diff --git a/.cci.jenkinsfile b/.cci.jenkinsfile
index d902235a26..a4a3ffeb1f 100644
--- a/.cci.jenkinsfile
+++ b/.cci.jenkinsfile
@@ -42,10 +42,8 @@ cosaPod(cpus: 4, memory: "9Gi") {
     }
     cosaBuild(skipInit: true, noStrict: no_strict_build, extraFetchArgs: '--with-cosa-overrides', extraArgs: parent_arg)
 
-    parallel metal: {
-        shwrap("cd /srv/coreos && cosa buildextend-metal")
-    }, metal4k: {
-        shwrap("cd /srv/coreos && cosa buildextend-metal4k")
+    stage("Metal/Metal4k") {
+        shwrap("cd /srv/coreos && cosa osbuild metal metal4k")
     }
 
     stage("Test ISO") {
diff --git a/.github/workflows/add-override.yml b/.github/workflows/add-override.yml
index e243037f2f..d88d965056 100644
--- a/.github/workflows/add-override.yml
+++ b/.github/workflows/add-override.yml
@@ -40,7 +40,10 @@ jobs:
     container: quay.io/fedora/fedora:latest
     steps:
       - name: Install dependencies
-        run: dnf install -y git jq python3-bodhi-client python3-pyyaml
+        # XXX: Note here we're installing python3-dnf, which pulls in libdnf,
+        # which is the old one. We should migrate to libdnf5 to match dnf5.
+        # https://github.com/coreos/fedora-coreos-config/issues/3254
+        run: dnf install -y git jq python3-bodhi-client python3-pyyaml python3-dnf
       - name: Check out repository
         uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/bump-fedora-bootc.yaml b/.github/workflows/bump-fedora-bootc.yaml
new file mode 100644
index 0000000000..1095ae73d7
--- /dev/null
+++ b/.github/workflows/bump-fedora-bootc.yaml
@@ -0,0 +1,66 @@
+name: Bump fedora-bootc submodule
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  bump-fedora-bootc-submodule:
+    name: Bump fedora-bootc submodule
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: true
+          fetch-depth: 0
+      # https://github.com/actions/checkout/issues/766
+      - name: Mark git checkout as safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Check if there are new commits
+        run: |
+          previous_rev=$(git -C fedora-bootc rev-parse HEAD)
+          git submodule update --remote fedora-bootc
+          new_rev=$(git -C fedora-bootc rev-parse HEAD)
+          if [ "${previous_rev}" != "${new_rev}" ]; then
+              if git -C fedora-bootc diff --quiet "${previous_rev}" "${new_rev}" tier-0 tier-x; then
+                  # reset back any changes to avoid a PR bump
+                  git submodule update
+              fi
+          fi
+          if git diff --quiet --exit-code; then
+              echo "No tier-0 or tier-x changes; exiting"
+              exit 0
+          fi
+
+          git -C fedora-bootc shortlog --no-merges "${previous_rev}..${new_rev}" -- tier-0 tier-x > $RUNNER_TEMP/shortlog
+
+          marker=END-OF-LOG-MARKER-$RANDOM$RANDOM$RANDOM
+          cat >> $GITHUB_ENV <<EOF
+          SHORTLOG<<$marker
+          $(cat $RUNNER_TEMP/shortlog)
+          $marker
+          EOF
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.COREOSBOT_RELENG_TOKEN }}
+          push-to-fork: coreosbot-releng/fedora-coreos-config
+          branch: bump-fedora-bootc
+          commit-message: |
+            Bump fedora-bootc submodule
+
+            ${{ env.SHORTLOG }}
+          title: "Bump fedora-bootc submodule"
+          body: |
+            Created by [GitHub workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/bump-fedora-bootc.yml) ([source](${{ github.server_url }}/${{ github.repository }}/blob/testing-devel/.github/workflows/bump-fedora-bootc.yml)).
+
+            ```
+            ${{ env.SHORTLOG }}
+            ```
+          committer: "CoreOS Bot <coreosbot@fedoraproject.org>"
+          author: "CoreOS Bot <coreosbot@fedoraproject.org>"
diff --git a/.github/workflows/remove-graduated-overrides.yml b/.github/workflows/remove-graduated-overrides.yml
index aa89e466a6..f861bddb6a 100644
--- a/.github/workflows/remove-graduated-overrides.yml
+++ b/.github/workflows/remove-graduated-overrides.yml
@@ -55,6 +55,7 @@ jobs:
         uses: actions/checkout@v3
         with:
           ref: ${{ matrix.branch }}
+          submodules: true
       # https://github.com/actions/checkout/issues/766
       - name: Mark git checkout as safe
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 4e0497acc7..e4c300e81a 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,7 +16,7 @@ jobs:
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # https://github.com/actions/checkout/issues/760
       - name: Mark git checkout as safe
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000000..9b68420b8f
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "fedora-bootc"]
+	path = fedora-bootc
+	url = https://gitlab.com/fedora/bootc/base-images.git
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index dc96a70a6b..eb694d82b7 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -1,10 +1,6 @@
 # This file documents currently known-to-fail kola tests. It is consumed by
 # coreos-assembler to automatically skip some tests. For more information,
 # see: https://github.com/coreos/coreos-assembler/pull/866.
-- pattern: fcos.internet
-  tracker: https://github.com/coreos/coreos-assembler/pull/1478
-- pattern: podman.workflow
-  tracker: https://github.com/coreos/coreos-assembler/pull/1478
 - pattern: coreos.boot-mirror*
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1659
   # warn: true (disabled on promotion)
diff --git a/manifest-lock.aarch64.json b/manifest-lock.aarch64.json
index 4fba46c9ed..fcad2af7c3 100644
--- a/manifest-lock.aarch64.json
+++ b/manifest-lock.aarch64.json
@@ -37,7 +37,7 @@
       }
     },
     "aardvark-dns": {
-      "evra": "2:1.13.0-1.fc41.aarch64",
+      "evra": "2:1.13.1-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "aardvark-dns"
       }
@@ -73,7 +73,7 @@
       }
     },
     "amd-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -157,7 +157,7 @@
       }
     },
     "bootc": {
-      "evra": "1.1.0-2.fc41.aarch64",
+      "evra": "1.1.2-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "bootc"
       }
@@ -307,7 +307,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.233.0-1.fc41.noarch",
+      "evra": "2:2.234.2-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -319,37 +319,37 @@
       }
     },
     "containers-common": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "containers-common-extra": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "coreos-installer": {
-      "evra": "0.22.1-3.fc41.aarch64",
+      "evra": "0.23.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.22.1-3.fc41.aarch64",
+      "evra": "0.23.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreutils": {
-      "evra": "9.5-10.fc41.aarch64",
+      "evra": "9.5-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "coreutils"
       }
     },
     "coreutils-common": {
-      "evra": "9.5-10.fc41.aarch64",
+      "evra": "9.5-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "coreutils"
       }
@@ -499,7 +499,7 @@
       }
     },
     "dnf5": {
-      "evra": "5.2.6.2-1.fc41.aarch64",
+      "evra": "5.2.7.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -577,19 +577,19 @@
       }
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.192-5.fc41.noarch",
+      "evra": "0.192-6.fc41.noarch",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libelf": {
-      "evra": "0.192-5.fc41.aarch64",
+      "evra": "0.192-6.fc41.aarch64",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libs": {
-      "evra": "0.192-5.fc41.aarch64",
+      "evra": "0.192-6.fc41.aarch64",
       "metadata": {
         "sourcerpm": "elfutils"
       }
@@ -601,7 +601,7 @@
       }
     },
     "expat": {
-      "evra": "2.6.3-1.fc41.aarch64",
+      "evra": "2.6.4-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "expat"
       }
@@ -613,19 +613,19 @@
       }
     },
     "fedora-release-common": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-identity-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
@@ -781,25 +781,25 @@
       }
     },
     "glibc": {
-      "evra": "2.40-9.fc41.aarch64",
+      "evra": "2.40-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-common": {
-      "evra": "2.40-9.fc41.aarch64",
+      "evra": "2.40-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-gconv-extra": {
-      "evra": "2.40-9.fc41.aarch64",
+      "evra": "2.40-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-minimal-langpack": {
-      "evra": "2.40-9.fc41.aarch64",
+      "evra": "2.40-11.fc41.aarch64",
       "metadata": {
         "sourcerpm": "glibc"
       }
@@ -841,25 +841,25 @@
       }
     },
     "grub2-common": {
-      "evra": "1:2.12-10.fc41.noarch",
+      "evra": "1:2.12-13.fc41.noarch",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-efi-aa64": {
-      "evra": "1:2.12-10.fc41.aarch64",
+      "evra": "1:2.12-13.fc41.aarch64",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools": {
-      "evra": "1:2.12-10.fc41.aarch64",
+      "evra": "1:2.12-13.fc41.aarch64",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.12-10.fc41.aarch64",
+      "evra": "1:2.12-13.fc41.aarch64",
       "metadata": {
         "sourcerpm": "grub2"
       }
@@ -883,7 +883,7 @@
       }
     },
     "ignition": {
-      "evra": "2.20.0-1.fc41.aarch64",
+      "evra": "2.20.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "ignition"
       }
@@ -895,7 +895,7 @@
       }
     },
     "intel-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1045,25 +1045,25 @@
       }
     },
     "kernel": {
-      "evra": "6.11.6-300.fc41.aarch64",
+      "evra": "6.11.8-300.fc41.aarch64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-core": {
-      "evra": "6.11.6-300.fc41.aarch64",
+      "evra": "6.11.8-300.fc41.aarch64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules": {
-      "evra": "6.11.6-300.fc41.aarch64",
+      "evra": "6.11.8-300.fc41.aarch64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules-core": {
-      "evra": "6.11.6-300.fc41.aarch64",
+      "evra": "6.11.8-300.fc41.aarch64",
       "metadata": {
         "sourcerpm": "kernel"
       }
@@ -1225,13 +1225,13 @@
       }
     },
     "libdnf5": {
-      "evra": "5.2.6.2-1.fc41.aarch64",
+      "evra": "5.2.7.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
     },
     "libdnf5-cli": {
-      "evra": "5.2.6.2-1.fc41.aarch64",
+      "evra": "5.2.7.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -1327,7 +1327,7 @@
       }
     },
     "libipa_hbac": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1435,7 +1435,7 @@
       }
     },
     "libnfsidmap": {
-      "evra": "1:2.8.1-0.fc41.aarch64",
+      "evra": "1:2.8.1-1.rc1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1573,7 +1573,7 @@
       }
     },
     "libsolv": {
-      "evra": "0.7.30-1.fc41.aarch64",
+      "evra": "0.7.31-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "libsolv"
       }
@@ -1585,25 +1585,25 @@
       }
     },
     "libsss_certmap": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_idmap": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_nss_idmap": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_sudo": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1651,7 +1651,7 @@
       }
     },
     "libtirpc": {
-      "evra": "1.3.6-0.fc41.aarch64",
+      "evra": "1.3.6-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "libtirpc"
       }
@@ -1705,7 +1705,7 @@
       }
     },
     "libxcrypt": {
-      "evra": "4.4.36-8.fc41.aarch64",
+      "evra": "4.4.36-10.fc41.aarch64",
       "metadata": {
         "sourcerpm": "libxcrypt"
       }
@@ -1735,13 +1735,13 @@
       }
     },
     "linux-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "linux-firmware-whence": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1903,7 +1903,7 @@
       }
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.8.1-0.fc41.aarch64",
+      "evra": "1:2.8.1-1.rc1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1939,7 +1939,7 @@
       }
     },
     "nvidia-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -2101,13 +2101,13 @@
       }
     },
     "podman": {
-      "evra": "5:5.2.5-1.fc41.aarch64",
+      "evra": "5:5.3.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "podman"
       }
     },
     "policycoreutils": {
-      "evra": "3.7-3.fc41.aarch64",
+      "evra": "3.7-5.fc41.aarch64",
       "metadata": {
         "sourcerpm": "policycoreutils"
       }
@@ -2155,13 +2155,13 @@
       }
     },
     "qed-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "qemu-user-static-x86": {
-      "evra": "2:9.1.1-1.fc41.aarch64",
+      "evra": "2:9.1.1-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "qemu"
       }
@@ -2221,7 +2221,7 @@
       }
     },
     "runc": {
-      "evra": "2:1.1.12-4.fc41.aarch64",
+      "evra": "2:1.2.1-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "runc"
       }
@@ -2257,13 +2257,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2275,13 +2275,13 @@
       }
     },
     "sg3_utils": {
-      "evra": "1.48-3.fc41.aarch64",
+      "evra": "1.48-4.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
     },
     "sg3_utils-libs": {
-      "evra": "1.48-3.fc41.aarch64",
+      "evra": "1.48-4.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
@@ -2311,7 +2311,7 @@
       }
     },
     "skopeo": {
-      "evra": "1:1.16.1-1.fc41.aarch64",
+      "evra": "1:1.17.0-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "skopeo"
       }
@@ -2365,55 +2365,55 @@
       }
     },
     "sssd-ad": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-client": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common-pac": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ipa": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5-common": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ldap": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-nfs-idmap": {
-      "evra": "2.10.0-1.fc41.aarch64",
+      "evra": "2.10.0-2.fc41.aarch64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -2431,37 +2431,37 @@
       }
     },
     "systemd": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-container": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-libs": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-pam": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-resolved": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-udev": {
-      "evra": "256.7-1.fc41.aarch64",
+      "evra": "256.8-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "systemd"
       }
@@ -2485,7 +2485,7 @@
       }
     },
     "toolbox": {
-      "evra": "0.1.0-1.fc41.aarch64",
+      "evra": "0.1.1-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "toolbox"
       }
@@ -2533,13 +2533,13 @@
       }
     },
     "vim-data": {
-      "evra": "2:9.1.825-1.fc41.noarch",
+      "evra": "2:9.1.866-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "vim"
       }
     },
     "vim-minimal": {
-      "evra": "2:9.1.825-1.fc41.aarch64",
+      "evra": "2:9.1.866-1.fc41.aarch64",
       "metadata": {
         "sourcerpm": "vim"
       }
@@ -2624,16 +2624,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-11-09T00:00:00Z",
+    "generated": "2024-11-22T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-10-24T13:55:58Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-11-08T18:21:42Z"
+        "generated": "2024-11-22T02:06:15Z"
       },
       "fedora-updates": {
-        "generated": "2024-11-09T01:37:04Z"
+        "generated": "2024-11-22T03:15:37Z"
       }
     }
   }
diff --git a/manifest-lock.overrides.yaml b/manifest-lock.overrides.yaml
index 4464896944..2756da9edf 100644
--- a/manifest-lock.overrides.yaml
+++ b/manifest-lock.overrides.yaml
@@ -9,8 +9,35 @@
 # for FCOS-specific packages (ignition, afterburn, etc.).
 
