diff --git a/ca-certificates-mozilla-prebuilt.changes b/ca-certificates-mozilla-prebuilt.changes
index 84ca3c8..0dc2807 100644
--- a/ca-certificates-mozilla-prebuilt.changes
+++ b/ca-certificates-mozilla-prebuilt.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Aug 30 10:23:35 UTC 2022 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Create /var/lib/ca-certificates during build to ensure rpm gives
+  the %ghost'ed directory proper mode attributes.
+
 -------------------------------------------------------------------
 Mon Oct  4 14:38:44 UTC 2021 - Ludwig Nussel <lnussel@suse.de>
 
diff --git a/ca-certificates-mozilla-prebuilt.spec b/ca-certificates-mozilla-prebuilt.spec
index d0755f8..057832e 100644
--- a/ca-certificates-mozilla-prebuilt.spec
+++ b/ca-certificates-mozilla-prebuilt.spec
@@ -53,6 +53,7 @@ cp /usr/share/licenses/ca-certificates-mozilla/COPYING .
 
 %install
 mkdir -p %{buildroot}/etc/ssl
+mkdir -p %{buildroot}/var/lib/ca-certificates
 ln -s /var/lib/ca-certificates/pem %{buildroot}/etc/ssl/certs
 ln -s /var/lib/ca-certificates/ca-bundle.pem %{buildroot}/etc/ssl/ca-bundle.pem
 mkdir -p %{buildroot}/usr/share/factory/var/lib