diff --git a/dnsmasq.changes b/dnsmasq.changes
index 58f3faf..958a496 100644
--- a/dnsmasq.changes
+++ b/dnsmasq.changes
@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Tue Aug 26 14:05:14 CEST 2014 - dsterba@suse.cz
+
+- enable DNSSEC
+  - require libnettle
+  - package trust-anchors.conf
+- spec fixes:
+  - define HAVE_ flags on commandline, otherwise 'dnsmasq --version'
+    will not correctly reflect the feature status
+
+-------------------------------------------------------------------
+Fri Aug 22 07:08:36 UTC 2014 - meissner@suse.com
+
+- actually build with relro and pie. (bnc#893057)
+
 -------------------------------------------------------------------
 Wed Aug  6 06:48:20 UTC 2014 - vwallfahrer@suse.com
 
diff --git a/dnsmasq.spec b/dnsmasq.spec
index c93cdea..65f8200 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -35,6 +35,7 @@ Patch1:         group_and_isc.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  dbus-1-devel
 BuildRequires:  libidn-devel
+BuildRequires:  libnettle-devel
 BuildRequires:  pkg-config
 BuildRequires:  pkgconfig(libnetfilter_conntrack)
 %if 0%{?suse_version} >= 1210
@@ -68,10 +69,11 @@ server's leases.
 echo "#define HAVE_DBUS" >> src/config.h
 echo "#define HAVE_CONNTRACK" >> src/config.h
 echo "#define HAVE_IDN" >> src/config.h
+echo "#define HAVE_DNSSEC" >> src/config.h
 mv po/no.po po/nb.po
-export CFLAGS="%optflags -std=gnu99 -fPIC -DPIC -fpie"
+export CFLAGS="%optflags -std=gnu99 -fPIC -DPIC -fpie -DHAVE_DBUS -DHAVE_CONNTRACK -DHAVE_IDN -DHAVE_DNSSEC"
 export LDFLAGS="-Wl,-z,relro,-z,now -pie"
-make %{?_smp_mflags} AWK=gawk all-i18n
+make %{?_smp_mflags} AWK=gawk all-i18n CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS"
 make -C contrib/wrt %{?_smp_mflags}
 
 %pre
@@ -110,6 +112,7 @@ install -m 644 dbus/dnsmasq.conf ${RPM_BUILD_ROOT}/etc/dbus-1/system.d/dnsmasq.c
 install -D -m 0644 %SOURCE2 %{buildroot}%{_unitdir}/dnsmasq.service
 install -d -m 0750 ${RPM_BUILD_ROOT}/srv/tftpboot
 ln -sf /sbin/service $RPM_BUILD_ROOT/usr/sbin/rcdnsmasq
+install -D -m 0644 trust-anchors.conf %{buildroot}%{_datadir}/%{name}/trust-anchors.conf
 
 # utils subpackage
 mkdir -p $RPM_BUILD_ROOT%{_bindir} $RPM_BUILD_ROOT%{_mandir}/man1
@@ -139,6 +142,8 @@ rm -rf contrib/MacOSX-launchd
 %{_mandir}/man8/dnsmasq.8.gz
 %config(noreplace) /etc/dbus-1/system.d/dnsmasq.conf
 %{_unitdir}/dnsmasq.service
+%dir %{_datadir}/%{name}
+%{_datadir}/%{name}/trust-anchors.conf
 
 %dir %attr(0750,tftp,tftp) /srv/tftpboot