diff --git a/knot-3.3.7.tar.xz b/knot-3.3.7.tar.xz
deleted file mode 100644
index 2e93f72..0000000
--- a/knot-3.3.7.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:18ceb398578342e9a3d5b75f2423945a2f8d1d7c730f24f4d2aa4a24b50e831d
-size 1564920
diff --git a/knot-3.3.7.tar.xz.asc b/knot-3.3.7.tar.xz.asc
deleted file mode 100644
index c247915..0000000
--- a/knot-3.3.7.tar.xz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEdC+k6VgptsXqxrhXELt69v671qsFAmZ6iQYACgkQELt69v67
-1quiRA//d9IwkFNWo1YlLo6KrnzRTRRkR70bGzJKOfA1KTrqFGN4oMlr872PSNy2
-mJgJmB4tPtW6BQb1Rqb6HRxMR8zshT/YslkFGe6GArdcJNlT93IYa9cB2fmnich2
-r8XBi9OQ0lJOcX+IWcjUbJavU1cDo3lehGUrNK41QX20a/40CrMNRS5YGjp3o5kB
-r1WVWhzaVhGhHDVGBrz99cyNarmP+dCHzBwReh3TAyxSp6g8ubNzwBqqJQwH8pYq
-xS61LuQJU/Y88JnaXNgVvv7hzlV+jTzcH/VQTI10aHVYs5lu9fU4tWnkLxf5E8wO
-LUYRhXf6Nr2I9jm+8LT7oUXUaDjga7sRFDWs0y56dSjqNT5S3Nei+bCMiUrYzi9l
-V72o2poqldyD+DG7UcYOyVhNLNgvo6a0wwiRnNk2dk5Ey6ZBW9+OpCqA0PQEtijM
-GJ67JP1d2UDIW1wlzr25dofO9p1elGqGk7R42bfciAh7tZhH8JXrmtBL6PARu7/O
-cRPQyEXbJov29LXmBtEHPO1YsHsyz53htjGmXjHvAFQuB2Nc+qeyI+IqVnne1xKL
-u1ptxW6XJUxpO54SNwUJft9fca8AS3wQQhRcfjjPMjpEpqn5QaV1sQWiR8NtktGt
-oMfDyrXoM/Nty43mxcAnAREXFKkQr3se2D+b+0ZROVikm1iRVIo=
-=To30
------END PGP SIGNATURE-----
diff --git a/knot-3.3.8.tar.xz b/knot-3.3.8.tar.xz
new file mode 100644
index 0000000..2b6cb57
--- /dev/null
+++ b/knot-3.3.8.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:498de8338489a625673797f7ecc921fa4490c826afbfa42fa66922b525089e6a
+size 1608360
diff --git a/knot-3.3.8.tar.xz.asc b/knot-3.3.8.tar.xz.asc
new file mode 100644
index 0000000..b519645
--- /dev/null
+++ b/knot-3.3.8.tar.xz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEdC+k6VgptsXqxrhXELt69v671qsFAmad/vIACgkQELt69v67
+1qsexg//fDv3BExMkpx7hPz5j0bncnXuWdpUKQVNAu/xs3dnTI/WsnmS8lnh4CTP
+mWvcsoO5FxzK9Nda76YvMc06eVjvlFXy4Mvzkp/OHf4u+RGcDVq2KHCF33i9YzGd
+cGbRDK2ERNvpdvsdSgR/p34XneqDwpGHfJin3U7BdyM7dSoSrPUwBR3KgApCppnr
+53PxWGGuSa4tpNPxMpWPa5tP/w3PhCd31MGXGrk4UulhCPAQ1oZPzxE81LcBVlW+
+a0Checbg2ZW685h9hvZqQzeJEkFXa1q4uFsOBhVMhf262VTUYMJojKoolykOSMDV
+QwirOUHAB32DpLpzhu8qdswCDcjFsXBr/ZrI08HivcMDFCj1XYkw57T94ZdJ+E6e
+E81U0SbIwrJtWrms4jwa9v+7lmMgfdRXcdGy2jaEm5O/NtYmy2G7YQ8Uji+YZyc2
+tlxzF1ImO3X7eIu/2Lpb2ubhgU7VrQG0Ho1lzEFTebBh6Ywjrwwfh7L/YXEmvOHm
+SXewwRDyhfValDCbF29AV4Nof/CLBqg5JD2DMLUMgyQ2mwDgTJky6tA5EgaxJPIM
+q/vrU9fKsK1o/vP9tldZ/Gwuhip8dKpkw0xDHOuBrY1vstHZSn+FqnP8AaLTcmPs
+6s6fj8orf7QD7CQ4b8uWi2T6IncPi4CnB2bvoUwqqHM4XFQK1bM=
+=JelB
+-----END PGP SIGNATURE-----
diff --git a/knot.changes b/knot.changes
index 03399d6..5d242ae 100644
--- a/knot.changes
+++ b/knot.changes
@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Wed Jul 24 14:57:48 UTC 2024 - Michal Hrusecky <michal.hrusecky@opensuse.org>
+
+- split knot-utils with kdig and friends
+
+-------------------------------------------------------------------
+Tue Jul 23 20:59:22 UTC 2024 - Michal Hrusecky <michal.hrusecky@opensuse.org>
+
+- update to version 3.3.8, see
+  https://www.knot-dns.cz/2024-07-22-version-338.html
+
 -------------------------------------------------------------------
 Mon Jul  1 21:42:11 UTC 2024 - Michal Hrusecky <michal.hrusecky@opensuse.org>
 
