diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 402d5c48bb..784b851cf8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -40,8 +40,8 @@ stages:
     - date '+%Y%m%d-%H%M%S'; dbus-uuidgen --ensure
     - date '+%Y%m%d-%H%M%S'; sed -i 's/^# \(pl_PL.UTF-8 .*\)$/\1/p' /etc/locale.gen ; true
     - date '+%Y%m%d-%H%M%S'; locale-gen pl_PL.UTF-8
-    - date '+%Y%m%d-%H%M%S'; grep -q "VERSION=.16.04.6 LTS" /etc/os-release && pip3 install meson==0.53.2
-    - date '+%Y%m%d-%H%M%S'; grep -q "VERSION=.16.04.6 LTS" /etc/os-release || pip3 install meson
+    - date '+%Y%m%d-%H%M%S'; grep -q "VERSION=.16.04.[0-9]\+ LTS" /etc/os-release && pip3 install meson==0.53.2
+    - date '+%Y%m%d-%H%M%S'; grep -q "VERSION=.16.04.[0-9]\+ LTS" /etc/os-release || pip3 install meson
     - date '+%Y%m%d-%H%M%S'; contrib/scripts/nm-ci-install-valgrind-in-ubuntu1604.sh
 
     # iproute2 5.2.0 on debian:sid causes our unit tests to fail.
diff --git a/contrib/fedora/rpm/NetworkManager.spec b/contrib/fedora/rpm/NetworkManager.spec
index 30ea6a1d78..aea7472235 100644
--- a/contrib/fedora/rpm/NetworkManager.spec
+++ b/contrib/fedora/rpm/NetworkManager.spec
@@ -130,6 +130,10 @@
 %global ebpf_enabled "no"
 %endif
 
+# On Fedora 33+, LTO is enabled by default. Newer branches of NetworkManager
+# fix build with LTO, but for this branch we simply disable it.
+%define _lto_cflags %{nil}
+
 ###############################################################################
 
 Name: NetworkManager
diff --git a/contrib/scripts/nm-ci-install-valgrind-in-ubuntu1604.sh b/contrib/scripts/nm-ci-install-valgrind-in-ubuntu1604.sh
index 1fd88d052b..864cce04be 100755
--- a/contrib/scripts/nm-ci-install-valgrind-in-ubuntu1604.sh
+++ b/contrib/scripts/nm-ci-install-valgrind-in-ubuntu1604.sh
@@ -13,7 +13,7 @@ set -exv
 #
 # Work around that by installing valgrind from bionic.
 
-grep -q 'PRETTY_NAME="Ubuntu 16.04.6 LTS"' /etc/os-release || exit 0
+grep -q 'PRETTY_NAME="Ubuntu 16.04.[0-9]\+ LTS"' /etc/os-release || exit 0
 dpkg -s valgrind | grep -q 'Version: 1:3.11.0-1ubuntu4.2$' || exit 0
 
 
diff --git a/shared/nm-glib-aux/nm-glib.h b/shared/nm-glib-aux/nm-glib.h
index e5a4766b30..3be708943b 100644
--- a/shared/nm-glib-aux/nm-glib.h
+++ b/shared/nm-glib-aux/nm-glib.h
@@ -412,9 +412,8 @@ _nm_g_hash_table_get_keys_as_array (GHashTable *hash_table,
 
 /*****************************************************************************/
 
-#if !GLIB_CHECK_VERSION(2, 44, 0)
 static inline gpointer
-g_steal_pointer (gpointer pp)
+_nm_g_steal_pointer (gpointer pp)
 {
 	gpointer *ptr = (gpointer *) pp;
 	gpointer ref;
@@ -424,13 +423,20 @@ g_steal_pointer (gpointer pp)
 
 	return ref;
 }
+
+#if !GLIB_CHECK_VERSION(2, 44, 0)
+static inline gpointer
+g_steal_pointer (gpointer pp)
+{
+	return _nm_g_steal_pointer (pp);
+}
 #endif
 
 #ifdef g_steal_pointer
 #undef g_steal_pointer
 #endif
 #define g_steal_pointer(pp) \
-	((typeof (*(pp))) g_steal_pointer (pp))
+	((typeof (*(pp))) _nm_g_steal_pointer (pp))
 
 /*****************************************************************************/
 
diff --git a/src/devices/wwan/nm-modem-broadband.c b/src/devices/wwan/nm-modem-broadband.c
index 949d9bff67..66b2b4668b 100644
--- a/src/devices/wwan/nm-modem-broadband.c
+++ b/src/devices/wwan/nm-modem-broadband.c
@@ -34,9 +34,22 @@
 
 #define NM_MODEM_BROADBAND_MODEM "modem"
 
