diff --git a/s390-tools.changes b/s390-tools.changes
index 562e715..ca4beeb 100644
--- a/s390-tools.changes
+++ b/s390-tools.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Feb 13 13:50:55 UTC 2020 - Marcus Meissner <meissner@suse.com>
+
+- sign the stage3.bin bootloader stage (bsc#1163524)
+
 -------------------------------------------------------------------
 Sat Feb  8 02:25:58 UTC 2020 - Mark Post <mpost@suse.com>
 
diff --git a/s390-tools.spec b/s390-tools.spec
index 2060174..6b562a9 100644
--- a/s390-tools.spec
+++ b/s390-tools.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package s390-tools
 #
-# Copyright (c) 2019-2020 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2020 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -14,6 +14,7 @@
 
 # Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
+# needssslcertforbuild
 
 
 #Compat macro for new _fillupdir macro introduced in Nov 2017
@@ -153,6 +154,7 @@ BuildRequires:  libjson-c-devel
 BuildRequires:  libpfm-devel
 BuildRequires:  ncurses-devel
 BuildRequires:  net-snmp-devel
+BuildRequires:  pesign-obs-integration
 BuildRequires:  qclib-devel-static
 BuildRequires:  tcpd-devel
 BuildRequires:  zlib-devel-static
@@ -364,6 +366,8 @@ echo \$\$ >\$PIDFILE
 EOT
 chmod 755 osasnmpd
 
+export BRP_PESIGN_FILES='/lib/s390-tools/stage3.bin'
+
 %verifyscript
 %verify_permissions -e %{_localstatedir}/log/ts-shell