diff --git a/gnutls.changes b/gnutls.changes
index af2c694..424fa54 100644
--- a/gnutls.changes
+++ b/gnutls.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Oct 12 11:54:00 UTC 2020 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Escape rpm command %%expand when used in comment.
+
 -------------------------------------------------------------------
 Tue Sep  8 08:18:48 UTC 2020 - Vítězslav Čížek <vcizek@suse.com>
 
diff --git a/gnutls.spec b/gnutls.spec
index 1f9bdbc..f9a206a 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -203,7 +203,7 @@ make %{?_smp_mflags}
 # invalidates a HMAC that may have been created earlier.
 # solution: create the hashes _after_ the macro runs.
 #
-# this shows up earlier because otherwise the %expand of
+# this shows up earlier because otherwise the %%expand of
 # the macro is too late.
 # remark: This is the same as running
 #   openssl dgst -sha256 -hmac 'orboDeJITITejsirpADONivirpUkvarP'