diff --git a/.gitmodules b/.gitmodules
index c09e188a..b219f0bb 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -3,4 +3,4 @@
 	url = https://gitlab.gnome.org/GNOME/libglnx.git
 [submodule "libdnf"]
 	path = libdnf
-	url = https://github.com/projectatomic/libdnf
+	url = https://github.com/rpm-software-management/libdnf
diff --git a/Makefile-libdnf.am b/Makefile-libdnf.am
index abf3d166..06153f4e 100644
--- a/Makefile-libdnf.am
+++ b/Makefile-libdnf.am
@@ -21,14 +21,14 @@
 ALL_LOCAL_HOOKS += libdnf-local
 libdnf-local:
 	cd libdnf-build && $(MAKE) $(if $(subst 0,,$(V)),VERBOSE=1,)
-	ln -sf libdnf-build/libdnf/libdnf.so.1 .
-libdnf.so.1: libdnf-local
-CLEANFILES += libdnf.so.1
+	ln -sf libdnf-build/libdnf/libdnf.so.2 .
+libdnf.so.2: libdnf-local
+CLEANFILES += libdnf.so.2
 GITIGNOREFILES += libdnf-build/
 
 install-libdnf-hook:
 	install -d -m 0755 $(DESTDIR)$(libdir)/rpm-ostree
-	install -m 0755 $$(readlink libdnf.so.1) $(DESTDIR)$(libdir)/rpm-ostree
+	install -m 0755 $$(readlink libdnf.so.2) $(DESTDIR)$(libdir)/rpm-ostree
 INSTALL_DATA_HOOKS += install-libdnf-hook
 
 clean-local: clean-local-dnf
diff --git a/Makefile-libpriv.am b/Makefile-libpriv.am
index 76344d30..a36116b3 100644
--- a/Makefile-libpriv.am
+++ b/Makefile-libpriv.am
@@ -85,7 +85,7 @@ librpmostreepriv_la_LIBADD = \
 	$(NULL)
 
 # bundled libdnf
-EXTRA_librpmostreepriv_la_DEPENDENCIES = libdnf.so.1
+EXTRA_librpmostreepriv_la_DEPENDENCIES = libdnf.so.2
 
 gperf_gperf_sources = src/libpriv/rpmostree-script-gperf.gperf
 BUILT_SOURCES += $(gperf_gperf_sources:-gperf.gperf=-gperf.c)
diff --git a/Makefile.am b/Makefile.am
index 531e5d4a..6aa485f8 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -34,9 +34,7 @@ endif
 RPM_OSTREE_GITREV=$(shell if command -v git >/dev/null 2>&1 && test -e $(srcdir)/.git; then git describe --abbrev=42 --tags --always HEAD; fi)
 
 ACLOCAL_AMFLAGS += -I m4 ${ACLOCAL_FLAGS}
-# WITH_SWDB is a hackaround for it being used in libdnf headers
 AM_CPPFLAGS += -DDATADIR='"$(datadir)"' \
-	-DWITH_SWDB=0 \
 	-DLIBEXECDIR='"$(libexecdir)"' \
 	-DLOCALEDIR=\"$(datadir)/locale\" \
 	-DSYSCONFDIR='"$(sysconfdir)"' \
diff --git a/ci/installdeps.sh b/ci/installdeps.sh
index b06c6530..c96e318b 100755
--- a/ci/installdeps.sh
+++ b/ci/installdeps.sh
@@ -22,6 +22,9 @@ fi
 pkg_upgrade
 pkg_install_if_os centos epel-release
 pkg_install_builddeps rpm-ostree
+# XXX: new libdnf deps until next release
+pkg_install json-c-devel cppunit{,-devel} swig sqlite-devel \
+    libmodulemd1-devel libsmartcols-devel gpgme-devel
 # Mostly dependencies for tests
 pkg_install ostree{,-devel,-grub2} createrepo_c /usr/bin/jq PyYAML \
     libubsan libasan libtsan elfutils fuse sudo python-gobject-base \
diff --git a/libdnf b/libdnf
index 7ecb2f5d..d8e481b3 160000
--- a/libdnf
+++ b/libdnf
@@ -1 +1 @@
-Subproject commit 7ecb2f5ddc93ae6f819b95ef7940b1d4dd66eb4d
+Subproject commit d8e481b331137089c25528f59d9d807fa0753e4c
diff --git a/src/daemon/rpmostreed-deployment-utils.c b/src/daemon/rpmostreed-deployment-utils.c
index 90a026d2..3e86cbaf 100644
--- a/src/daemon/rpmostreed-deployment-utils.c
+++ b/src/daemon/rpmostreed-deployment-utils.c
@@ -937,6 +937,14 @@ advisory_equal (gconstpointer v1,
                       dnf_advisory_get_id ((DnfAdvisory*)v2));
 }
 
