diff --git a/apache2-mod_nss.changes b/apache2-mod_nss.changes
index 2249809..293cdf9 100644
--- a/apache2-mod_nss.changes
+++ b/apache2-mod_nss.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Sep 29 15:26:39 UTC 2016 - jengelh@inai.de
+
+- Avoid changing permissions through symlinks
+
 -------------------------------------------------------------------
 Thu Sep 15 10:44:06 UTC 2016 - vcizek@suse.com
 
diff --git a/apache2-mod_nss.spec b/apache2-mod_nss.spec
index 72f5ec2..8fc639d 100644
--- a/apache2-mod_nss.spec
+++ b/apache2-mod_nss.spec
@@ -199,8 +199,8 @@ if [ ! -e %{apache_sysconf_nssdir}/key3.db ]; then
     echo ""
 fi
 # Make sure that the database ownership is setup properly.
-find %{apache_sysconf_nssdir} -user root -name "*.db" -exec /bin/chgrp www {} \;
-find %{apache_sysconf_nssdir} -user root -name "*.db" -exec /bin/chmod 640 {} \;
+find %{apache_sysconf_nssdir} -user root -name "*.db" -exec /bin/chgrp -h www {} +
+find %{apache_sysconf_nssdir} -user root -name "*.db" ! -type l -exec /bin/chmod 640 {} +
 
 %files
 %defattr(-,root,root,-)