 packages:
-  ignition:
-    evr: 2.20.0-1.fc41
+  clevis:
+    evr: 21-5.fc41
     metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-5298e9e9d4
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1836
+      type: pin
+  clevis-dracut:
+    evr: 21-5.fc41
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1836
+      type: pin
+  clevis-luks:
+    evr: 21-5.fc41
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1836
+      type: pin
+  clevis-systemd:
+    evr: 21-5.fc41
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1836
+      type: pin
+  coreos-installer:
+    evr: 0.23.0-1.fc41
+    metadata:
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f74beba038
+      reason: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f74beba038
+      type: fast-track
+  coreos-installer-bootinfra:
+    evr: 0.23.0-1.fc41
+    metadata:
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f74beba038
+      reason: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f74beba038
       type: fast-track
diff --git a/manifest-lock.ppc64le.json b/manifest-lock.ppc64le.json
index fc1096ba54..47d3b8a362 100644
--- a/manifest-lock.ppc64le.json
+++ b/manifest-lock.ppc64le.json
@@ -37,7 +37,7 @@
       }
     },
     "aardvark-dns": {
-      "evra": "2:1.13.0-1.fc41.ppc64le",
+      "evra": "2:1.13.1-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "aardvark-dns"
       }
@@ -73,7 +73,7 @@
       }
     },
     "amd-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -163,7 +163,7 @@
       }
     },
     "bootc": {
-      "evra": "1.1.0-2.fc41.ppc64le",
+      "evra": "1.1.2-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "bootc"
       }
@@ -313,7 +313,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.233.0-1.fc41.noarch",
+      "evra": "2:2.234.2-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -325,37 +325,37 @@
       }
     },
     "containers-common": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "containers-common-extra": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "coreos-installer": {
-      "evra": "0.22.1-3.fc41.ppc64le",
+      "evra": "0.23.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.22.1-3.fc41.ppc64le",
+      "evra": "0.23.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreutils": {
-      "evra": "9.5-10.fc41.ppc64le",
+      "evra": "9.5-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "coreutils"
       }
     },
     "coreutils-common": {
-      "evra": "9.5-10.fc41.ppc64le",
+      "evra": "9.5-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "coreutils"
       }
@@ -499,7 +499,7 @@
       }
     },
     "dnf5": {
-      "evra": "5.2.6.2-1.fc41.ppc64le",
+      "evra": "5.2.7.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -559,19 +559,19 @@
       }
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.192-5.fc41.noarch",
+      "evra": "0.192-6.fc41.noarch",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libelf": {
-      "evra": "0.192-5.fc41.ppc64le",
+      "evra": "0.192-6.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libs": {
-      "evra": "0.192-5.fc41.ppc64le",
+      "evra": "0.192-6.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "elfutils"
       }
@@ -583,7 +583,7 @@
       }
     },
     "expat": {
-      "evra": "2.6.3-1.fc41.ppc64le",
+      "evra": "2.6.4-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "expat"
       }
@@ -595,19 +595,19 @@
       }
     },
     "fedora-release-common": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-identity-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
@@ -763,25 +763,25 @@
       }
     },
     "glibc": {
-      "evra": "2.40-9.fc41.ppc64le",
+      "evra": "2.40-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-common": {
-      "evra": "2.40-9.fc41.ppc64le",
+      "evra": "2.40-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-gconv-extra": {
-      "evra": "2.40-9.fc41.ppc64le",
+      "evra": "2.40-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-minimal-langpack": {
-      "evra": "2.40-9.fc41.ppc64le",
+      "evra": "2.40-11.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "glibc"
       }
@@ -817,31 +817,31 @@
       }
     },
     "grub2-common": {
-      "evra": "1:2.12-10.fc41.noarch",
+      "evra": "1:2.12-13.fc41.noarch",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-ppc64le": {
-      "evra": "1:2.12-10.fc41.ppc64le",
+      "evra": "1:2.12-13.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-ppc64le-modules": {
-      "evra": "1:2.12-10.fc41.noarch",
+      "evra": "1:2.12-13.fc41.noarch",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools": {
-      "evra": "1:2.12-10.fc41.ppc64le",
+      "evra": "1:2.12-13.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.12-10.fc41.ppc64le",
+      "evra": "1:2.12-13.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "grub2"
       }
@@ -865,7 +865,7 @@
       }
     },
     "ignition": {
-      "evra": "2.20.0-1.fc41.ppc64le",
+      "evra": "2.20.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "ignition"
       }
@@ -877,7 +877,7 @@
       }
     },
     "intel-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1027,25 +1027,25 @@
       }
     },
     "kernel": {
-      "evra": "6.11.6-300.fc41.ppc64le",
+      "evra": "6.11.8-300.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-core": {
-      "evra": "6.11.6-300.fc41.ppc64le",
+      "evra": "6.11.8-300.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules": {
-      "evra": "6.11.6-300.fc41.ppc64le",
+      "evra": "6.11.8-300.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules-core": {
-      "evra": "6.11.6-300.fc41.ppc64le",
+      "evra": "6.11.8-300.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "kernel"
       }
@@ -1207,13 +1207,13 @@
       }
     },
     "libdnf5": {
-      "evra": "5.2.6.2-1.fc41.ppc64le",
+      "evra": "5.2.7.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "dnf5"
       }
     },
     "libdnf5-cli": {
-      "evra": "5.2.6.2-1.fc41.ppc64le",
+      "evra": "5.2.7.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -1309,7 +1309,7 @@
       }
     },
     "libipa_hbac": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1417,7 +1417,7 @@
       }
     },
     "libnfsidmap": {
-      "evra": "1:2.8.1-0.fc41.ppc64le",
+      "evra": "1:2.8.1-1.rc1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1567,7 +1567,7 @@
       }
     },
     "libsolv": {
-      "evra": "0.7.30-1.fc41.ppc64le",
+      "evra": "0.7.31-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "libsolv"
       }
@@ -1579,25 +1579,25 @@
       }
     },
     "libsss_certmap": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_idmap": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_nss_idmap": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_sudo": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1645,7 +1645,7 @@
       }
     },
     "libtirpc": {
-      "evra": "1.3.6-0.fc41.ppc64le",
+      "evra": "1.3.6-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "libtirpc"
       }
@@ -1699,7 +1699,7 @@
       }
     },
     "libxcrypt": {
-      "evra": "4.4.36-8.fc41.ppc64le",
+      "evra": "4.4.36-10.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "libxcrypt"
       }
@@ -1729,13 +1729,13 @@
       }
     },
     "linux-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "linux-firmware-whence": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1879,7 +1879,7 @@
       }
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.8.1-0.fc41.ppc64le",
+      "evra": "1:2.8.1-1.rc1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1915,7 +1915,7 @@
       }
     },
     "nvidia-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -2083,13 +2083,13 @@
       }
     },
     "podman": {
-      "evra": "5:5.2.5-1.fc41.ppc64le",
+      "evra": "5:5.3.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "podman"
       }
     },
     "policycoreutils": {
-      "evra": "3.7-3.fc41.ppc64le",
+      "evra": "3.7-5.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "policycoreutils"
       }
@@ -2149,13 +2149,13 @@
       }
     },
     "qed-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "qemu-user-static-x86": {
-      "evra": "2:9.1.1-1.fc41.ppc64le",
+      "evra": "2:9.1.1-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "qemu"
       }
@@ -2215,7 +2215,7 @@
       }
     },
     "runc": {
-      "evra": "2:1.1.12-4.fc41.ppc64le",
+      "evra": "2:1.2.1-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "runc"
       }
@@ -2251,13 +2251,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2275,13 +2275,13 @@
       }
     },
     "sg3_utils": {
-      "evra": "1.48-3.fc41.ppc64le",
+      "evra": "1.48-4.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
     },
     "sg3_utils-libs": {
-      "evra": "1.48-3.fc41.ppc64le",
+      "evra": "1.48-4.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
@@ -2305,7 +2305,7 @@
       }
     },
     "skopeo": {
-      "evra": "1:1.16.1-1.fc41.ppc64le",
+      "evra": "1:1.17.0-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "skopeo"
       }
@@ -2353,55 +2353,55 @@
       }
     },
     "sssd-ad": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-client": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common-pac": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ipa": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5-common": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ldap": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-nfs-idmap": {
-      "evra": "2.10.0-1.fc41.ppc64le",
+      "evra": "2.10.0-2.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -2419,37 +2419,37 @@
       }
     },
     "systemd": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-container": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-libs": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-pam": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-resolved": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-udev": {
-      "evra": "256.7-1.fc41.ppc64le",
+      "evra": "256.8-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "systemd"
       }
@@ -2473,7 +2473,7 @@
       }
     },
     "toolbox": {
-      "evra": "0.1.0-1.fc41.ppc64le",
+      "evra": "0.1.1-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "toolbox"
       }
@@ -2521,13 +2521,13 @@
       }
     },
     "vim-data": {
-      "evra": "2:9.1.825-1.fc41.noarch",
+      "evra": "2:9.1.866-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "vim"
       }
     },
     "vim-minimal": {
-      "evra": "2:9.1.825-1.fc41.ppc64le",
+      "evra": "2:9.1.866-1.fc41.ppc64le",
       "metadata": {
         "sourcerpm": "vim"
       }
@@ -2606,16 +2606,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-11-09T00:00:00Z",