+/* adds noop-on-NULL semantics so we can steal in advisories_variant() */
+static void
+advisory_free (gpointer p)
+{
+  if (p)
+    dnf_advisory_free (p);
+}
+
 /* Go through the list of @pkgs and check if there are any advisories open for them. If
  * no advisories are found, returns %NULL. Otherwise, returns a GVariant of the type
  * RPMOSTREE_UPDATE_ADVISORY_GVARIANT_FORMAT.
@@ -946,7 +954,7 @@ advisories_variant (DnfSack    *sack,
                     GPtrArray  *pkgs)
 {
   g_autoptr(GHashTable) advisories =
-    g_hash_table_new_full (advisory_hash, advisory_equal, g_object_unref,
+    g_hash_table_new_full (advisory_hash, advisory_equal, advisory_free,
                            (GDestroyNotify)g_ptr_array_unref);
 
   /* libdnf provides pkg -> set of advisories, but we want advisory -> set of pkgs;
@@ -967,9 +975,12 @@ advisories_variant (DnfSack    *sack,
           GPtrArray *pkgs_in_advisory = g_hash_table_lookup (advisories, advisory);
           if (!pkgs_in_advisory)
             {
+              /* take it out of the array, transferring ownership to the hash table; there's
+               * g_ptr_array_steal_index() we could use, but it's still very new */
+              advisories_with_pkg->pdata[j] = NULL;
               pkgs_in_advisory =
                 g_ptr_array_new_with_free_func ((GDestroyNotify)g_object_unref);
-              g_hash_table_insert (advisories, g_object_ref (advisory), pkgs_in_advisory);
+              g_hash_table_insert (advisories, advisory, pkgs_in_advisory);
             }
           g_ptr_array_add (pkgs_in_advisory, g_object_ref (pkg));
         }
diff --git a/src/libpriv/rpmostree-core.c b/src/libpriv/rpmostree-core.c
index cd3c0e5b..960f33f5 100644
--- a/src/libpriv/rpmostree-core.c
+++ b/src/libpriv/rpmostree-core.c
@@ -425,10 +425,11 @@ rpmostree_context_new_system (OstreeRepo   *repo,
   dnf_context_set_solv_dir (self->dnfctx, RPMOSTREE_CORE_CACHEDIR RPMOSTREE_DIR_CACHE_SOLV);
   dnf_context_set_lock_dir (self->dnfctx, "/run/rpm-ostree/" RPMOSTREE_DIR_LOCK);
   dnf_context_set_user_agent (self->dnfctx, PACKAGE_NAME "/" PACKAGE_VERSION);
+  /* don't need SWDB: https://github.com/rpm-software-management/libdnf/issues/645 */
+  dnf_context_set_write_history (self->dnfctx, FALSE);
 
   dnf_context_set_check_disk_space (self->dnfctx, FALSE);
   dnf_context_set_check_transaction (self->dnfctx, FALSE);
-  dnf_context_set_yumdb_enabled (self->dnfctx, FALSE);
 
   return self;
 }
diff --git a/src/libpriv/rpmostree-rojig-client.c b/src/libpriv/rpmostree-rojig-client.c
index 30458d12..118c60cd 100644
--- a/src/libpriv/rpmostree-rojig-client.c
+++ b/src/libpriv/rpmostree-rojig-client.c
@@ -34,8 +34,7 @@
 #include "rpmostree-rpm-util.h"
 #include "rpmostree-output.h"
 // For the rojig Requires parsing
-#include <libdnf/dnf-reldep-private.hpp>
-#include <libdnf/dnf-sack-private.hpp>
+#include <libdnf/dnf-reldep-list.h>
 
 #include <string.h>
 #include <stdlib.h>
diff --git a/src/libpriv/rpmostree-rpm-util.c b/src/libpriv/rpmostree-rpm-util.c
index 99f60381..5197d9cb 100644
--- a/src/libpriv/rpmostree-rpm-util.c
+++ b/src/libpriv/rpmostree-rpm-util.c
@@ -1170,7 +1170,7 @@ rpmostree_get_matching_packages (DnfSack *sack,
   HySubject subject = NULL;
 
   subject = hy_subject_create (pattern);
-  selector = hy_subject_get_best_selector (subject, sack, false);
+  selector = hy_subject_get_best_selector (subject, sack, NULL, FALSE, NULL);
   matches = hy_selector_matches (selector);
 
   hy_selector_free (selector);
diff --git a/tests/vmcheck/install.sh b/tests/vmcheck/install.sh
index f0abc53a..592124bd 100755
--- a/tests/vmcheck/install.sh
+++ b/tests/vmcheck/install.sh
@@ -18,7 +18,9 @@ ostree --version
 # We don't want to sync all of userspace, just things
 # that rpm-ostree links to or uses and tend to drift
 # in important ways.
-pkgs="libsolv"
+# XXX: We add libmodulemd manually for now until it's
+# part of the image.
+pkgs="libsolv libmodulemd1"
 if rpm -q zchunk-libs 2>/dev/null; then
     pkgs="${pkgs} zchunk-libs"
 fi