diff --git a/catatonit.spec b/catatonit.spec
index b5bc583..b38520e 100644
--- a/catatonit.spec
+++ b/catatonit.spec
@@ -2,7 +2,7 @@ Name: catatonit
 Version: 0.2.1
 Summary: A signal-forwarding process manager for containers
 License: GPL-3.0-or-later
-Release: 2%{?dist}
+Release: 3%{?dist}
 # Bump epoch to 5 for RHEL
 # Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2257446
 Epoch: 5
@@ -72,6 +72,10 @@ ln -s %{_libexecdir}/%{name}/%{name} %{buildroot}%{_libexecdir}/podman/%{name}
 %{_libexecdir}/podman/%{name}
 
 %changelog
+* Fri Feb 27 2026 Jindrich Novy <jnovy@redhat.com> - 5:0.2.1-3
+- skip annocheck false positives for a static binary
+- Related: RHEL-152096
+
 * Thu Feb 26 2026 Jindrich Novy <jnovy@redhat.com> - 5:0.2.1-2
 - use -static-pie on x86_64/aarch64, fall back to -static on ppc64le/s390x
   where rcrt1.o is not available
diff --git a/rpminspect.yaml b/rpminspect.yaml
index 9b91328..92eebda 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -1,3 +1,3 @@
 ---
 annocheck:
-  - hardened: --skip-lto --ignore-unknown --verbose --skip-dynamic-tags
+  - hardened: --skip-lto --ignore-unknown --verbose --skip-dynamic-tags --skip-stack-prot --skip-fortify