+    "generated": "2024-11-22T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-10-24T13:55:58Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-11-08T18:18:42Z"
+        "generated": "2024-11-22T02:03:34Z"
       },
       "fedora-updates": {
-        "generated": "2024-11-09T01:37:06Z"
+        "generated": "2024-11-22T03:15:39Z"
       }
     }
   }
diff --git a/manifest-lock.s390x.json b/manifest-lock.s390x.json
index 0f5d438d68..e6d18449f8 100644
--- a/manifest-lock.s390x.json
+++ b/manifest-lock.s390x.json
@@ -37,7 +37,7 @@
       }
     },
     "aardvark-dns": {
-      "evra": "2:1.13.0-1.fc41.s390x",
+      "evra": "2:1.13.1-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "aardvark-dns"
       }
@@ -73,7 +73,7 @@
       }
     },
     "amd-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -157,7 +157,7 @@
       }
     },
     "bootc": {
-      "evra": "1.1.0-2.fc41.s390x",
+      "evra": "1.1.2-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "bootc"
       }
@@ -307,7 +307,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.233.0-1.fc41.noarch",
+      "evra": "2:2.234.2-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -319,37 +319,37 @@
       }
     },
     "containers-common": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "containers-common-extra": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "coreos-installer": {
-      "evra": "0.22.1-3.fc41.s390x",
+      "evra": "0.23.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.22.1-3.fc41.s390x",
+      "evra": "0.23.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreutils": {
-      "evra": "9.5-10.fc41.s390x",
+      "evra": "9.5-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "coreutils"
       }
     },
     "coreutils-common": {
-      "evra": "9.5-10.fc41.s390x",
+      "evra": "9.5-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "coreutils"
       }
@@ -493,7 +493,7 @@
       }
     },
     "dnf5": {
-      "evra": "5.2.6.2-1.fc41.s390x",
+      "evra": "5.2.7.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -553,19 +553,19 @@
       }
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.192-5.fc41.noarch",
+      "evra": "0.192-6.fc41.noarch",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libelf": {
-      "evra": "0.192-5.fc41.s390x",
+      "evra": "0.192-6.fc41.s390x",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libs": {
-      "evra": "0.192-5.fc41.s390x",
+      "evra": "0.192-6.fc41.s390x",
       "metadata": {
         "sourcerpm": "elfutils"
       }
@@ -577,7 +577,7 @@
       }
     },
     "expat": {
-      "evra": "2.6.3-1.fc41.s390x",
+      "evra": "2.6.4-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "expat"
       }
@@ -589,19 +589,19 @@
       }
     },
     "fedora-release-common": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-identity-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
@@ -739,25 +739,25 @@
       }
     },
     "glibc": {
-      "evra": "2.40-9.fc41.s390x",
+      "evra": "2.40-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-common": {
-      "evra": "2.40-9.fc41.s390x",
+      "evra": "2.40-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-gconv-extra": {
-      "evra": "2.40-9.fc41.s390x",
+      "evra": "2.40-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-minimal-langpack": {
-      "evra": "2.40-9.fc41.s390x",
+      "evra": "2.40-11.fc41.s390x",
       "metadata": {
         "sourcerpm": "glibc"
       }
@@ -811,7 +811,7 @@
       }
     },
     "ignition": {
-      "evra": "2.20.0-1.fc41.s390x",
+      "evra": "2.20.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "ignition"
       }
@@ -823,7 +823,7 @@
       }
     },
     "intel-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -967,25 +967,25 @@
       }
     },
     "kernel": {
-      "evra": "6.11.6-300.fc41.s390x",
+      "evra": "6.11.8-300.fc41.s390x",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-core": {
-      "evra": "6.11.6-300.fc41.s390x",
+      "evra": "6.11.8-300.fc41.s390x",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules": {
-      "evra": "6.11.6-300.fc41.s390x",
+      "evra": "6.11.8-300.fc41.s390x",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules-core": {
-      "evra": "6.11.6-300.fc41.s390x",
+      "evra": "6.11.8-300.fc41.s390x",
       "metadata": {
         "sourcerpm": "kernel"
       }
@@ -1141,13 +1141,13 @@
       }
     },
     "libdnf5": {
-      "evra": "5.2.6.2-1.fc41.s390x",
+      "evra": "5.2.7.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "dnf5"
       }
     },
     "libdnf5-cli": {
-      "evra": "5.2.6.2-1.fc41.s390x",
+      "evra": "5.2.7.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -1243,7 +1243,7 @@
       }
     },
     "libipa_hbac": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1351,7 +1351,7 @@
       }
     },
     "libnfsidmap": {
-      "evra": "1:2.8.1-0.fc41.s390x",
+      "evra": "1:2.8.1-1.rc1.fc41.s390x",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1489,7 +1489,7 @@
       }
     },
     "libsolv": {
-      "evra": "0.7.30-1.fc41.s390x",
+      "evra": "0.7.31-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "libsolv"
       }
@@ -1501,25 +1501,25 @@
       }
     },
     "libsss_certmap": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_idmap": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_nss_idmap": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_sudo": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1561,7 +1561,7 @@
       }
     },
     "libtirpc": {
-      "evra": "1.3.6-0.fc41.s390x",
+      "evra": "1.3.6-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "libtirpc"
       }
@@ -1615,7 +1615,7 @@
       }
     },
     "libxcrypt": {
-      "evra": "4.4.36-8.fc41.s390x",
+      "evra": "4.4.36-10.fc41.s390x",
       "metadata": {
         "sourcerpm": "libxcrypt"
       }
@@ -1645,13 +1645,13 @@
       }
     },
     "linux-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "linux-firmware-whence": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1795,7 +1795,7 @@
       }
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.8.1-0.fc41.s390x",
+      "evra": "1:2.8.1-1.rc1.fc41.s390x",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1825,7 +1825,7 @@
       }
     },
     "nvidia-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1981,13 +1981,13 @@
       }
     },
     "podman": {
-      "evra": "5:5.2.5-1.fc41.s390x",
+      "evra": "5:5.3.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "podman"
       }
     },
     "policycoreutils": {
-      "evra": "3.7-3.fc41.s390x",
+      "evra": "3.7-5.fc41.s390x",
       "metadata": {
         "sourcerpm": "policycoreutils"
       }
@@ -2035,13 +2035,13 @@
       }
     },
     "qed-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "qemu-user-static-x86": {
-      "evra": "2:9.1.1-1.fc41.s390x",
+      "evra": "2:9.1.1-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "qemu"
       }
@@ -2101,7 +2101,7 @@
       }
     },
     "runc": {
-      "evra": "2:1.1.12-4.fc41.s390x",
+      "evra": "2:1.2.1-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "runc"
       }
@@ -2143,13 +2143,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2161,13 +2161,13 @@
       }
     },
     "sg3_utils": {
-      "evra": "1.48-3.fc41.s390x",
+      "evra": "1.48-4.fc41.s390x",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
     },
     "sg3_utils-libs": {
-      "evra": "1.48-3.fc41.s390x",
+      "evra": "1.48-4.fc41.s390x",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
@@ -2191,7 +2191,7 @@
       }
     },
     "skopeo": {
-      "evra": "1:1.16.1-1.fc41.s390x",
+      "evra": "1:1.17.0-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "skopeo"
       }
@@ -2239,55 +2239,55 @@
       }
     },
     "sssd-ad": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-client": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common-pac": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ipa": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5-common": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ldap": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-nfs-idmap": {
-      "evra": "2.10.0-1.fc41.s390x",
+      "evra": "2.10.0-2.fc41.s390x",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -2305,37 +2305,37 @@
       }
     },
     "systemd": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-container": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-libs": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-pam": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-resolved": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-udev": {
-      "evra": "256.7-1.fc41.s390x",
+      "evra": "256.8-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "systemd"
       }
@@ -2359,7 +2359,7 @@
       }
     },
     "toolbox": {
-      "evra": "0.1.0-1.fc41.s390x",
+      "evra": "0.1.1-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "toolbox"
       }
@@ -2413,13 +2413,13 @@
       }
     },
     "vim-data": {
-      "evra": "2:9.1.825-1.fc41.noarch",
+      "evra": "2:9.1.866-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "vim"
       }
     },
     "vim-minimal": {
-      "evra": "2:9.1.825-1.fc41.s390x",
+      "evra": "2:9.1.866-1.fc41.s390x",
       "metadata": {
         "sourcerpm": "vim"
       }
@@ -2498,16 +2498,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-11-09T00:00:00Z",
+    "generated": "2024-11-22T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-10-24T13:55:55Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-11-08T18:18:01Z"
+        "generated": "2024-11-22T02:03:08Z"
       },
       "fedora-updates": {
-        "generated": "2024-11-09T01:37:08Z"
+        "generated": "2024-11-22T03:15:41Z"
       }
     }
   }
diff --git a/manifest-lock.x86_64.json b/manifest-lock.x86_64.json
index 940df11325..d623ca8cd8 100644
--- a/manifest-lock.x86_64.json
+++ b/manifest-lock.x86_64.json
@@ -37,7 +37,7 @@
       }
     },
     "aardvark-dns": {
-      "evra": "2:1.13.0-1.fc41.x86_64",
+      "evra": "2:1.13.1-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "aardvark-dns"
       }
@@ -73,13 +73,13 @@
       }
     },
     "amd-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "amd-ucode-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -163,7 +163,7 @@
       }
     },
     "bootc": {
-      "evra": "1.1.0-2.fc41.x86_64",
+      "evra": "1.1.2-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "bootc"
       }
@@ -313,7 +313,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.233.0-1.fc41.noarch",
+      "evra": "2:2.234.2-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -325,37 +325,37 @@
       }
