diff --git a/grub.macros b/grub.macros
index d1ac1dc..ff58cec 100644
--- a/grub.macros
+++ b/grub.macros
@@ -592,7 +592,7 @@ ln -s ../boot/%{name}/grub.cfg					\\\
 %{expand:%%files %{1}}						\
 %defattr(-,root,root,-)						\
 %config(noreplace) %{_sysconfdir}/%{name}.cfg			\
-%ghost %config(noreplace) /boot/%{name}/grub.cfg		\
+%ghost %config(noreplace) %attr(0700,root,root)/boot/%{name}/grub.cfg	\
 %dir %attr(0700,root,root)/boot/loader/entries			\
 %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/%{name}-%{1}.conf \
 								\
@@ -620,7 +620,7 @@ ln -s ../boot/%{name}/grub.cfg					\\\
 %endif								\
 %attr(0700,root,root)/boot/%{name}/fonts			\
 %dir %attr(0700,root,root)/boot/loader/entries			\
-%ghost %config(noreplace) /boot/%{name}/grub.cfg		\
+%ghost %config(noreplace) %attr(0700,root,root)/boot/%{name}/grub.cfg	\
 %ghost %config(noreplace) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg	\
 %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv	\
 %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/%{name}-%{1}.conf \
diff --git a/grub2.spec b/grub2.spec
index 906296e..704efdc 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	35%{?dist}
+Release:	36%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -529,6 +529,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Mon Apr 18 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-36
+- Fix permission change report from rpm verification on grub.cfg
+
 * Wed Apr 13 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-35
 - Enable "read" module
 - Resolves: #2071644