diff --git a/knot.spec b/knot.spec
index a007fea..ef0915b 100644
--- a/knot.spec
+++ b/knot.spec
@@ -2,12 +2,19 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}}
 
 %define GPG_CHECK 1
+%if 0%{?fedora} >= 40 || 0%{?rhel} >= 9
+# use modern %pyproject_* macros on distros which support them
+%define PYPROJECT 1
+%else
+# use older %py3_* macros on older/other distros
+%define PYPROJECT 0
+%endif
 %define BASE_VERSION %(echo "%{version}" | sed 's/^\\([^.]\\+\\.[^.]\\+\\).*/\\1/')
 %define repodir %{_builddir}/%{name}-%{version}
 
 Summary:	High-performance authoritative DNS server
 Name:		knot
-Version:	3.4.3
+Version:	3.4.8
 Release:	1%{?dist}
 License:	GPL-3.0-or-later
 URL:		https://www.knot-dns.cz
@@ -39,6 +46,9 @@ BuildRequires:	pkgconfig(libmnl)
 BuildRequires:	pkgconfig(libnghttp2)
 BuildRequires:	pkgconfig(libsystemd)
 BuildRequires:	pkgconfig(systemd)
+%if 0%{?fedora} || 0%{?rhel}
+BuildRequires:	softhsm
+%endif
 # dnstap dependencies
 BuildRequires:	pkgconfig(libfstrm)
 BuildRequires:	pkgconfig(libprotobuf-c)
@@ -46,6 +56,15 @@ BuildRequires:	pkgconfig(libprotobuf-c)
 BuildRequires:	pkgconfig(libmaxminddb)
 # XDP dependencies
 BuildRequires:	pkgconfig(libbpf)
+# Python modules (python3-libknot, knot-exporter) dependencies
+BuildRequires:  python3-devel
+%if 0%{?PYPROJECT}
+BuildRequires:  pyproject-rpm-macros
+BuildRequires:  python3-pip
+BuildRequires:  python3-hatchling
+%else
+BuildRequires:  python3-setuptools
+%endif
 
 # Distro-dependent dependencies
 %if 0%{?suse_version}
@@ -129,6 +148,23 @@ Requires:	%{name} = %{version}-%{release}
 %description module-geoip
 The package contains geoip Knot DNS module for geography-based responses.
 
+%package exporter
+Summary:	Prometheus exporter for Knot DNS
+BuildArch:	noarch
+Requires:	%{name}-libs = %{version}-%{release}
+
+%description exporter
+The package provides Python Prometheus exporter for Knot DNS.
+
+%package -n python3-libknot
+Summary:	Python bindings for libknot
+BuildArch:	noarch
+Requires:	%{name}-libs = %{version}-%{release}
+%{?python_provide:%python_provide python3-libknot}
+
+%description -n python3-libknot
+The package provides Python bindings for the libknot shared library.
+
 %package doc
 Summary:	Documentation for the Knot DNS server
 BuildArch:	noarch
@@ -148,6 +184,11 @@ gpg2 --verify %{SOURCE1} %{SOURCE0}
 %endif
 %autosetup -p1
 
+# Create a sysusers.d config file
+cat >knot.sysusers.conf <<EOF
+u knot - 'Knot DNS server' %{_sharedstatedir}/knot -
+EOF
+
 %build
 # disable debug code (causes unused warnings)
 CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
@@ -174,9 +215,43 @@ CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
 make %{?_smp_mflags}
 make html
 
+# build python3-libknot
+pushd python/libknot
+%if %{PYPROJECT}
+%pyproject_wheel
+%else
+%py3_build
+%endif
+popd
+# build knot-exporter
+pushd python/knot_exporter
+%if %{PYPROJECT}
+%pyproject_wheel
+%else
+%py3_build
+%endif
+popd
+
 %install
 make install DESTDIR=%{buildroot}
 