     },
     "containers-common": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "containers-common-extra": {
-      "evra": "5:0.60.4-4.fc41.noarch",
+      "evra": "5:0.61.0-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "containers-common"
       }
     },
     "coreos-installer": {
-      "evra": "0.22.1-3.fc41.x86_64",
+      "evra": "0.23.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreos-installer-bootinfra": {
-      "evra": "0.22.1-3.fc41.x86_64",
+      "evra": "0.23.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "rust-coreos-installer"
       }
     },
     "coreutils": {
-      "evra": "9.5-10.fc41.x86_64",
+      "evra": "9.5-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "coreutils"
       }
     },
     "coreutils-common": {
-      "evra": "9.5-10.fc41.x86_64",
+      "evra": "9.5-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "coreutils"
       }
@@ -505,7 +505,7 @@
       }
     },
     "dnf5": {
-      "evra": "5.2.6.2-1.fc41.x86_64",
+      "evra": "5.2.7.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -583,19 +583,19 @@
       }
     },
     "elfutils-default-yama-scope": {
-      "evra": "0.192-5.fc41.noarch",
+      "evra": "0.192-6.fc41.noarch",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libelf": {
-      "evra": "0.192-5.fc41.x86_64",
+      "evra": "0.192-6.fc41.x86_64",
       "metadata": {
         "sourcerpm": "elfutils"
       }
     },
     "elfutils-libs": {
-      "evra": "0.192-5.fc41.x86_64",
+      "evra": "0.192-6.fc41.x86_64",
       "metadata": {
         "sourcerpm": "elfutils"
       }
@@ -607,7 +607,7 @@
       }
     },
     "expat": {
-      "evra": "2.6.3-1.fc41.x86_64",
+      "evra": "2.6.4-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "expat"
       }
@@ -619,19 +619,19 @@
       }
     },
     "fedora-release-common": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
     },
     "fedora-release-identity-coreos": {
-      "evra": "41-27.noarch",
+      "evra": "41-28.noarch",
       "metadata": {
         "sourcerpm": "fedora-release"
       }
@@ -787,25 +787,25 @@
       }
     },
     "glibc": {
-      "evra": "2.40-9.fc41.x86_64",
+      "evra": "2.40-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-common": {
-      "evra": "2.40-9.fc41.x86_64",
+      "evra": "2.40-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-gconv-extra": {
-      "evra": "2.40-9.fc41.x86_64",
+      "evra": "2.40-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "glibc"
       }
     },
     "glibc-minimal-langpack": {
-      "evra": "2.40-9.fc41.x86_64",
+      "evra": "2.40-11.fc41.x86_64",
       "metadata": {
         "sourcerpm": "glibc"
       }
@@ -847,37 +847,37 @@
       }
     },
     "grub2-common": {
-      "evra": "1:2.12-10.fc41.noarch",
+      "evra": "1:2.12-13.fc41.noarch",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-efi-x64": {
-      "evra": "1:2.12-10.fc41.x86_64",
+      "evra": "1:2.12-13.fc41.x86_64",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-pc": {
-      "evra": "1:2.12-10.fc41.x86_64",
+      "evra": "1:2.12-13.fc41.x86_64",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-pc-modules": {
-      "evra": "1:2.12-10.fc41.noarch",
+      "evra": "1:2.12-13.fc41.noarch",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools": {
-      "evra": "1:2.12-10.fc41.x86_64",
+      "evra": "1:2.12-13.fc41.x86_64",
       "metadata": {
         "sourcerpm": "grub2"
       }
     },
     "grub2-tools-minimal": {
-      "evra": "1:2.12-10.fc41.x86_64",
+      "evra": "1:2.12-13.fc41.x86_64",
       "metadata": {
         "sourcerpm": "grub2"
       }
@@ -901,7 +901,7 @@
       }
     },
     "ignition": {
-      "evra": "2.20.0-1.fc41.x86_64",
+      "evra": "2.20.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "ignition"
       }
@@ -913,7 +913,7 @@
       }
     },
     "intel-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1063,25 +1063,25 @@
       }
     },
     "kernel": {
-      "evra": "6.11.6-300.fc41.x86_64",
+      "evra": "6.11.8-300.fc41.x86_64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-core": {
-      "evra": "6.11.6-300.fc41.x86_64",
+      "evra": "6.11.8-300.fc41.x86_64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules": {
-      "evra": "6.11.6-300.fc41.x86_64",
+      "evra": "6.11.8-300.fc41.x86_64",
       "metadata": {
         "sourcerpm": "kernel"
       }
     },
     "kernel-modules-core": {
-      "evra": "6.11.6-300.fc41.x86_64",
+      "evra": "6.11.8-300.fc41.x86_64",
       "metadata": {
         "sourcerpm": "kernel"
       }
@@ -1237,13 +1237,13 @@
       }
     },
     "libdnf5": {
-      "evra": "5.2.6.2-1.fc41.x86_64",
+      "evra": "5.2.7.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
     },
     "libdnf5-cli": {
-      "evra": "5.2.6.2-1.fc41.x86_64",
+      "evra": "5.2.7.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "dnf5"
       }
@@ -1339,7 +1339,7 @@
       }
     },
     "libipa_hbac": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1447,7 +1447,7 @@
       }
     },
     "libnfsidmap": {
-      "evra": "1:2.8.1-0.fc41.x86_64",
+      "evra": "1:2.8.1-1.rc1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1585,7 +1585,7 @@
       }
     },
     "libsolv": {
-      "evra": "0.7.30-1.fc41.x86_64",
+      "evra": "0.7.31-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "libsolv"
       }
@@ -1597,25 +1597,25 @@
       }
     },
     "libsss_certmap": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_idmap": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_nss_idmap": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "libsss_sudo": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -1663,7 +1663,7 @@
       }
     },
     "libtirpc": {
-      "evra": "1.3.6-0.fc41.x86_64",
+      "evra": "1.3.6-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "libtirpc"
       }
@@ -1717,7 +1717,7 @@
       }
     },
     "libxcrypt": {
-      "evra": "4.4.36-8.fc41.x86_64",
+      "evra": "4.4.36-10.fc41.x86_64",
       "metadata": {
         "sourcerpm": "libxcrypt"
       }
@@ -1747,13 +1747,13 @@
       }
     },
     "linux-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
     },
     "linux-firmware-whence": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -1837,7 +1837,7 @@
       }
     },
     "microcode_ctl": {
-      "evra": "2:2.1-65.fc41.x86_64",
+      "evra": "2:2.1-67.fc41.x86_64",
       "metadata": {
         "sourcerpm": "microcode_ctl"
       }
@@ -1921,7 +1921,7 @@
       }
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.8.1-0.fc41.x86_64",
+      "evra": "1:2.8.1-1.rc1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "nfs-utils"
       }
@@ -1957,7 +1957,7 @@
       }
     },
     "nvidia-gpu-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -2119,13 +2119,13 @@
       }
     },
     "podman": {
-      "evra": "5:5.2.5-1.fc41.x86_64",
+      "evra": "5:5.3.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "podman"
       }
     },
     "policycoreutils": {
-      "evra": "3.7-3.fc41.x86_64",
+      "evra": "3.7-5.fc41.x86_64",
       "metadata": {
         "sourcerpm": "policycoreutils"
       }
@@ -2173,7 +2173,7 @@
       }
     },
     "qed-firmware": {
-      "evra": "20241017-2.fc41.noarch",
+      "evra": "20241110-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "linux-firmware"
       }
@@ -2233,7 +2233,7 @@
       }
     },
     "runc": {
-      "evra": "2:1.1.12-4.fc41.x86_64",
+      "evra": "2:1.2.1-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "runc"
       }
@@ -2269,13 +2269,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "41.24-1.fc41.noarch",
+      "evra": "41.26-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2287,13 +2287,13 @@
       }
     },
     "sg3_utils": {
-      "evra": "1.48-3.fc41.x86_64",
+      "evra": "1.48-4.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
     },
     "sg3_utils-libs": {
-      "evra": "1.48-3.fc41.x86_64",
+      "evra": "1.48-4.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sg3_utils"
       }
@@ -2323,7 +2323,7 @@
       }
     },
     "skopeo": {
-      "evra": "1:1.16.1-1.fc41.x86_64",
+      "evra": "1:1.17.0-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "skopeo"
       }
@@ -2377,55 +2377,55 @@
       }
     },
     "sssd-ad": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-client": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-common-pac": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ipa": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-krb5-common": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-ldap": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
     },
     "sssd-nfs-idmap": {
-      "evra": "2.10.0-1.fc41.x86_64",
+      "evra": "2.10.0-2.fc41.x86_64",
       "metadata": {
         "sourcerpm": "sssd"
       }
@@ -2443,37 +2443,37 @@
       }
     },
     "systemd": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-container": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-libs": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-pam": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-resolved": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
     },
     "systemd-udev": {
-      "evra": "256.7-1.fc41.x86_64",
+      "evra": "256.8-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "systemd"
       }
@@ -2497,7 +2497,7 @@
       }
     },
     "toolbox": {
-      "evra": "0.1.0-1.fc41.x86_64",
+      "evra": "0.1.1-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "toolbox"
       }
@@ -2545,13 +2545,13 @@
       }
     },
     "vim-data": {
-      "evra": "2:9.1.825-1.fc41.noarch",
+      "evra": "2:9.1.866-1.fc41.noarch",
       "metadata": {
         "sourcerpm": "vim"
       }
     },
     "vim-minimal": {
-      "evra": "2:9.1.825-1.fc41.x86_64",
+      "evra": "2:9.1.866-1.fc41.x86_64",
       "metadata": {
         "sourcerpm": "vim"
       }
@@ -2636,16 +2636,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-11-09T00:00:00Z",
+    "generated": "2024-11-22T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-10-24T13:55:59Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-11-08T18:21:13Z"
+        "generated": "2024-11-22T02:05:36Z"
       },
       "fedora-updates": {
-        "generated": "2024-11-09T01:37:10Z"
+        "generated": "2024-11-22T03:15:44Z"
       }
     }
   }
diff --git a/manifests/bootable-rpm-ostree.yaml b/manifests/bootable-rpm-ostree.yaml
index 9d5faddbec..57c18d5c66 100644
--- a/manifests/bootable-rpm-ostree.yaml
+++ b/manifests/bootable-rpm-ostree.yaml
@@ -14,6 +14,8 @@ packages:
  - rpm-ostree nss-altfiles
  # firmware updates
  - fwupd
+ # https://fedoraproject.org/wiki/Changes/DNFAndBootcInImageModeFedora
+ - bootc
 
