diff --git a/grafana.spec b/grafana.spec
index e3cc772..c2867b0 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -19,13 +19,14 @@
 end}
 
 %global gomodulesmode GO111MODULE=auto
-%global gotestflags   %{gotestflags} -tags=integration
+%global _gotestflags_save %{?gotestflags}
+%global gotestflags %{?_gotestflags_save} -tags=integration
 
 %global selinux_variants mls targeted
 
 Name:             grafana
 Version:          10.2.6
-Release:          17%{?dist}
+Release:          22%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPL-3.0-only
 URL:              https://grafana.org
@@ -1025,6 +1026,21 @@ done
 %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
 
 %changelog
+* Wed Dec 3 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-22
+- Fix recursive macro definition causing rpminspect failure
+
+* Tue Dec 2 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-21
+- Fix grafana-selinux cgroups denials
+
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 10.2.6-20
+- rebuild
+
+* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 10.2.6-19
+- Rebuild for golang-1.25.0
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.2.6-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
 * Wed Jul 16 2025 Sam Feifer <sfeifer@redhat.com> - 10.2.6-17
 - Backport selinux policy changes
 - Backport selinux packaging changes in the spec file
diff --git a/grafana.te b/grafana.te
index 41f0cb3..a536e21 100644
--- a/grafana.te
+++ b/grafana.te
@@ -108,6 +108,16 @@ allow grafana_t self:unix_stream_socket connectto;
 
 allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
 
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
 optional_policy(`
 	require {
 		type smtp_port_t;