diff --git a/.gitignore b/.gitignore
index 1fb490b..7e1c8e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,4 @@
 /osbuild-20.tar.gz
 /osbuild-21.tar.gz
 /osbuild-22.tar.gz
+/osbuild-23.tar.gz
diff --git a/osbuild.spec b/osbuild.spec
index 2fe80a0..9b7ecf8 100644
--- a/osbuild.spec
+++ b/osbuild.spec
@@ -1,7 +1,7 @@
 %global         forgeurl https://github.com/osbuild/osbuild
 %global         selinuxtype targeted
 
-Version:        22
+Version:        23
 
 %forgemeta
 
@@ -43,6 +43,16 @@ Requires:       (%{name}-selinux if selinux-policy-%{selinuxtype})
 # by rhel runner.
 %global __requires_exclude_from ^%{pkgdir}/(assemblers|runners|stages)/.*$
 
+# Turn off shebang mangling on RHEL. brp-mangle-shebangs (from package
+# redhat-rpm-config) is run on all executables in a package after the `install`
+# section runs. The below macro turns this behavior off for:
+#   - runners, because they already have the correct shebang for the platform
+#     they're meant for, and
+#   - stages and assemblers, because they are run within osbuild build roots,
+#     which are not required to contain the same OS as the host and might thus
+#     have a different notion of "platform-python".
+%global __brp_mangle_shebangs_exclude_from ^%{pkgdir}/(assemblers|runners|stages)/.*$
+
 %{?python_enable_dependency_generator}
 
 %description
@@ -171,6 +181,10 @@ fi
 %selinux_relabel_post -s %{selinuxtype}
 
 %changelog
+* Fri Oct 23 2020 Christian Kellner <ckellner@redhat.com> - 23-1
+- Upstream release 23
+- Do not mangle shebangs for assemblers, runners & stages.
+
 * Mon Oct 12 2020 Christian Kellner <ckellner@redhat.com> - 22-1
 - Upstream release 22
 
diff --git a/sources b/sources
index 2aa174b..b6a2698 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (osbuild-22.tar.gz) = 76b2efb083b2c372251b20185f76d59336fd3ddb4dfcf9b33f825a9f93c5dd2449ae2321fcdca1d9d3b0fc9f4547e5850d11b7137e92793d766c6e9383cb2703
+SHA512 (osbuild-23.tar.gz) = a3f1489cc12c875cc1d1cef52f38a618ee395284cad4c6838e3f0022ad50bc1fd1d0bc53eb3b9ce293ffbef9096f4aa37fd4a506aa04a24017b4fe98787a0f20