diff --git a/passt.spec b/passt.spec
index 4f4dfca..d718461 100644
--- a/passt.spec
+++ b/passt.spec
@@ -12,7 +12,7 @@
 
 Name:		passt
 Version:	0^20230818.g0af928e
-Release:	2%{?dist}
+Release:	3%{?dist}
 Summary:	User-mode networking daemons for virtual machines and namespaces
 License:	GPLv2+ and BSD
 Group:		System Environment/Daemons
@@ -91,6 +91,16 @@ fi
 
 %posttrans selinux
 %selinux_relabel_post -s %{selinuxtype}
+# pasta is a hard link to passt, and, depending on the order of archiving,
+# rpm(8) might or might not associate (lsetfilecon) the same context to both
+# entries, see rpmPackageFilesInstall() in lib/fsm.c. If there's no difference
+# in file contexts compared to a previous installed version,
+# %selinux_relabel_post won't touch the labels, so we need to ensure that the
+# right labels are applied to hard links, here.
+restorecon %{_bindir}/passt %{_bindir}/pasta || :
+%ifarch x86_64
+restorecon %{_bindir}/passt.avx2 %{_bindir}/pasta.avx2 || :
+%endif
 
 %files
 %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt}
@@ -116,6 +126,10 @@ fi
 %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp
 
 %changelog
+* Tue Aug 22 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-3
+- Explicit restorecon in scriptlet as rpm(8) mix up contexts with hard links
+- Resolves: RHELPLAN-155811
+
 * Mon Aug 21 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-2
 - Drop user_namespace create allow rule, incompatible with current el9 kernel
 - Resolves: RHELPLAN-155811