diff --git a/sssd.changes b/sssd.changes
index d4077e6..29ced7e 100644
--- a/sssd.changes
+++ b/sssd.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Jun 12 14:18:30 UTC 2014 - ckornacker@suse.com
+
+- fix %postun to not erroneously remove sss pam module
+
 -------------------------------------------------------------------
 Tue May 27 16:56:42 UTC 2014 - crrodriguez@opensuse.org
 
diff --git a/sssd.spec b/sssd.spec
index 5d1fa88..250c0c3 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -29,6 +29,7 @@ Source:         https://fedorahosted.org/released/sssd/sssd-%version.tar.gz
 Source2:        https://fedorahosted.org/released/sssd/sssd-%version.tar.gz.asc
 Source3:        baselibs.conf
 Source4:        sssd.service
+Source5:        %name.keyring
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 Patch1:         0001-build-detect-endianness-at-configure-time.patch
 Patch2:         0001-BUILD-Link-libsss_ldap_common.so-to-libsss_idmap.so.patch
@@ -371,13 +372,13 @@ rm -Rf "$b/usr/share/locale"/{fa_IR,ja_JP,lt_LT,ta_IN,vi_VN}
 %endif
 
 %postun
+if [ "$1" == "0" ]; then
+	"%_sbindir/pam-config" -d --sss || :;
+fi;
 /sbin/ldconfig
 %if 0%{?_unitdir:1}
 %service_del_postun sssd.service
 %endif
-if [ "$1" == "0" ]; then
-	"%_sbindir/pam-config" -d --sss || :;
-fi;
 
 %post   -n libipa_hbac0 -p /sbin/ldconfig
 %postun -n libipa_hbac0 -p /sbin/ldconfig