OnFailureJobMode=isolate
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.service
index df0e256c8a..3728641512 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.service
@@ -4,15 +4,17 @@ Documentation=https://github.com/coreos/ignition
 ConditionPathExists=/etc/initrd-release
 DefaultDependencies=false
 
-# We run before config fetch because we may copy in new/different configs
-# for Ignition to consume.
-Before=ignition-fetch-offline.service
+# We run before config fetch because we may copy in new/different
+# configs for Ignition to consume. We include both fetch stages since
+# ignition-fetch-offline.service is neutered in a root on iSCSI boot (see
+# `coreos-diskful-generator`).
+Before=ignition-fetch-offline.service ignition-fetch.service
 
 OnFailure=emergency.target
 OnFailureJobMode=isolate
 
 # On diskful boots, coreos-diskful-generator adds Requires/After on
-# dev-disk-by\x2dlabel-boot.device and coreos-gpt-setup.service
+# dev-disk-by\x2dlabel-boot.device
 
 [Service]
 Type=oneshot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.service
index 02283bc3d0..e52a29348f 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.service
@@ -1,3 +1,5 @@
+# This service is enabled by coreos-diskful-generator
+
 [Unit]
 Description=CoreOS Secex Ignition Config Decryptor
 ConditionPathExists=/etc/initrd-release
@@ -7,8 +9,9 @@ DefaultDependencies=false
 OnFailure=emergency.target
 OnFailureJobMode=isolate
 
-# Run after virtio_blk and before Ignition
-After=coreos-gpt-setup.service
+# Run after the crypt device becomes available and before Ignition
+Requires=dev-disk-by\x2did-virtio\x2dignition_crypted.device
+After=dev-disk-by\x2did-virtio\x2dignition_crypted.device
 Before=ignition-fetch-offline.service
 
 [Service]
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-teardown-initramfs.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-teardown-initramfs.sh
index 35d681418b..8312b534a4 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-teardown-initramfs.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-teardown-initramfs.sh
@@ -229,13 +229,22 @@ main() {
     # Load libraries from dracut
     load_dracut_libs
 
-    # Take down all interfaces set up in the initramfs
-    down_interfaces
+    # If we're using iSCSI, then we can't tear down networking since we'll lose
+    # root. This means in that case that the network config written to the real
+    # root won't be applied "from scratch". But anyway, since networking must
+    # stay on, it's simply not supported to configure the real root in a way
+    # that would require tearing down the connection on the interface involved.
+    if dracut_func getargbool 0 rd.iscsi.firmware || dracut_func getarg netroot; then
+        echo "info: iSCSI in use; not tearing down networking"
+    else
+        # Take down all interfaces set up in the initramfs
+        down_interfaces
 
-    # Clean up all routing
-    echo "info: flushing all routing"
-    ip route flush table main
-    ip route flush cache
+        # Clean up all routing
+        echo "info: flushing all routing"
+        ip route flush table main
+        ip route flush cache
+    fi
 
     # Hopefully our logic is sound enough that this is never needed, but
     # user's can explicitly disable initramfs network/hostname propagation
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
index f78725fdc6..b66a0c2782 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
@@ -83,7 +83,8 @@ install() {
 
     # IBM Secure Execution. Ignition config for reencryption of / and /boot
     inst_simple "$moddir/01-secex.ign" /usr/lib/coreos/01-secex.ign
-    install_ignition_unit "coreos-secex-ignition-decrypt.service"
+    inst_simple "$moddir/coreos-secex-ignition-decrypt.service" \
+        "$systemdsystemunitdir/coreos-secex-ignition-decrypt.service"
     inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
         "/usr/sbin/coreos-secex-ignition-decrypt"
 
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
index e0fd500cd4..5da2ee4bd6 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
@@ -11,8 +11,8 @@ After=multipathd.service
 OnFailure=emergency.target
 OnFailureJobMode=isolate
 
-# This is already enforced transitively by coreos-gpt-setup.service, but
-# let's be more explicit and list it directly here too.
+# This is one of the earliest services that accesses the bootfs so make sure we
+# already have our multipath target.
 Before=coreos-ignition-setup-user.service
 