+# install python3-libknot
+pushd python/libknot
+%if %{PYPROJECT}
+%pyproject_install
+%else
+%py3_install
+%endif
+popd
+# install knot-exporter
+pushd python/knot_exporter
+%if %{PYPROJECT}
+%pyproject_install
+%else
+%py3_install
+%endif
+popd
+
 # install documentation
 install -d -m 0755 %{buildroot}%{_pkgdocdir}/samples
 install -p -m 0644 -t %{buildroot}%{_pkgdocdir}/samples samples/*.zone*
@@ -205,14 +280,12 @@ install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/knot
 # remove libarchive files
 find %{buildroot} -type f -name "*.la" -delete -print
 
+install -m0644 -D knot.sysusers.conf %{buildroot}%{_sysusersdir}/knot.conf
+
 %check
 V=1 make check
 
 %pre
-getent group knot >/dev/null || groupadd -r knot
-getent passwd knot >/dev/null || \
-  useradd -r -g knot -d %{_sharedstatedir}/knot -s /sbin/nologin \
-  -c "Knot DNS server" knot
 %if 0%{?suse_version}
 %service_add_pre knot.service
 %endif
@@ -273,6 +346,7 @@ getent passwd knot >/dev/null || \
 %{_mandir}/man8/knotc.*
 %{_mandir}/man8/knotd.*
 %ghost %attr(770,root,knot) %dir %{_rundir}/knot
+%{_sysusersdir}/knot.conf
 
 %files utils
 %{_bindir}/kdig
@@ -298,6 +372,15 @@ getent passwd knot >/dev/null || \
 %files module-geoip
 %{_libdir}/knot/modules-*/geoip.so
 
+%files exporter
+%{_bindir}/knot-exporter
+%{python3_sitelib}/knot_exporter
+%{python3_sitelib}/knot_exporter-*-info
+
+%files -n python3-libknot
+%{python3_sitelib}/libknot
+%{python3_sitelib}/libknot-*-info
+
 %files libs
 %license COPYING
 %doc NEWS
@@ -324,6 +407,25 @@ getent passwd knot >/dev/null || \
 %doc %{_pkgdocdir}/html
 
 %changelog
+* Wed Jul 30 2025 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.8-1
+- Update to 3.4.8
+
+* Thu Jun 12 2025 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.7-1
+- Update to 3.4.7
+- Add new knot-exporter and python3-libknot packages
+
+* Thu Apr 10 2025 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.6-1
+- Update to 3.4.6
+
+* Wed Mar 19 2025 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.5-1
+- Update to 3.4.5
+
+* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.4.4-2
+- Add sysusers.d config file to allow rpm to create users/groups automatically
+
+* Thu Jan 23 2025 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.4-1
+- Update to 3.4.4
+
 * Tue Dec 10 2024 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.4.3-1
 - Update to 3.4.3
 
diff --git a/sources b/sources
index 8943dbb..2b9d53a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (knot-3.4.3.tar.xz) = c05a214a9e5564d09257aff44c0f42e9d084d47536197c95dff7aa125a8b53ed99e26c90affaa6833779778cd8d37af9cc473f108ab6acf7230c476b5858c03f
-SHA512 (knot-3.4.3.tar.xz.asc) = ee8618401628a2979475fb9cf6c408d454841d5aa35fd801fdb5c24f48efc000d39160b995490341de4c0db5942deedab8991436304a9d4900560274ea526b48
+SHA512 (knot-3.4.8.tar.xz) = 62fb62e07c751bbc63759c0c74e3967b6a245bb0c76770e109b2c1bacf1580be98315ce3ecac8adfbdd37beab7b300a06078c44e57a1189def9efbc48b8d2c3e
+SHA512 (knot-3.4.8.tar.xz.asc) = 55900f6cd9963299066597da6eab2be61a9a8fb7acd562b24a6883466e132372b99fc9e9643aef39566d2eff5fec27850fed0d8b97ca8ea417626ef5c90481e1