-#define MODEM_CAPS_3GPP(caps) (caps & (MM_MODEM_CAPABILITY_GSM_UMTS |    \
-                                       MM_MODEM_CAPABILITY_LTE |         \
-                                       MM_MODEM_CAPABILITY_LTE_ADVANCED))
+static gboolean
+MODEM_CAPS_3GPP (MMModemCapability caps)
+{
+	G_GNUC_BEGIN_IGNORE_DEPRECATIONS
+	/* MM_MODEM_CAPABILITY_LTE_ADVANCED is marked as deprecated since ModemManager 1.14.0.
+	 *
+	 * The flag probably was never used, it certainly isn't used since 1.14.0.
+	 *
+	 * Still, just to be sure, there is no harm in checking it here. Suppress the
+	 * warning, it should have no bad effect.
+	 */
+	return NM_FLAGS_ANY (caps, (  MM_MODEM_CAPABILITY_GSM_UMTS
+	                            | MM_MODEM_CAPABILITY_LTE
+	                            | MM_MODEM_CAPABILITY_LTE_ADVANCED));
+	G_GNUC_END_IGNORE_DEPRECATIONS
+}
 
 #define MODEM_CAPS_3GPP2(caps) (caps & (MM_MODEM_CAPABILITY_CDMA_EVDO))
 
diff --git a/src/nm-hostname-manager.c b/src/nm-hostname-manager.c
index db56111600..c10d31fcb9 100644
--- a/src/nm-hostname-manager.c
+++ b/src/nm-hostname-manager.c
@@ -26,6 +26,7 @@
 
 #if HAVE_SELINUX
 #include <selinux/selinux.h>
+#include <selinux/label.h>
 #endif
 
 #include "nm-libnm-core-intern/nm-common-macros.h"
@@ -360,8 +361,8 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	gs_unref_variant GVariant *var = NULL;
 	struct stat file_stat;
 #if HAVE_SELINUX
-	security_context_t se_ctx_prev = NULL, se_ctx = NULL;
-	mode_t st_mode = 0;
+	gboolean fcon_was_set = FALSE;
+	char *fcon_prev = NULL;
 #endif
 
 	g_return_val_if_fail (NM_IS_HOSTNAME_MANAGER (self), FALSE);
@@ -391,16 +392,6 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	    && (link_path = nm_utils_read_link_absolute (file, NULL)))
 		file = link_path;
 
-#if HAVE_SELINUX
-	/* Get default context for hostname file and set it for fscreate */
-	if (stat (file, &file_stat) == 0)
-		st_mode = file_stat.st_mode;
-	matchpathcon (file, st_mode, &se_ctx);
-	matchpathcon_fini ();
-	getfscreatecon (&se_ctx_prev);
-	setfscreatecon (se_ctx);
-#endif
-
 #if defined (HOSTNAME_PERSIST_GENTOO)
 	hostname_eol = g_strdup_printf ("#Generated by NetworkManager\n"
 	                                "hostname=\"%s\"\n", hostname);
@@ -408,13 +399,39 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	hostname_eol = g_strdup_printf ("%s\n", hostname);
 #endif
 
+#if HAVE_SELINUX
+	/* Get default context for hostname file and set it for fscreate */
+	{
+		struct selabel_handle *handle;
+
+		handle = selabel_open (SELABEL_CTX_FILE, NULL, 0);
+		if (handle) {
+			mode_t st_mode = 0;
+			char *fcon = NULL;
+
+			if (stat (file, &file_stat) == 0)
+				st_mode = file_stat.st_mode;
+
+			if (   (selabel_lookup (handle, &fcon, file, st_mode) == 0)
+			    && (getfscreatecon (&fcon_prev) == 0)) {
+				setfscreatecon (fcon);
+				fcon_was_set = TRUE;
+			}
+
+			selabel_close (handle);
+			freecon (fcon);
+		}
+	}
+#endif
+
 	ret = g_file_set_contents (file, hostname_eol, -1, &error);
 
 #if HAVE_SELINUX
 	/* Restore previous context and cleanup */
-	setfscreatecon (se_ctx_prev);
-	freecon (se_ctx);
-	freecon (se_ctx_prev);
+	if (fcon_was_set)
+		setfscreatecon (fcon_prev);
+	if (fcon_prev)
+		freecon (fcon_prev);
 #endif
 
 	g_free (hostname_eol);
diff --git a/tools/run-nm-test.sh b/tools/run-nm-test.sh
index 09c735c129..be35590c48 100755
--- a/tools/run-nm-test.sh
+++ b/tools/run-nm-test.sh
@@ -297,16 +297,21 @@ if [ $HAS_ERRORS -eq 0 ]; then
     # valgrind doesn't support setns syscall and spams the logfile.
     # hack around it...
     case "$TEST_NAME" in
+        'libnm-test-nm-client' | \
+        'libnm-test-remote-settings-client' | \
+        'libnm-test-secret-agent' | \
+        'test-acd' | \
+        'test-address-linux' | \
+        'test-cleanup-linux' | \
         'test-config' | \
         'test-link-linux' | \
-        'test-acd' | \
-        'test-service-providers' | \
-        'test-remote-settings-client' | \
-        'test-secret-agent' | \
+        'test-lldp' | \
         'test-nm-client' | \
-        'libnm-test-remote-settings-client' | \
-        'libnm-test-nm-client' | \
-        'libnm-test-secret-agent' )
+        'test-platform-general' | \
+        'test-remote-settings-client' | \
+        'test-route-linux' | \
+        'test-secret-agent' | \
+        'test-service-providers' )
             if [ -z "$(sed -e '/^--[0-9]\+-- WARNING: unhandled .* syscall: /,/^--[0-9]\+-- it at http.*\.$/d' "$LOGFILE")" ]; then
                 HAS_ERRORS=1
             fi