 # This is already enforced by coreos-multipath-trigger.service, though ideally
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.service
index a1dd64b1bb..478dd85253 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-network/coreos-copy-firstboot-network.service
@@ -11,7 +11,7 @@
 # - In the diskful case, we need to look for networking configuration on the
 #   /boot partition
 #     - i.e. after /dev/disk/by-label/boot is available
-#     - which is implied by running after coreos-gpt-setup (see below)
+#     - which is injected via coreos-diskful-generator
 # - Need to run before networking is brought up.
 #     - This is done in nm-initrd.service [1]
 #     - i.e. Before=nm-initrd.service
@@ -41,9 +41,6 @@ Before=nm-initrd.service
 # compat: remove when everyone is on dracut 054+
 Before=dracut-initqueue.service
 After=dracut-cmdline.service
-# Any services looking at mounts need to order after this
-# because it causes device re-probing.
-After=coreos-gpt-setup.service
 # And since the boot device may be on multipath; optionally wait for it to
 # appear via the dynamic target.
 After=coreos-multipath-wait.target
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
index 80415624ce..85448c2a67 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
@@ -1,16 +1,15 @@
 [Unit]
 Description=Ignition OSTree: Regenerate Filesystem UUID (boot)
-DefaultDependencies=false
 ConditionPathExists=/usr/lib/initrd-release
 ConditionKernelCommandLine=ostree
 ConditionPathExists=!/run/ostree-live
-# We run pretty early
-Before=coreos-copy-firstboot-network.service
-Before=coreos-ignition-setup-user.service
-Before=ignition-fetch-offline.service
 # Any services looking at mounts need to order after this
 # because it causes device re-probing.
 After=coreos-gpt-setup.service
+# This could mount the bootfs rw and the ext4 in el9 at least doesn't seem to
+# like doing that in parallel with restamping the UUID
+Before=ignition-kargs.service
+
 # If we're going to reprovision the bootfs, then there's no need to restamp
 ConditionKernelCommandLine=!bootfs.roothash
 
diff --git a/tests/kola/binfmt/qemu b/tests/kola/binfmt/qemu
index 3140ef2920..70282cf188 100755
--- a/tests/kola/binfmt/qemu
+++ b/tests/kola/binfmt/qemu
@@ -20,7 +20,7 @@ set -xeuo pipefail
 
 case "$(arch)" in
     aarch64|ppc64le|s390x)
-        containerArch=$(podman run --arch=amd64 --rm quay.io/fedora/fedora:38 arch)
+        containerArch=$(podman run --arch=amd64 --rm quay.io/fedora/fedora:39 arch)
         if [ "$containerArch" != "x86_64" ]; then
             fatal "Test failed: x86_64 qemu emulator failed to run"
         fi
diff --git a/tests/kola/butane/grub-users/test.sh b/tests/kola/butane/grub-users/test.sh
index beb28f8de4..f31aacbebe 100755
--- a/tests/kola/butane/grub-users/test.sh
+++ b/tests/kola/butane/grub-users/test.sh
@@ -36,18 +36,18 @@ rebooted)
         fatal "Rebooted into old deployment"
     fi
     # cross-check karg with BLS configs
-    if grep -q test-added-karg /boot/loader.0/entries/ostree-1-fedora-coreos.conf; then
+    if grep -q test-added-karg /boot/loader.0/entries/ostree-1*.conf; then
         fatal "Old BLS config contains new karg"
     fi
-    if ! grep -q test-added-karg /boot/loader.0/entries/ostree-2-fedora-coreos.conf; then
+    if ! grep -q test-added-karg /boot/loader.0/entries/ostree-2*.conf; then
         fatal "New BLS config doesn't contain new karg"
     fi
     # old deployment should require a password to boot
-    if ! grep -q '^grub_users ""$' /boot/loader.0/entries/ostree-1-fedora-coreos.conf; then
+    if ! grep -q '^grub_users ""$' /boot/loader.0/entries/ostree-1*.conf; then
         fatal "Missing grub_users setting in old BLS config"
     fi
     # new one should not
-    if grep -q grub_users /boot/loader.0/entries/ostree-2-fedora-coreos.conf; then
+    if grep -q grub_users /boot/loader.0/entries/ostree-2*.conf; then
         fatal "grub_users setting present in new BLS config"
     fi
     ok "BLS grub_users setting"
diff --git a/tests/kola/containers/quadlet/config.bu b/tests/kola/containers/quadlet/config.bu
index a4fb72694f..c21433b5b5 100644
--- a/tests/kola/containers/quadlet/config.bu
+++ b/tests/kola/containers/quadlet/config.bu
@@ -9,7 +9,7 @@ storage:
           Description=A minimal container
 
           [Container]
-          Image=quay.io/fedora/fedora-minimal
+          Image=quay.io/fedora/fedora-minimal:39
           Exec=sleep 60
           Volume=test.volume:/data
           Network=test.network
diff --git a/tests/kola/containers/quadlet/test.sh b/tests/kola/containers/quadlet/test.sh
index 58afc48f9c..aa6bcc78ff 100755
--- a/tests/kola/containers/quadlet/test.sh
+++ b/tests/kola/containers/quadlet/test.sh
@@ -17,7 +17,7 @@ if [[ "$(podman network inspect systemd-test | jq -r '.[0].labels."org.test.Key"
     fatal "Network not correctly created"
 fi
 
