diff --git a/README.maintainer b/README.maintainer
index ab0db12..a3bd5f0 100644
--- a/README.maintainer
+++ b/README.maintainer
@@ -160,6 +160,13 @@ Limitations & Ceveats
   will be executed by the cron script / systemd timer *after* an update run
   has been performed.
 
+Upgrade Notes
+=============
+
+If you are upgrading from letsencrypt.sh, note that you need to move
+/etc/letsencrypt.sh to /etc/dehydrated and chown it to the "dehydrated"
+user.
+
 Links
 =====
 
diff --git a/dehydrated.changes b/dehydrated.changes
index 713414a..f6d26b7 100644
--- a/dehydrated.changes
+++ b/dehydrated.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Mon Jun 29 12:38:31 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
+
+- Remove potentially harmful scriptlet (bsc#1154167). Documented
+  transition case in the maintainer README. Unlikely enough. The
+  versions that have not transitioned yet would be broken for more
+  than two years now.
+
 -------------------------------------------------------------------
 Wed May  6 12:34:56 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
 
diff --git a/dehydrated.spec b/dehydrated.spec
index a82fba4..b6215a6 100644
--- a/dehydrated.spec
+++ b/dehydrated.spec
@@ -146,7 +146,6 @@ This adds a configuration file for dehydrated's acme-challenge to nginx.
 getent group %{_user} >/dev/null || %{_sbindir}/groupadd -r %{_user}
 getent passwd %{_user} >/dev/null || %{_sbindir}/useradd -g %{_user} \
 	-s /bin/false -r -c "%{_user}" -d %{_home} %{_user}
-if [ -d %{_sysconfdir}/letsencrypt.sh ]; then mv %{_sysconfdir}/letsencrypt.sh %{_sysconfdir}/dehydrated; chown -R %{_user} %{_sysconfdir}/dehydrated; fi
 if [ -e %{_sysconfdir}/dehydrated/config.sh ]; then mv %{_sysconfdir}/dehydrated/config.sh %{_sysconfdir}/dehydrated/config; fi
 
 %if %{with systemd}