diff --git a/keylime-agent-rust.spec b/keylime-agent-rust.spec
index e4d2de7..5fce5d3 100644
--- a/keylime-agent-rust.spec
+++ b/keylime-agent-rust.spec
@@ -106,9 +106,10 @@ Summary:   Common files for Keylime agent
 License:   (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
 BuildArch: noarch
 
-# This is necessary to provide a clean upgrade path from the previous
-# keylime-agent-rust which shipped the IMA emulator
-Obsoletes: keylime-agent-rust < %{version}-%{release}
+# The old unsplit keylime-agent-rust shipped files now owned by -common
+# (agent.conf, config dirs). This conflict ensures the split packages are
+# removed on downgrade to avoid file conflicts.
+Conflicts: keylime-agent-rust < 0.2.9
 
 %description common
 Common files for the Keylime agent in both push and pull models
@@ -154,6 +155,11 @@ Requires:       keylime-agent-rust-common = %{version}-%{release}
 Requires:       keylime-base
 %endif
 
+# The old unsplit keylime-agent-rust shipped keylime_ima_emulator binary.
+# This conflict ensures the split packages are removed on downgrade to avoid
+# file conflicts.
+Conflicts: keylime-agent-rust < 0.2.9
+
 Provides:       keylime-ima-emulator = %{version}-%{release}
 
 %description ima-emulator
@@ -251,7 +257,6 @@ chown -R keylime:keylime %{_sysconfdir}/keylime
 %if 0%{?bundled_rust_deps}
 %license cargo-vendor.txt
 %endif
-%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf
 %{_unitdir}/keylime_agent.service
 %{_unitdir}/var-lib-keylime-secure.mount
 %{_bindir}/keylime_agent