-if [[ "$(podman inspect systemd-test | jq -r '.[0].ImageName')" != "quay.io/fedora/fedora-minimal:latest" ]]; then
+if [[ "$(podman inspect systemd-test | jq -r '.[0].ImageName')" != "quay.io/fedora/fedora-minimal:39" ]]; then
     fatal "Container not using the correct image"
 fi
 
diff --git a/tests/kola/docker/basic b/tests/kola/docker/basic
index c1cbafcc1f..e8c970e5ef 100755
--- a/tests/kola/docker/basic
+++ b/tests/kola/docker/basic
@@ -13,6 +13,6 @@ set -xeuo pipefail
 # shellcheck disable=SC1091
 . "$KOLA_EXT_DATA/commonlib.sh"
 
-docker run --rm quay.io/fedora/fedora:38 true
+docker run --rm quay.io/fedora/fedora:39 true
 
 ok "basic docker run successfully"
diff --git a/tests/kola/ntp/data/ntplib.sh b/tests/kola/ntp/data/ntplib.sh
index 262590791e..507e8cea1a 100644
--- a/tests/kola/ntp/data/ntplib.sh
+++ b/tests/kola/ntp/data/ntplib.sh
@@ -20,7 +20,7 @@ ntp_test_setup() {
     # run podman commands to set up dnsmasq server
     pushd "$(mktemp -d)"
     cat <<EOF >Dockerfile
-FROM quay.io/fedora/fedora:38
+FROM quay.io/fedora/fedora:39
 RUN dnf -y install systemd dnsmasq iproute iputils \
 && dnf clean all \
 && systemctl enable dnsmasq
diff --git a/tests/kola/podman/dns/test.sh b/tests/kola/podman/dns/test.sh
index 0e5bb18d9b..b3c77efb8f 100755
--- a/tests/kola/podman/dns/test.sh
+++ b/tests/kola/podman/dns/test.sh
@@ -23,7 +23,7 @@ runascoreuserscript='
 set -euxo pipefail
 
 podman network create testnetwork
-podman run --rm -t --network=testnetwork quay.io/fedora/fedora:38 getent hosts google.com
+podman run --rm -t --network=testnetwork quay.io/fedora/fedora:39 getent hosts google.com
 podman network rm testnetwork
 '
 
diff --git a/tests/kola/podman/rootless-pasta-networking b/tests/kola/podman/rootless-pasta-networking
index 4492360147..ca11c4126e 100755
--- a/tests/kola/podman/rootless-pasta-networking
+++ b/tests/kola/podman/rootless-pasta-networking
@@ -20,7 +20,7 @@ set -xeuo pipefail
 runascoreuserscript='#!/bin/bash
 set -euxo pipefail
 # Just a basic test that uses pasta network and sets the gateway
-podman run -i --net=pasta:--mtu,1500 quay.io/fedora/fedora:38 bash <<"EOF"
+podman run -i --net=pasta:--mtu,1500 quay.io/fedora/fedora:39 bash <<"EOF"
 set -euxo pipefail
 # Verify the mtu got set to 1500. No /sbin/ip so just use /sys/class/net/<nic>/mtu
 cat /sys/class/net/e*/mtu | grep 1500
diff --git a/tests/kola/podman/rootless-systemd b/tests/kola/podman/rootless-systemd
index 07b0d3e480..bae9596532 100755
--- a/tests/kola/podman/rootless-systemd
+++ b/tests/kola/podman/rootless-systemd
@@ -35,7 +35,7 @@ set -euxo pipefail
 #       https://github.com/coreos/coreos-assembler/issues/1645
 cd $(mktemp -d)
 cat <<EOF > Containerfile
-FROM quay.io/fedora/fedora:38
+FROM quay.io/fedora/fedora:39
 RUN dnf -y update \
 && dnf -y install systemd httpd \
 && dnf clean all \
diff --git a/tests/kola/rpm-ostree/kernel-replace b/tests/kola/rpm-ostree/kernel-replace
index 13cacaf0d0..4fd0dd38af 100755
--- a/tests/kola/rpm-ostree/kernel-replace
+++ b/tests/kola/rpm-ostree/kernel-replace
@@ -49,12 +49,22 @@ kver="6.2.9-300.fc38.${arch}"
 case "${AUTOPKGTEST_REBOOT_MARK:-}" in
   "")
     # Take the existing ostree commit, and export it to a container image, then rebase to it.
-    checksum=$(rpm-ostree status --json | jq -r '.deployments[0].checksum')
-    v0=$(rpm-ostree status --json | jq -r '.deployments[0].version')
+    rpm-ostree status --json > status.json
+    checksum=$(jq -r '.deployments[0].checksum' < status.json)
+    v0=$(jq -r '.deployments[0].version' < status.json)
+    imgref=$(jq -r '.deployments[0]["container-image-reference"]' < status.json)
     rm ${image_dir} -rf
+    encapsulate_args=()
+    # A hack...if we're booted into a container, then we need to fake things out
+    # for the merge commit to turn it back into an image.  What we *really* want
+    # here obviously is seamless support for re-serializing a container from
+    # the ostree storage, but right now we're not doing the tar-split stuff.
+    if [[ "$imgref" != null ]]; then
+      encapsulate_args+=("--label" "ostree.bootable=true")
+    fi
     # Since we're switching OS update stream, turn off zincati
     systemctl mask --now zincati
-    ostree container encapsulate --repo=/ostree/repo ${checksum} "${image}"
+    ostree container encapsulate "${encapsulate_args[@]}" --repo=/ostree/repo ${checksum} "${image}"
     # This one keeps --experimental, but we also test without it below
     rpm-ostree rebase --experimental "$image_pull"
     ostree container image list --repo=/ostree/repo | tee imglist.txt
diff --git a/tests/kola/selinux/podman-tmpfs-context b/tests/kola/selinux/podman-tmpfs-context
index 4ec0a3e504..1e033e9f2d 100755
--- a/tests/kola/selinux/podman-tmpfs-context
+++ b/tests/kola/selinux/podman-tmpfs-context
@@ -15,7 +15,7 @@ set -xeuo pipefail
 # shellcheck disable=SC1091
 . "$KOLA_EXT_DATA/commonlib.sh"
 
