diff --git a/.gitignore b/.gitignore
index 1e3b99a..4530dbe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -45,3 +45,4 @@ freeradius-*.src.rpm
 /freeradius-server-3.2.4.tar.bz2
 /freeradius-server-3.2.5.tar.bz2
 /freeradius-server-3.2.7.tar.bz2
+/freeradius-server-3.2.8.tar.bz2
diff --git a/freeradius.spec b/freeradius.spec
index 7629663..87126ca 100644
--- a/freeradius.spec
+++ b/freeradius.spec
@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.2.7
-Release: 6%{?dist}
+Version: 3.2.8
+Release: 2%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: http://www.freeradius.org/
 
@@ -14,7 +14,7 @@ URL: http://www.freeradius.org/
 
 %global dist_base freeradius-server-%{version}
 
-Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
+Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
@@ -204,6 +204,15 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.
 
+%package kafka
+Summary: Kafka producer support for FreeRADIUS
+Requires: %{name} = %{version}-%{release}
+Requires: librdkafka
+BuildRequires: librdkafka-devel
+
+%description kafka
+This plugin provides Kafka producer support for the FreeRADIUS server project.
+
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
@@ -361,7 +370,19 @@ EOF
 %preun
 %systemd_preun radiusd.service
 
+%post
+# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
+# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
+if [ -x /usr/sbin/setsebool ]; then
+    /usr/sbin/setsebool -P radius_use_jit on || :
+fi
+
 %postun
+if [ $1 -eq 0 ]; then
+    if [ -x /usr/sbin/setsebool ]; then
+        /usr/sbin/setsebool -P radius_use_jit off || :
+    fi
+fi
 %systemd_postun_with_restart radiusd.service
 
 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :
@@ -902,7 +923,20 @@ EOF
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
+%files kafka
+%{_libdir}/freeradius/rlm_kafka.so
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
+
 %changelog
+* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
+- Enable selinux flag for JIT usage
+  Resolves: #2427017
+
+* Wed Nov 12 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
+- Update to upstream release 3.2.8
+
 * Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
diff --git a/sources b/sources
index 38a1c91..3fdee90 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (freeradius-server-3.2.7.tar.bz2) = c4a13471844ab4ce041db1567e2827370433725beadfbf425d2522b0bf9a4def8ebd41d3c4f45ad350dacdf86bc5bf3952d519d84672c7dde25a12005a009ae5
+SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae