diff --git a/grub.macros b/grub.macros
index ae0d1e0..5038650 100644
--- a/grub.macros
+++ b/grub.macros
@@ -38,7 +38,7 @@
 		%{nil}
 
 %global host_cflags_ %{expand:%%(echo %{build_cflags} %{?_hardening_cflags} | %{cflags_sed})} -fstack-protector-strong
-%ifarch x86_64
+%ifarch %{x86_64}
 %global host_cflags %{host_cflags_} -fcf-protection
 %else
 %global host_cflags %{host_cflags_}
@@ -111,7 +111,7 @@
 
 
 %global efi_only aarch64 %{arm} riscv64
-%global efi_arch x86_64 ia64 %{efi_only}
+%global efi_arch %{x86_64} ia64 %{efi_only}
 %ifarch %{efi_arch}
 %global with_efi_arch 1
 %else
@@ -131,7 +131,7 @@
 %global efi_modules " efi_netfs efifwsetup efinet lsefi lsefimmap connectefi "
 %endif
 
-%ifarch x86_64 %{ix86}
+%ifarch %{x86_64} %{ix86}
 %global platform_modules " backtrace chain tpm usb usbserial_common usbserial_pl2303 usbserial_ftdi usbserial_usbdebug keylayouts at_keyboard "
 %endif
 
@@ -158,7 +158,7 @@
 %global platform pc
 %endif
 
-%ifarch x86_64
+%ifarch %{x86_64}
 %global efiarch x64
 %global target_cpu_name %{_arch}
 %global grub_target_name %{_arch}-efi
@@ -245,7 +245,7 @@
 
 %global evr %{epoch}:%{version}-%{release}
 
-%ifarch x86_64
+%ifarch %{x86_64}
 %global with_efi_common 1
 %global with_legacy_modules 1
 %global with_legacy_common 1
diff --git a/grub2.spec b/grub2.spec
index eb868b9..097e9f9 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	14%{?dist}
+Release:	14%{?dist}.alma.1
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -38,25 +38,13 @@ Source12:	sbat.csv.in
 
 %include %{SOURCE1}
 
-%ifarch x86_64 aarch64 ppc64le
+%ifarch %{x86_64} aarch64 ppc64le
 %define sb_ca		%{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
 %define sb_cer		%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
 %endif
 
-%if 0%{?centos}
+%define sb_key         almalinuxsecurebootca0
 
-%ifarch x86_64 aarch64 ppc64le
-%define sb_key		centossecureboot202
-%endif
-%else
-%ifarch x86_64 aarch64
-%define sb_key		redhatsecureboot502
-%endif
-%ifarch ppc64le
-%define sb_key		redhatsecureboot702
-%endif
-
-%endif
 BuildRequires:	autoconf
 BuildRequires:	automake
 BuildRequires:	binutils
@@ -108,6 +96,9 @@ variety of kernel formats, file systems, computer architectures and \
 hardware devices.\
 %{nil}
 
+# AlmaLinux: keep upstream EVR for RHEL SBAT entry
+%define rhel_version_release $(echo %{version}-%{release} | sed 's/\.alma.*//')
+
 # generate with do-rebase
 %include %{SOURCE11}
 
@@ -139,7 +130,7 @@ Requires(pre):	sed
 %{desc}
 This subpackage provides tools for support of all platforms.
 
-%ifarch x86_64
+%ifarch %{x86_64}
 %package tools-efi
 Summary:	Support tools for GRUB.
 Requires:	gettext-runtime os-prober file
@@ -204,7 +195,7 @@ This subpackage provides the GRUB user-space emulation modules.
 mkdir grub-%{grubefiarch}-%{tarversion}
 grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubefiarch}-%{tarversion}/.gitignore
 cp %{SOURCE4} grub-%{grubefiarch}-%{tarversion}/unifont.pcf.gz
-sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
+sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" -e "s,@@RHEL_VERSION_RELEASE@@,%{rhel_version_release},g" \
     %{SOURCE12} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
 git add grub-%{grubefiarch}-%{tarversion}
 %endif
@@ -273,7 +264,7 @@ rm -fr $RPM_BUILD_ROOT
 rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 ln -s grub2-set-password ${RPM_BUILD_ROOT}/%{_sbindir}/grub2-setpassword
 echo '.so man8/grub2-set-password.8' > ${RPM_BUILD_ROOT}/%{_datadir}/man/man8/grub2-setpassword.8
-%ifnarch x86_64
+%ifnarch %{x86_64}
 rm -vf ${RPM_BUILD_ROOT}/%{_bindir}/grub2-render-label
 rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/grub2-bios-setup
 rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/grub2-macbless
@@ -451,7 +442,7 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %{_datadir}/man/man1/grub2-editenv*
 %{_datadir}/man/man1/grub2-mkpasswd-*
 
-%ifarch x86_64
+%ifarch %{x86_64}
 %files tools-efi
 %{_bindir}/grub2-glue-efi
 %{_bindir}/grub2-render-label
@@ -512,7 +503,7 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 
 %if %{with_legacy_arch}
 %{_sbindir}/grub2-install
-%ifarch x86_64
+%ifarch %{x86_64}
 %{_sbindir}/grub2-bios-setup
 %else
 %exclude %{_sbindir}/grub2-bios-setup
@@ -583,6 +574,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Wed May 14 2025 Eduard Abdullin <eabdullin@almalinux.org> - 1:2.12-14.alma.1
+- Debrand for AlmaLinux
+
 * Tue Mar 25 2025 Nicolas Frayer <nfrayer@redhat.com> 2.12-14
 - ieee1275/ofnet: Fix grub_malloc() removed after added safe
 - Related: #RHEL-80073
diff --git a/sbat.csv.in b/sbat.csv.in
index b338b5f..63e255f 100755
--- a/sbat.csv.in
+++ b/sbat.csv.in
@@ -1,3 +1,4 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
 grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
-grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.rh,2,Red Hat,grub2,@@RHEL_VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.almalinux,2,AlmaLinux,grub2,@@VERSION_RELEASE@@,mailto:security@almalinux.org