diff --git a/systemd.changes b/systemd.changes
index 95301ad..bd67d98 100644
--- a/systemd.changes
+++ b/systemd.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Apr 20 07:59:23 UTC 2022 - Ludwig Nussel <lnussel@suse.de>
+
+- spec: sign the systemd-boot efi binary (boo#1198586)
+
 -------------------------------------------------------------------
 Tue Apr 19 11:17:03 UTC 2022 - Franck Bui <fbui@suse.com>
 
diff --git a/systemd.spec b/systemd.spec
index 4bcf341..f9ed16f 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -305,6 +305,7 @@ License:        GPL-2.0-only
 URL:            http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html
 %if %{with sd_boot}
 BuildRequires:  gnu-efi
+BuildRequires:  pesign-obs-integration
 %endif
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
@@ -720,6 +721,12 @@ Have fun with these services at your own risk.
 %install
 %meson_install
 
+%if %{with sd_boot}
+%ifarch x86_64
+export BRP_PESIGN_FILES="/usr/lib/systemd/boot/efi/systemd-bootx64.efi"
+%endif
+%endif
+
 # Don't ship resolvconf symlink for now as it conflicts with the
 # binary shipped by openresolv and provides limited compatibility
 # only