diff --git a/33861.patch b/33861.patch
deleted file mode 100644
index b443387..0000000
--- a/33861.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 1310492f7a58db4315390db174da65aef699aa91 Mon Sep 17 00:00:00 2001
-From: Daan De Meyer <daan.j.demeyer@gmail.com>
-Date: Mon, 29 Jul 2024 15:41:51 +0200
-Subject: [PATCH] kernel-install: Try some more initrd variants in
- 90-loaderentry.install
-
-On CentOS/Fedora, dracut is configured to write the initrd to
-/boot/initramfs-$KERNEL_VERSION...img so let's check for that as well
-if no initrds were supplied.
----
- src/kernel-install/90-loaderentry.install.in | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/src/kernel-install/90-loaderentry.install.in b/src/kernel-install/90-loaderentry.install.in
-index 4ef6aca169c1a..84f7a4a97fb43 100755
---- a/src/kernel-install/90-loaderentry.install.in
-+++ b/src/kernel-install/90-loaderentry.install.in
-@@ -205,8 +205,18 @@ mkdir -p "${LOADER_ENTRY%/*}" || {
-         have_initrd=yes
-     done
- 
--    # Try "initrd", generated by dracut in its kernel-install hook, if no initrds were supplied
--    [ -z "$have_initrd" ] && [ -f "$ENTRY_DIR_ABS/initrd" ] && echo "initrd     $ENTRY_DIR/initrd"
-+    # Try a few variations that are generated by various initrd generators in their kernel-install hooks if
-+    # no initrds were supplied.
-+
-+    if [ -z "$have_initrd" ] && [ -f "$ENTRY_DIR_ABS/initrd" ]; then
-+        echo "initrd     $ENTRY_DIR/initrd"
-+        have_initrd=yes
-+    fi
-+
-+    if [ -z "$have_initrd" ] && [ -f "$BOOT_ROOT/initramfs-$KERNEL_VERSION.img" ]; then
-+        echo "initrd     /initramfs-$KERNEL_VERSION.img"
-+        have_initrd=yes
-+    fi
-     :
- } >"$LOADER_ENTRY" || {
-     echo "Error: could not create loader entry '$LOADER_ENTRY'." >&2
diff --git a/33864.patch b/33864.patch
deleted file mode 100644
index 290af4c..0000000
--- a/33864.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 94a2999f250e3f7579883f5c79815b80398043cd Mon Sep 17 00:00:00 2001
-From: Daan De Meyer <daan.j.demeyer@gmail.com>
-Date: Mon, 29 Jul 2024 17:13:28 +0200
-Subject: [PATCH] kernel-install: Only read cmdline from /proc/cmdline when not
- in container
-
-If we're running from within a container, we're very likely not going
-to want to use the kernel command line from /proc/cmdline, so let's add
-a check to see if we're running from a container to decide whether we'll
-use the kernel command line from /proc/cmdline.
----
- src/kernel-install/90-loaderentry.install.in | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/kernel-install/90-loaderentry.install.in b/src/kernel-install/90-loaderentry.install.in
-index 4ef6aca169c1a..79427684cc5c9 100755
---- a/src/kernel-install/90-loaderentry.install.in
-+++ b/src/kernel-install/90-loaderentry.install.in
-@@ -79,8 +79,10 @@ elif [ -f /etc/kernel/cmdline ]; then
-     BOOT_OPTIONS="$(tr -s "$IFS" ' ' </etc/kernel/cmdline)"
- elif [ -f /usr/lib/kernel/cmdline ]; then
-     BOOT_OPTIONS="$(tr -s "$IFS" ' ' </usr/lib/kernel/cmdline)"
--else
-+elif ! systemd-detect-virt --container --quiet; then
-     BOOT_OPTIONS="$(tr -s "$IFS" '\n' </proc/cmdline | grep -ve '^BOOT_IMAGE=' -e '^initrd=' | tr '\n' ' ')"
-+else
-+    BOOT_OPTIONS=""
- fi
- 
- BOOT_OPTIONS="${BOOT_OPTIONS% }"
-@@ -194,7 +196,7 @@ mkdir -p "${LOADER_ENTRY%/*}" || {
-         echo "machine-id $MACHINE_ID"
-     fi
-     [ -n "$SORT_KEY" ] && echo "sort-key   $SORT_KEY"
--    echo "options    $BOOT_OPTIONS"
-+    [ -n "$BOOT_OPTIONS" ] && echo "options    $BOOT_OPTIONS"
-     echo "linux      $KERNEL_ENTRY"
-     [ -n "$DEVICETREE_ENTRY" ] && echo "devicetree $DEVICETREE_ENTRY"
- 
diff --git a/sources b/sources
index dca53b1..87067ab 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (systemd-256.4.tar.gz) = 0357f1b61a07e594aff118dec54bd7233f37b69ccdfa393b91f46f32f08238fa7dd44df70d1df858464c866e114868ae1bec66dc685703d425cbd4c86baddfb8
+SHA512 (systemd-256.5.tar.gz) = 40558194e05a17b218adf3d6df48b738c866855d43d09c1e9381c2c568a44a8f1617b64476736fc7e34416ad9e8d25dc023cf9de090b4ef9079866919377009f
diff --git a/systemd.spec b/systemd.spec
index 0fca0eb..c4f31f5 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -43,7 +43,7 @@ Name:           systemd
 Url:            https://systemd.io
 # Allow users to specify the version and release when building the rpm by 
 # setting the %%version_override and %%release_override macros.
-Version:        %{?version_override}%{!?version_override:256.4}
+Version:        %{?version_override}%{!?version_override:256.5}
 Release:        %{?release_override}%{!?release_override:1.1}%{?dist}
 
