diff --git a/config.yaml b/config.yaml
index ed94912..de4b636 100644
--- a/config.yaml
+++ b/config.yaml
@@ -48,24 +48,31 @@ actions:
               %define secureboot_key_0 %{SOURCE12}
               %define pesign_name_0 centossecureboot201
               %else
-        replace: |
-              Source10: almalinuxsecurebootca0.cer
-              Source11: almalinuxsecurebootca0.cer
-        count: 1
-      - target: "spec"
-        find: |
+
               %ifarch x86_64 aarch64
               %define secureboot_ca_0 %{SOURCE10}
               %define secureboot_key_0 %{SOURCE13}
               %define pesign_name_0 redhatsecureboot501
               %endif
-        replace: |
-              %define secureboot_ca_0 %{SOURCE10}
-              %define secureboot_ca_1 %{SOURCE11}
-              %define secureboot_ca_2 %{SOURCE11}
 
-              %define secureboot_key_0 %{SOURCE10}
-              %define pesign_name_0 almalinuxsecurebootca0
+              %ifarch s390x
+              %define secureboot_ca_0 %{SOURCE10}
+              %define secureboot_key_0 %{SOURCE14}
+              %define pesign_name_0 redhatsecureboot302
+              %endif
+
+              %ifarch ppc64le
+              %define secureboot_ca_0 %{SOURCE16}
+              %define secureboot_key_0 %{SOURCE15}
+              %define pesign_name_0 redhatsecureboot701
+              %endif
+              %endif
+        replace: |
+              Source10: almalinuxsecurebootca0.cer
+              Source11: almalinuxsecureboot0.cer
+              %define secureboot_ca_0  %{SOURCE10}
+              %define secureboot_key_0 %{SOURCE11}
+              %define pesign_name_0 almalinuxsecureboot0
         count: 1
       - target: "spec"
         find: |
@@ -164,19 +171,6 @@ actions:
   - delete_line:
       - target: "spec"
         lines:
-          - |
-             %ifarch s390x
-             %define secureboot_ca_0 %{SOURCE10}
-             %define secureboot_key_0 %{SOURCE14}
-             %define pesign_name_0 redhatsecureboot302
-             %endif
-          - |
-             %ifarch ppc64le
-             %define secureboot_ca_0 %{SOURCE16}
-             %define secureboot_key_0 %{SOURCE15}
-             %define pesign_name_0 redhatsecureboot701
-             %endif
-             %endif
           - |
             if [ "$KernelExtension" == "gz" ]; then
                   gzip -f9 $SignImage
diff --git a/files/almalinuxsecureboot0.cer b/files/almalinuxsecureboot0.cer
new file mode 100644
index 0000000..e6bb9db
Binary files /dev/null and b/files/almalinuxsecureboot0.cer differ