 # bootloader
 packages-aarch64:
@@ -24,8 +26,6 @@ packages-s390x:
   # On Fedora, this is provided by s390utils-core. on RHEL, this is for now
   # provided by s390utils-base, but soon will be -core too.
   - /usr/sbin/zipl
-  # for Secure Execution
-  - veritysetup
 packages-x86_64:
   - grub2 grub2-efi-x64 efibootmgr shim
   - microcode_ctl
diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index 36128cc0aa..9f60159a11 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -10,10 +10,19 @@ include:
   - networking-tools.yaml
   - user-experience.yaml
   - shared-workarounds.yaml
-  # See https://github.com/coreos/bootupd
-  - bootupd.yaml
   - shared-el9.yaml
   - shared-el10.yaml
+
+conditional-include:
+  # starting from f42, we inherit from tier-x
+  # once we're on f42, we can move this up to the default list of includes above
+  - if: releasever >= 42
+    include: tier-x.yaml
+  # all these are inherited from tier-x in f42+, but we carry them here to
+  # enforce that there's really no coupling until f42
+  - if: releasever < 42
+    include: tier-x-dupes.yaml
+
 ostree-layers:
   - overlay/05core
   - overlay/08nouveau
@@ -159,8 +168,6 @@ packages:
   - iptables-legacy
   # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora
   - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746
-  # https://fedoraproject.org/wiki/Changes/DNFAndBootcInImageModeFedora
-  - bootc
 