 %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?)
@@ -115,9 +115,6 @@ Patch0010:      https://github.com/systemd/systemd/pull/26494.patch
 # Requested in https://bugzilla.redhat.com/show_bug.cgi?id=2298422
 Patch0011:      https://github.com/systemd/systemd/pull/33738.patch
 
-Patch0012:      https://github.com/systemd/systemd/pull/33861.patch
-Patch0013:      https://github.com/systemd/systemd/pull/33864.patch
-
 # Those are downstream-only patches, but we don't want them in packit builds:
 # https://bugzilla.redhat.com/show_bug.cgi?id=2251843
 Patch0491:      https://github.com/systemd/systemd/pull/30846.patch
@@ -418,8 +415,10 @@ Obsoletes:      systemd < 245.6-1
 Provides:       udev = %{version}
 Provides:       udev%{_isa} = %{version}
 Obsoletes:      udev < 183
+%if 0%{?fedora} || 0%{?rhel} >= 10
 Requires:       (grubby > 8.40-72 if grubby)
 Requires:       (sdubby > 1.0-3 if sdubby)
+%endif
 # A backport of systemd-timesyncd is shipped as a separate package in EPEL so
 # let's make sure we properly handle that.
 %if 0%{?rhel}
@@ -494,7 +493,9 @@ Requires:       python3dist(pefile)
 Requires:       python3dist(zstd)
 %endif
 Requires:       python3dist(cryptography)
+%if 0%{?fedora}
 Recommends:     python3dist(pillow)
+%endif
 
 # for tests
 %ifarch riscv64
@@ -1012,6 +1013,13 @@ mv -v %{buildroot}/usr/sbin/* %{buildroot}%{_bindir}/
 rm %{buildroot}/usr/lib/sysusers.d/basic.conf
 %endif
 
+# Disable sshd_config.d/20-systemd-userdb.conf for now.
+# This option may override an existing AuthorizedKeysCommand setting
+# (or be ineffective, depending on the order of configuration).
+# See https://github.com/systemd/systemd/issues/33648.
+rm %{buildroot}/etc/ssh/sshd_config.d/20-systemd-userdb.conf
+mv %{buildroot}/usr/lib/tmpfiles.d/20-systemd-userdb.conf{,.example}
+
 %find_lang %{name}
 
 # Split files in build root into rpms