diff --git a/libunbound-devel-mini.changes b/libunbound-devel-mini.changes
index 95b7b8c..7119b5b 100644
--- a/libunbound-devel-mini.changes
+++ b/libunbound-devel-mini.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Dec 29 18:12:29 UTC 2022 - Wolfgang Frisch <wolfgang.frisch@suse.com>
+
+- Tighten permissions (boo#1173619)
+- Add missing dependency: unbound-control-setup needs /usr/bin/openssl.
+
 -------------------------------------------------------------------
 Thu Oct 13 17:08:56 UTC 2022 - Michael Ströder <michael@stroeder.com>
 
diff --git a/unbound.changes b/unbound.changes
index d0faad1..bbaccb7 100644
--- a/unbound.changes
+++ b/unbound.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Dec 29 18:10:37 UTC 2022 - Wolfgang Frisch <wolfgang.frisch@suse.com>
+
+- Tighten permissions (boo#1173619)
+- Add missing dependency: unbound-control-setup needs /usr/bin/openssl.
+
 -------------------------------------------------------------------
 Thu Oct 13 17:08:56 UTC 2022 - Michael Ströder <michael@stroeder.com>
 
diff --git a/unbound.spec b/unbound.spec
index df91007..5575bb5 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -57,6 +57,8 @@ BuildRequires:  pkgconfig(libnghttp2)
 Requires:       ldns >= %{ldns_version}
 # until we figured something else out for the unbound-anchor part in the systemd unit file
 Requires:       sudo
+# unbound-control-setup depends on /usr/bin/openssl
+Requires:       openssl
 %if %{with systemd}
 BuildRequires:  pkgconfig(libsystemd)
 %{?systemd_requires}
@@ -351,11 +353,11 @@ systemd-tmpfiles --create  %{_tmpfilesdir}/unbound.conf  || :
 %attr(0755,unbound,unbound) %ghost %dir %{piddir}/%{name}
 %attr(0640,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %dir %attr(-,root,unbound)                     %{_sysconfdir}/%{name}/keys.d
-%attr(0660,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/keys.d/*.key
+%attr(0640,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/keys.d/*.key
 %dir %attr(-,root,unbound)                     %{_sysconfdir}/%{name}/conf.d
-%attr(0660,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/conf.d/*.conf
+%attr(0640,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/conf.d/*.conf
 %dir %attr(-,root,unbound)                     %{_sysconfdir}/%{name}/local.d
-%attr(0660,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/local.d/*.conf
+%attr(0640,root,unbound)    %config(noreplace) %{_sysconfdir}/%{name}/local.d/*.conf
 %{_sbindir}/unbound
 %{_sbindir}/unbound-checkconf
 %{_sbindir}/unbound-host