diff --git a/keylime.spec b/keylime.spec
index 3feaab1..b27cceb 100644
--- a/keylime.spec
+++ b/keylime.spec
@@ -208,14 +208,19 @@ for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
     install -Dpm 400 config/${comp}.conf %{buildroot}/%{_sysconfdir}/%{srcname}
 done
 
-# Ship some scripts.
-mkdir -p %{buildroot}/%{_datadir}/%{srcname}/scripts
-for s in create_mb_refstate \
-         ek-openssl-verify; do
-    install -Dpm 755 scripts/${s} \
-        %{buildroot}/%{_datadir}/%{srcname}/scripts/${s}
+# Do not ship a few scripts that are to be obsoleted soon.
+# The functionality they provide is now provided by keylime-policy.
+for s in keylime_convert_runtime_policy \
+         keylime_create_policy \
+         keylime_sign_runtime_policy; do
+    rm -f %{buildroot}/%{_bindir}/"${s}"
 done
 
+# Ship the ek-openssl-verify script.
+mkdir -p %{buildroot}/%{_datadir}/%{srcname}/scripts
+install -Dpm 755 scripts/ek-openssl-verify \
+        %{buildroot}/%{_datadir}/%{srcname}/scripts/ek-openssl-verify
+
 # Ship configuration templates.
 cp -r ./templates %{buildroot}%{_datadir}/%{srcname}/templates/
 
@@ -359,11 +364,7 @@ fi
 %license LICENSE
 %{python3_sitelib}/%{srcname}-*.egg-info/
 %{python3_sitelib}/%{srcname}
-%{_datadir}/%{srcname}/scripts/create_mb_refstate
 %{_bindir}/keylime_attest
-%{_bindir}/keylime_convert_runtime_policy
-%{_bindir}/keylime_create_policy
-%{_bindir}/keylime_sign_runtime_policy
 %{_bindir}/keylime-policy