 
 # - irqbalance
diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index 047f86292a..a80cfd4ea8 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -3,7 +3,7 @@
 # or are very "opinionated" like disabling SSH passwords by default.
 
 ref: fedora/${basearch}/coreos/${stream}
-rojig:
+metadata:
   license: MIT
   name: fedora-coreos
   summary: Fedora CoreOS ${stream}
@@ -17,7 +17,10 @@ conditional-include:
   - if: prod == false
     # long-term, would be good to support specifying a nested TreeComposeConfig
     include: disable-zincati.yaml
-  - if: basearch != "s390x"
+  - if:
+    - basearch != "s390x"
+    # for 42+, it's inherited from fedora-bootc
+    - releasever < 42
     # And remove some cruft from grub2
     include: grub2-removals.yaml
   # On <41, we want to keep making sure dnf doesn't slip in somehow
@@ -25,12 +28,14 @@ conditional-include:
   # https://github.com/coreos/fedora-coreos-tracker/issues/1687
   - if: releasever < 41
     include: exclude-dnf.yaml
-  - if: releasever >= 41
+  # for 42+, it's inherited from fedora-bootc
+  - if: releasever == 41
     include: include-dnf.yaml
   # Wifi firmwares will be dropped in F41
   - if: releasever < 41
     include: wifi-firmwares.yaml
-  - if: releasever >= 41
+  # for 42+, it's inherited from fedora-bootc
+  - if: releasever == 41
     include: composefs.yaml
   - if: releasever >= 41
     include: selinux-workaround.yaml
diff --git a/manifests/ignition-and-ostree-tier-x-dupes.yaml b/manifests/ignition-and-ostree-tier-x-dupes.yaml
new file mode 100644
index 0000000000..67464ad83f
--- /dev/null
+++ b/manifests/ignition-and-ostree-tier-x-dupes.yaml
@@ -0,0 +1,17 @@
+# This manifest can go away in Fedora 42. It duplicates tier-x.
+
+# Modern defaults we want
+boot-location: modules
+tmp-is-dir: true
+
+# Required by Ignition, and makes the system not compatible with Anaconda
+machineid-compat: false
+
+remove-from-packages:
+  # We don't want systemd-firstboot.service. It conceptually conflicts with
+  # Ignition.  We also inject runtime bits to disable it in systemd-firstboot.service.d/fcos-disable.conf
+  # to make it easier to use systemd builds from git.
+  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
+  # We don't want auto-generated mount units. See also
+  # https://github.com/systemd/systemd/issues/13099
+  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
diff --git a/manifests/ignition-and-ostree.yaml b/manifests/ignition-and-ostree.yaml
index 8416a6dbfc..d3a2b595f8 100644
--- a/manifests/ignition-and-ostree.yaml
+++ b/manifests/ignition-and-ostree.yaml
@@ -5,32 +5,15 @@
 # One good model is to add fedora-coreos-config as a git submodule.  See:
 # https://github.com/coreos/coreos-assembler/pull/639
 
