diff --git a/keepalived.changes b/keepalived.changes
index fe6a8de..7695847 100644
--- a/keepalived.changes
+++ b/keepalived.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Tue Apr 12 14:50:58 UTC 2022 - Marcus Rueckert <mrueckert@suse.de>
+
+- Own /etc/keepalived/keepalived.conf as %ghost entry
+  otherwise upgrading the package will always move the
+  /etc/keepalived/keepalived.conf to
+  /etc/keepalived/keepalived.conf.rpmsave
+- make permissions of config files more secure
+
 -------------------------------------------------------------------
 Thu Feb 24 18:36:08 UTC 2022 - Ferdinand Thiessen <rpm@fthiessen.de>
 
diff --git a/keepalived.spec b/keepalived.spec
index 2364572..2dde644 100644
--- a/keepalived.spec
+++ b/keepalived.spec
@@ -208,7 +208,8 @@ getent passwd %{name} >/dev/null || \
 %doc %{_defaultdocdir}/%{name}/
 %dir  %{_sysconfdir}/keepalived
 %dir %attr(-,keepalived,keepalived) %{_var}/lib/%{name}
-%config %{_sysconfdir}/keepalived/keepalived.conf.sample
+%config(noreplace) %ghost %attr(0640,root,root) %{_sysconfdir}/keepalived/keepalived.conf
+%config %attr(0640,root,root) %{_sysconfdir}/keepalived/keepalived.conf.sample
 %{_fillupdir}/sysconfig.%{name}
 %{_bindir}/genhash
 %{_sbindir}/rckeepalived