diff --git a/freeipa.spec.in b/freeipa.spec.in
index 3e6afb0a6..09eb6af34 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -76,9 +76,9 @@
 
 %endif  # Fedora
 
-# Require Dogtag PKI 10.6.6 to detect when fips is available,
-# https://pagure.io/freeipa/issue/7608
-%global pki_version 10.6.6
+# Require Dogtag PKI 10.6.7 which fixes UpdateNumberRange clone
+# installation issue; https://pagure.io/freeipa/issue/7654
+%global pki_version 10.6.7
 
 # NSS release with fix for CKA_LABEL import bug in shared SQL database.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1568271
diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py
index 9a07debb2..905838e60 100644
--- a/ipatests/test_integration/test_installation.py
+++ b/ipatests/test_integration/test_installation.py
@@ -118,7 +118,6 @@ class InstallTestBase2(IntegrationTest):
     def test_replica2_ipa_ca_install(self):
         tasks.install_ca(self.replicas[2])
 
-    @pytest.mark.xfail(reason='Ticket 7654', strict=True)
     def test_replica2_ipa_kra_install(self):
         tasks.install_kra(self.replicas[2])