diff --git a/SOURCES/sbat.csv.in b/SOURCES/sbat.csv.in
index 55b3d10..7027ef8 100755
--- a/SOURCES/sbat.csv.in
+++ b/SOURCES/sbat.csv.in
@@ -1,3 +1,4 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
 grub,2,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
-grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.rh,2,Red Hat,grub2,@@RHEL_VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.almalinux,2,AlmaLinux,grub2,@@VERSION_RELEASE@@,mail:security@almalinux.org
diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec
index 9d0893b..4bd0aaf 100644
--- a/SPECS/grub2.spec
+++ b/SPECS/grub2.spec
@@ -1,3 +1,7 @@
+%global efi_vendor almalinux
+%global efidir almalinux
+%global efi_esp_dir /boot/efi/EFI/%{efidir}
+
 # This package calls binutils components directly and would need to pass
 # in flags to enable the LTO plugins
 # Disable LTO
@@ -14,7 +18,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	27%{?dist}.7
+Release:	27%{?dist}.7.alma
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -40,19 +44,7 @@ Source12:	sbat.csv.in
 %define sb_cer		%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
 %endif
 
-%if 0%{?centos}
-%ifarch x86_64 aarch64 ppc64le
-%define sb_key		centossecureboot202
-%endif
-%else
-%ifarch x86_64 aarch64
-%define sb_key		redhatsecureboot502
-%endif
-%ifarch ppc64le
-%define sb_key		redhatsecureboot602
-%endif
-%endif
-
+%define sb_key		clsecureboot001
 
 BuildRequires:	gcc efi-srpm-macros
 BuildRequires:	flex bison binutils python3
@@ -93,6 +85,9 @@ variety of kernel formats, file systems, computer architectures and \
 hardware devices.\
 %{nil}
 
+# AlmaLinux: keep upstream EVR for RHEL SBAT entry
+%define rhel_evr $(echo %{evr} | sed 's/\.alma.*//')
+
 # generate with do-rebase
 %include %{SOURCE11}
 
@@ -185,7 +180,7 @@ This subpackage provides the GRUB user-space emulation modules.
 mkdir grub-%{grubefiarch}-%{tarversion}
 grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubefiarch}-%{tarversion}/.gitignore
 cp %{SOURCE4} grub-%{grubefiarch}-%{tarversion}/unifont.pcf.gz
-sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
+sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" -e "s,@@RHEL_VERSION_RELEASE@@,%{rhel_evr},g" \
     %{SOURCE12} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
 git add grub-%{grubefiarch}-%{tarversion}
 %endif
@@ -530,6 +525,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Fri Jun 17 2022 Eduard Abdullin <eabdullin@almalinux.org> - 2.06-27.el9_0.7.alma
+- Debrand for AlmaLinux
+
 * Fri Jun 03 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-27.el9_0.7
 - CVE fixes for 2022-06-07
 - CVE-2022-28736 CVE-2022-28735 CVE-2022-28734 CVE-2022-28733