diff --git a/pesign-run.patch b/pesign-run.patch
new file mode 100644
index 0000000..de0b8c3
--- /dev/null
+++ b/pesign-run.patch
@@ -0,0 +1,90 @@
+Index: pesign-0.109/src/Makefile
+===================================================================
+--- pesign-0.109.orig/src/Makefile
++++ pesign-0.109/src/Makefile
+@@ -79,7 +79,7 @@ install_sysvinit:
+ 
+ install :
+ 	$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/
+-	$(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/
++	$(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/
+ 	$(INSTALL) -d -m 755 $(INSTALLROOT)$(PREFIX)/bin/
+ 	$(INSTALL) -m 755 pesign $(INSTALLROOT)$(PREFIX)/bin/
+ 	$(INSTALL) -m 755 client $(INSTALLROOT)$(PREFIX)/bin/pesign-client
+Index: pesign-0.109/src/daemon.h
+===================================================================
+--- pesign-0.109.orig/src/daemon.h
++++ pesign-0.109/src/daemon.h
+@@ -47,7 +47,7 @@ typedef enum {
+ } pesignd_cmd;
+ 
+ #define PESIGND_VERSION 0xa3cf41cb
+-#define SOCKPATH	"/var/run/pesign/socket"
+-#define PIDFILE		"/var/run/pesign.pid"
++#define SOCKPATH	"/run/pesign/socket"
++#define PIDFILE		"/run/pesign.pid"
+ 
+ #endif /* DAEMON_H */
+Index: pesign-0.109/src/macros.pesign
+===================================================================
+--- pesign-0.109.orig/src/macros.pesign
++++ pesign-0.109/src/macros.pesign
+@@ -34,7 +34,7 @@
+       %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i}			\\\
+                  --certdir ${nss} -c signer %{-o}			\
+       rm -rf ${sattrs} ${sattrs}.sig ${nss}				\
+-    elif [ -S /var/run/pesign/socket ]; then				\
++    elif [ -S /run/pesign/socket ]; then				\
+       %{_pesign_client} -t "OpenSC Card (Fedora Signer)"		\\\
+                         -c "/CN=Fedora Secure Boot Signer"		\\\
+                         %{-i} %{-o} %{-e} %{-s} %{-C}			\
+Index: pesign-0.109/src/pesign.sysvinit
+===================================================================
+--- pesign-0.109.orig/src/pesign.sysvinit
++++ pesign-0.109/src/pesign.sysvinit
+@@ -4,7 +4,7 @@
+ #
+ # chkconfig: - 50 50
+ # processname: /usr/bin/pesign
+-# pidfile: /var/run/pesign.pid
++# pidfile: /run/pesign.pid
+ ### BEGIN INIT INFO 
+ # Provides:          pesign
+ # Should-Start:      $remote_fs
+@@ -19,7 +19,7 @@
+ 
+ [ -f /usr/bin/pesign ] || exit 1
+ 
+-PESIGN_PIDFILE=/var/run/pesign.pid
++PESIGN_PIDFILE=/run/pesign.pid
+ RETVAL=0
+ 
+ start(){
+@@ -28,15 +28,15 @@ start(){
+     RETVAL=$?
+     echo
+     touch /var/lock/subsys/pesign
+-    setfacl -m u:kojibuilder:x /var/run/pesign
+-    setfacl -m u:kojibuilder:rw /var/run/pesign/socket
+-    setfacl -m g:kojibuilder:x /var/run/pesign
+-    setfacl -m g:kojibuilder:rw /var/run/pesign/socket
++    setfacl -m u:kojibuilder:x /run/pesign
++    setfacl -m u:kojibuilder:rw /run/pesign/socket
++    setfacl -m g:kojibuilder:x /run/pesign
++    setfacl -m g:kojibuilder:rw /run/pesign/socket
+ }
+ 
+ stop(){
+     echo -n "Stopping pesign: "
+-    killproc -p /var/run/pesign.pid pesignd
++    killproc -p /run/pesign.pid pesignd
+     RETVAL=$?
+     echo
+     rm -f /var/lock/subsys/pesign
+Index: pesign-0.109/src/tmpfiles.conf
+===================================================================
+--- pesign-0.109.orig/src/tmpfiles.conf
++++ pesign-0.109/src/tmpfiles.conf
+@@ -1 +1 @@
+-D /var/run/pesign 0770 pesign pesign -
++D /run/pesign 0770 pesign pesign -
diff --git a/pesign.changes b/pesign.changes
index 807080b..0427f94 100644
--- a/pesign.changes
+++ b/pesign.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Apr 16 07:12:05 UTC 2014 - aj@suse.com
+
+- Add pesign-run.patch: Use /run instead of /var/run (bnc#873857).
+
 -------------------------------------------------------------------
 Fri Jan 31 08:49:12 UTC 2014 - lnussel@suse.de
 
diff --git a/pesign.spec b/pesign.spec
index f4509bb..d8368d4 100644
--- a/pesign.spec
+++ b/pesign.spec
@@ -36,6 +36,8 @@ Patch4:         pesign-clear-padding-bits.patch
 Patch6:         use-standard-pid-location.patch
 # PATCH-FIX-UPSTREAM pesign-no-db.patch glin@suse.com -- Allow some commands to proceed without a NSS database
 Patch7:         pesign-no-db.patch
+# PATCH-FIX-SUSE pesign-run.patch aj@suse.com - Use /run instead of /var/run
+Patch8:         pesign-run.patch
 BuildRequires:  mozilla-nss-devel
 BuildRequires:  pkg-config
 BuildRequires:  popt-devel
@@ -62,6 +64,7 @@ Authors:
 %patch4 -p1
 %patch6 -p1
 %patch7 -p1
+%patch8 -p1
 
 %build
 make OPTFLAGS="$RPM_OPT_FLAGS"
@@ -107,7 +110,7 @@ systemd-tmpfiles --create /usr/lib/tmpfiles.d/pesign.conf
 %{_unitdir}/pesign.service
 /usr/lib/tmpfiles.d/pesign.conf
 %dir %attr(0775,pesign,pesign) %{_sysconfdir}/pki/pesign
-%ghost %dir %attr(0770,pesign,pesign) %{_localstatedir}/run/%{name}
+%ghost %dir %attr(0770,pesign,pesign) /run/%{name}
 %dir %attr(0770,pesign,pesign) %{_localstatedir}/lib/%{name}
 
 %changelog