-# Include rpm-ostree + kernel + bootloader
-include: bootable-rpm-ostree.yaml
-
-# Modern defaults we want
-boot-location: modules
-tmp-is-dir: true
-
-# Required by Ignition, and makes the system not compatible with Anaconda
-machineid-compat: false
-
 packages:
   - ignition
   - dracut-network
   # for encryption
   - clevis clevis-luks clevis-dracut clevis-systemd
 
-remove-from-packages:
-  # We don't want systemd-firstboot.service. It conceptually conflicts with
-  # Ignition.  We also inject runtime bits to disable it in systemd-firstboot.service.d/fcos-disable.conf
-  # to make it easier to use systemd builds from git.
-  - [systemd, /usr/bin/systemd-firstboot,
-              /usr/lib/systemd/system/systemd-firstboot.service,
-              /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
-  # We don't want auto-generated mount units. See also
-  # https://github.com/systemd/systemd/issues/13099
-  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
+packages-s390x:
+  # for Secure Execution
+  - veritysetup
 
 postprocess:
   # Undo RPM scripts enabling units; we want the presets to be canonical
diff --git a/manifests/networking-tools-tier-x-dupes.yaml b/manifests/networking-tools-tier-x-dupes.yaml
new file mode 100644
index 0000000000..65be99bc00
--- /dev/null
+++ b/manifests/networking-tools-tier-x-dupes.yaml
@@ -0,0 +1,8 @@
+# This manifest can go away in Fedora 42. It duplicates tier-x.
+
+packages:
+  # Standard tools for configuring network/hostname
+  - NetworkManager hostname
+  - iproute
+  # Firewall manipulation
+  - iptables
diff --git a/manifests/networking-tools.yaml b/manifests/networking-tools.yaml
index 471a2621d4..2860806029 100644
--- a/manifests/networking-tools.yaml
+++ b/manifests/networking-tools.yaml
@@ -3,17 +3,15 @@
 # generic enough to be shared downstream with RHCOS.
 
 packages:
-  # Standard tools for configuring network/hostname
-  - NetworkManager hostname
   # Interactive Networking configuration during coreos-install
   - NetworkManager-tui
   # Support for cloud quirks and dynamic config in real rootfs:
   # https://github.com/coreos/fedora-coreos-tracker/issues/320
   - NetworkManager-cloud-setup
-  # Route manipulation and QoS
-  - iproute iproute-tc
+  # Route QoS
+  - iproute-tc
   # Firewall manipulation
-  - iptables nftables
+  - nftables
   # Interactive network tools for admins
   - socat net-tools bind-utils
   # Declarative network configuration
diff --git a/manifests/system-configuration-tier-x-dupes.yaml b/manifests/system-configuration-tier-x-dupes.yaml
new file mode 100644
index 0000000000..a07aca6b73
--- /dev/null
+++ b/manifests/system-configuration-tier-x-dupes.yaml
@@ -0,0 +1,14 @@
+# This manifest can go away in Fedora 42. It duplicates tier-x.
+
+packages:
+  - cryptsetup
+  - e2fsprogs
+  - lvm2
+  - xfsprogs
+  # SELinux policy
+  - selinux-policy-targeted
+  # Allow for configuring different timezones
+  - tzdata
+  # zram-generator (but not zram-generator-defaults) for F33 change
+  # https://github.com/coreos/fedora-coreos-tracker/issues/509
+  - zram-generator
diff --git a/manifests/system-configuration.yaml b/manifests/system-configuration.yaml
index 0f982b612d..8436468b70 100644
--- a/manifests/system-configuration.yaml
+++ b/manifests/system-configuration.yaml
@@ -16,19 +16,13 @@ packages:
   ## cloud-utils-growpart - For growing root partition
   - cifs-utils
   - cloud-utils-growpart
-  - cryptsetup
   - device-mapper-multipath
-  - e2fsprogs
   - iscsi-initiator-utils
-  - lvm2
   - mdadm
   - sg3_utils
-  - xfsprogs
   # User configuration
   - shadow-utils
   - acl
-  # SELinux policy
-  - selinux-policy-targeted
   # There are things that write outside of the journal still (such as the
   # classic wtmp, etc.). auditd also writes outside the journal but it has its
   # own log rotation.
@@ -41,11 +35,6 @@ packages:
   - stalld
   # Ignition aware SSH key management
   - ssh-key-dir
-  # Allow for configuring different timezones
-  - tzdata
-  # zram-generator (but not zram-generator-defaults) for F33 change
-  # https://github.com/coreos/fedora-coreos-tracker/issues/509
-  - zram-generator
 
 postprocess:
   # Mask systemd-repart. Ignition is responsible for partition setup on first
diff --git a/manifests/tier-x-dupes.yaml b/manifests/tier-x-dupes.yaml
new file mode 100644
index 0000000000..2b6bbf84ea
--- /dev/null
+++ b/manifests/tier-x-dupes.yaml
@@ -0,0 +1,11 @@
+# All of these manifests duplicate tier-x. It's meant to be included by streams
+# which do not yet inherit from it (like FCOS <42, and "traditional" RHCOS)
+
+include:
+  - bootable-rpm-ostree.yaml
+  - ignition-and-ostree-tier-x-dupes.yaml
+  - system-configuration-tier-x-dupes.yaml
+  - networking-tools-tier-x-dupes.yaml
+  - user-experience-tier-x-dupes.yaml
+  # See https://github.com/coreos/bootupd
+  - bootupd.yaml
diff --git a/manifests/tier-x.yaml b/manifests/tier-x.yaml
new file mode 100644
index 0000000000..ccb918684b
--- /dev/null
+++ b/manifests/tier-x.yaml
@@ -0,0 +1,32 @@
+# Here, we include tier-x, but override some key settings.
+
+include: ../fedora-bootc/tier-x/manifest.yaml
+
+# Required by Ignition, and makes the system not compatible with Anaconda.
+# Note this deviates from fedora-bootc and means `systemctl enable` doesn't
+# work in a container build. We'll have to resolve that issue some other way in
+# the future... For more details, see
+# https://github.com/CentOS/centos-bootc/issues/167
+machineid-compat: false
+
+# This is the historical default and what FCOS currently ships. fedora-bootc
+# uses the new `root` value, but migrating FCOS is not that simple...
+opt-usrlocal: var
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -euo pipefail
+    # For now, rely on the `sysroot.readonly` knob in /ostree/config only.
+    # Having it in prepare-root.conf too throws off ostree-prepare-root in
+    # live PXE/ISO and we have no easy way to override it when building those.
+    # Really, we need to fix libostree + live ISOs to work well together:
+    # https://github.com/ostreedev/ostree/issues/1921
+    # It's awkward to edit arbitrary keyfile configs. Just rewrite it.
+    if grep -q readonly /usr/lib/ostree/prepare-root.conf; then
+        grep -q '^4 ' <(wc -l /usr/lib/ostree/prepare-root.conf)
+        cat > /usr/lib/ostree/prepare-root.conf <<EOF
+    [composefs]
+    enabled = true
+    EOF
+    fi
diff --git a/manifests/user-experience-tier-x-dupes.yaml b/manifests/user-experience-tier-x-dupes.yaml
new file mode 100644
index 0000000000..da8503f012
--- /dev/null
+++ b/manifests/user-experience-tier-x-dupes.yaml
@@ -0,0 +1,26 @@
+# This manifest can go away in Fedora 42. It duplicates tier-x.
+
+# Default to `bash` in our container, the same as other containers we ship.
+# Note this changes to /sbin/init in f42 as inherited by tier-x.
+container-cmd:
+  - /usr/bin/bash
+
+packages:
+  # Basic user tools
+  - bash-completion
+  - coreutils
+  # jq - parsing/interacting with JSON data
+  - jq
+  - less
+  - sudo
+  - vim-minimal
+  # File compression/decompression
+  - tar
+  # Remote Access
+  - openssh-clients openssh-server
+  # Container tooling
+  ## crun recommends but doesn't require criu and criu-libs. We want them for
+  ## checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
+  - crun criu criu-libs
+  - podman
+  - skopeo
diff --git a/manifests/user-experience.yaml b/manifests/user-experience.yaml
index 45dcb1c3f6..6f9bf4890d 100644
--- a/manifests/user-experience.yaml
+++ b/manifests/user-experience.yaml
@@ -2,9 +2,6 @@
 # https://github.com/openshift/os/blob/71c974b1e456292033e3ef3fe7bcfe17d1855ebc/manifest.yaml#L12
 # Only apply changes here that should apply to both FCOS and RHCOS.
 