diff --git a/knot.spec b/knot.spec
index ba818b0..6adbb1b 100644
--- a/knot.spec
+++ b/knot.spec
@@ -35,7 +35,7 @@ BuildRequires:  pkgconfig(libsystemd)
 %{?systemd_requires}
 %endif
 Name:           knot
-Version:        3.3.7
+Version:        3.3.8
 Release:        0
 Summary:        An authoritative DNS daemon
 License:        GPL-3.0-or-later
@@ -46,6 +46,7 @@ Source2:        knot-tmp.conf
 Source3:        https://secure.nic.cz/files/knot-dns/%{pkg_name}-%{version}.tar.xz.asc
 Source4:        system-user-knot.conf
 Source99:       knot.keyring
+Recommends:     knot-utils
 BuildRequires:  libcap-ng-devel
 BuildRequires:  libedit-devel
 BuildRequires:  libnghttp2-devel
@@ -103,6 +104,19 @@ removal.
 
 This package contains headers for knot.
 
+%package utils
+#
+Summary:        Utilities to query and test DNS coming from Knot project
+Group:          Productivity/Networking/DNS/Utilities
+
+%description utils
+Knot DNS is a DNS server. It implements only the authoritative domain
+name service. It uses a multi-threaded and mostly lock-free
+implementation and can operate non-stop during zone addition or
+removal.
+
+This package contains tools to query and test DNS like kdig and knsupdate.
+
 %package -n %{libdnssec}
 #
 Summary:        DNSSEC support functions for Knot DNS
@@ -186,7 +200,12 @@ This package contains a library for a zone record scanner.
 
 %install
 %make_install STRIP="/bin/true"
-find %{buildroot}
+for i in kdig khost knsec3hash knsupdate; do
+    find %{buildroot} -name "$i*" | sed 's|%{buildroot}||' | while read fl; do
+        echo "$fl*" >> utils
+        echo "%exclude $fl*" >> no-utils
+    done
+done
 install -d %{buildroot}%{_docdir}/%{pkg_name}
 install -d %{buildroot}%{_docdir}/%{pkg_name}/samples/
 rm %{buildroot}%{_sysconfdir}/%{pkg_name}/*
@@ -242,11 +261,11 @@ fi
 %postun -n %{libknot}     -p /sbin/ldconfig
 %postun -n %{libzscanner} -p /sbin/ldconfig
 
-%files
+%files -f no-utils
 %dir %attr(750,knot,knot) %{_sysconfdir}/%{pkg_name}
 %config(noreplace) %attr(640,knot,knot) %{_sysconfdir}/%{pkg_name}/%{pkg_name}.conf
-%{_sbindir}/*
 %{_bindir}/*
+%{_sbindir}/*
 %{_mandir}/man?/*
 %doc %{_docdir}/%{pkg_name}
 %if %{with systemd}
@@ -267,6 +286,8 @@ fi
 %files -n %{libzscanner}
 %{_libdir}/libzscanner.so.*
 
+%files utils -f utils
+
 %files devel
 %{_includedir}/knot/
 %{_libdir}/libdnssec.so