-context=$(podman run --rm --privileged quay.io/fedora/fedora:38 \
+context=$(podman run --rm --privileged quay.io/fedora/fedora:39 \
             bash -c "mount -t tmpfs tmpfs /mnt/ && stat --format '%C' /mnt/")
 if [ "$context" != "system_u:object_r:container_file_t:s0" ]; then
     fatal "SELinux context for files on a tmpfs inside a container is wrong"
diff --git a/tests/kola/systemd/condition-needs-update b/tests/kola/systemd/condition-needs-update
new file mode 100755
index 0000000000..c99f275b06
--- /dev/null
+++ b/tests/kola/systemd/condition-needs-update
@@ -0,0 +1,64 @@
+#!/bin/bash
+## kola:
+##   tags: "platform-independent"
+##   description: Verify systemd-sysuser.service with `ConditionNeedsUpdate=`
+##     will be triggered with new deployment at boot time.
+
+# See https://github.com/ostreedev/ostree/issues/3069#issuecomment-1798115799
+
+# Systemd units using ConditionNeedsUpdate= run if the mtime of .updated in
+# the specified directory is newer than /usr. Since /usr has an mtime of
+# 0, there's no way to have an older .updated file refer to
+# https://ostreedev.github.io/ostree/repo/#content-objects. Systemd units
+# typically specify ConditionNeedsUpdate=/etc or ConditionNeedsUpdate=/var
+# to support stateless systems like ostree.
+
+# Remove the file .updated from the new deployment's /etc and the OS's /var
+# regardless of where they came from to ensure that these systemd units
+# run when booting new deployments, see
+# https://github.com/ostreedev/ostree/commit/19d18842cf2df944c7e9536494353aefa2916743
+
+set -xeuo pipefail
+
+. "$KOLA_EXT_DATA/commonlib.sh"
+
+username=footest
+kargs="somedummykarg=1"
+
+case "${AUTOPKGTEST_REBOOT_MARK:-}" in
+  "")
+    ok "first boot"
+    if getent passwd ${username}; then
+      fatal "should not get user ${username} before testing"
+    fi
+    # create sysusers config
+    mkdir /etc/sysusers.d
+    echo "u      ${username}  -   ${username}" > /etc/sysusers.d/30-${username}.conf
+    /tmp/autopkgtest-reboot second-boot
+    ;;
+
+  second-boot)
+    # reboot to check user footest not created
+    ok "second boot"
+    if getent passwd ${username}; then
+      fatal "should not get user ${username} after second boot"
+    fi
+    # create a new deployment
+    rpm-ostree kargs --append=${kargs}
+    /tmp/autopkgtest-reboot third-boot
+    ;;
+
+  third-boot)
+    ok "third boot"
+    # check user footest is created
+    if ! getent passwd ${username}; then
+      fatal "should get user ${username} with new deployment after third boot"
+    fi
+    # check appended kargs
+    if ! grep "${kargs}" /proc/cmdline; then
+      fatal "can not get appended kargs ${kargs}"
+    fi
+    ;;
+
+    *) fatal "unexpected mark: ${AUTOPKGTEST_REBOOT_MARK}";;
+esac