-# Default to `bash` in our container, the same as other containers we ship.
-container-cmd:
-  - /usr/bin/bash
 
 # These packages are either widely used utilities/services or
 # are targeted for improving the general CoreOS user experience.
@@ -12,20 +9,12 @@ container-cmd:
 # RHCOS.
 packages:
   # Basic user tools
-  ## jq - parsing/interacting with JSON data
-  - bash-completion
-  - coreutils
   - file
-  - jq
-  - less
-  - sudo
-  - vim-minimal
   # File compression/decompression
   ## bsdtar - dependency of 35coreos-live dracut module
   - bsdtar
   - bzip2
   - gzip
-  - tar
   - xz
   - zstd
   # Improved MOTD experience
@@ -34,14 +23,6 @@ packages:
   # kdump support
   # https://github.com/coreos/fedora-coreos-tracker/issues/622
   - kexec-tools
-  # Remote Access
-  - openssh-clients openssh-server
-  # Container tooling
-  ## crun recommends but doesn't require criu and criu-libs. We want them for
-  ## checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
-  - crun criu criu-libs
-  - podman
-  - skopeo
   - toolbox
   # passt provides user-mode networking daemons for namespaces
   - passt
diff --git a/tests/kola/boot/bootupd-validate b/tests/kola/boot/bootupd-validate
index fca0f9a443..4650dae372 100755
--- a/tests/kola/boot/bootupd-validate
+++ b/tests/kola/boot/bootupd-validate
@@ -19,6 +19,8 @@ set -xeuo pipefail
 . "$KOLA_EXT_DATA/commonlib.sh"
 
 overwrite=
+bootupd_version=$(rpm -q --queryformat '%{VERSION}' bootupd)
+required_version='0.2.22'
 # only x64 and aarch64 have esp device
 overwrite_file() {
     case "$(arch)" in
@@ -28,7 +30,8 @@ overwrite_file() {
                 fatal "can not find ${esp_dev}"
             fi
             mount -v "${esp_dev}" /boot/efi
-            local shim_file=$(find /boot/efi -name shim.efi)
+            # on centos can not find shim.efi, use shimx64.efi instead
+            local shim_file=$(find /boot/efi \( -name "shim.efi" -o -name "shimx64.efi" \) | head -n1)
             if [ -z "${shim_file}" ]; then
                 fatal "can not find ${shim_file}"
             fi
@@ -61,7 +64,9 @@ validate() {
 
     case "$(arch)" in
         x86_64)
-            bootupctl validate | grep "${msg_bios}"
+            if vergte "${bootupd_version}" "${required_version}"; then
+                bootupctl validate | grep "${msg_bios}"
+            fi
             bootupctl validate | grep "${msg_efi}"
             ;;
         aarch64)
@@ -76,11 +81,20 @@ validate() {
     esac
 }
 
+# should remove this until https://issues.redhat.com/browse/RHEL-66584 is fixed
+set_selinux_permissve() {
+    source /etc/os-release
+    if is_scos || ([ "${RHEL_VERSION}" == "9.6" ] && [ "${VARIANT_ID}" == "coreos" ] ); then
+        semanage permissive -a bootupd_t
+    fi
+}
+
 overwrite_file
 if [ -n "${overwrite}" ] && bootupctl validate 2>&1; then
     fatal "bootupctl validate did not fail as expected"
 fi
 
+set_selinux_permissve
 adopt_and_update
 validate
 
diff --git a/tests/kola/systemd/no-systemd-firstboot b/tests/kola/systemd/no-systemd-firstboot
new file mode 100755
index 0000000000..38f248b33f
--- /dev/null
+++ b/tests/kola/systemd/no-systemd-firstboot
@@ -0,0 +1,24 @@
+#!/bin/bash
+## kola:
+##   exclusive: false
+##   tags: "platform-independent"
+##   description: Verify systemd-firstboot isn't active.
+
+set -xeuo pipefail
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
+
+UnitFileState=$(systemctl show systemd-firstboot.service --value --property=UnitFileState) # static
+UnitFilePreset=$(systemctl show systemd-firstboot.service --value --property=UnitFilePreset) # disabled
+ActiveState=$(systemctl show systemd-firstboot.service --value --property=ActiveState) # inactive
+SubState=$(systemctl show systemd-firstboot.service --value --property=SubState) # dead
+
+if [[ $UnitFileState != static ]] ||
+   [[ $UnitFilePreset != disabled ]] ||
+   [[ $ActiveState != inactive ]] ||
+   [[ $SubState != dead ]]; then
+    systemctl status systemd-firstboot.service
+    fatal "systemd-firstboot.service is not completely neutralized"
+fi
+ok "systemd-firstboot.service completely neutralized"
diff --git a/tests/kola/upgrade/extended/test.sh b/tests/kola/upgrade/extended/test.sh
index d4fada76d3..4d73db845d 100755
--- a/tests/kola/upgrade/extended/test.sh
+++ b/tests/kola/upgrade/extended/test.sh
@@ -162,34 +162,35 @@ wait-for-coreos-fix-selinux-labels() {
         echo "Waited for coreos-fix-selinux-labels.service to finish"
 }
 
-# Check if the rollback deployment has the dtb copy fix, which
-# means that the dtb files should have the correct SELinux labels.
+# We need to drop the rollback deployment. During upgrade
+# `...-> 40.20240906.1.0 (A)-> 41.20241109.1.0 (B)-> 42.20241114.91.0 (C)`
+# 1) A->B, A has the unfixed ostree, the upgrade will copy dtb files
+# to `/boot/ostree` both for current A and new B with wrong label
+# 2) B->C, B has the fixed ostree, the upgrade will prune A, leave B
+# with wrong label, and new C with correct label
+# 3) Finaly booting C and will check that B has the wrong label
+# In this case we need to drop the rollback before checking.
+#
+# If then upgrade to newer D, the upgrade will prune B (wrong label),
+# leave C with correct label, and new D with correct label. (We
+# should remove the drop under this case)
+#
 # https://github.com/coreos/fedora-coreos-tracker/issues/1808
 #
-# NOTE: we can drop this once the newest barrier release for all
-# streams is newer than 41.20241028.x.x.
-has_dtb_cp_fix() {
+# NOTE: we can drop this once moved to F43.
+drop_rollback_on_aarch64() {
     # The dtb copy issue was only ever an issue ever on aarch64
-    [ "$(arch)" != 'aarch64' ] && return 0
-    # We have the dtb copy fix if the rollback deployment is newer than
-    # when the fixed ostree was included. It should be fixed in the
-    # next round of releases after 41.20241028. Note 41.20241028.0.0
-    # is not a real build and uses `0` for the stream identifier, but
-    # should sort accordingly.
-    previous=$(rpm-ostree status --json | jq -r '.deployments[] | select(.booted == false).version')
-    if ! vergt $previous '41.20241028.0.0'; then
-        return 1
-    else
-        return 0
-    fi
+    [ "$(arch)" != 'aarch64' ] && return
+    echo "Dropping rollback deployment because it could have mislabeled dtb files"
+    rpm-ostree cleanup -r
 }
 
 selinux-sanity-check() {
     # First make sure the migrations/fix script has finished if this is the boot
     # where the fixes are taking place.
     wait-for-coreos-fix-selinux-labels
-    # Check to see if we have the dtb copy fix
-    has_dtb_cp_fix || add_dtb_exception='true'
+    # Drop the rooback on aarch64 before checking.
+    drop_rollback_on_aarch64
     # Verify SELinux labels are sane. Migration scripts should have cleaned
     # up https://github.com/coreos/fedora-coreos-tracker/issues/1772
     unlabeled="$(find /sysroot -context '*unlabeled_t*' -print0 | xargs --null -I{} ls -ldZ '{}')"
@@ -230,9 +231,6 @@ selinux-sanity-check() {
             # Add in a few temporary glob exceptions
             # https://github.com/coreos/fedora-coreos-tracker/issues/1806
             [[ "${path}" =~ /etc/selinux/targeted/active/ ]] && continue
-            if [ "${add_dtb_exception:-}" == 'true' ]; then
-                [[ "${path}" =~ /boot/ostree/.*/dtb ]] && continue
-            fi
             if [[ "${exceptions[$path]:-noexception}" == 'noexception' ]]; then
                 echo "Unexpected mislabeled file found: ${path}"
                 found="1"