diff --git a/buildflags.md b/buildflags.md
index 70e7b5e..6252cb6 100644
--- a/buildflags.md
+++ b/buildflags.md
@@ -117,15 +117,17 @@ or:
 ### Controlling Type Safety
 
 The macro `%build_type_safety_c` can be set to change the C type
-safety level.  By default (value 0), all C constructs that GCC accepts
-for backwards compatibility with obsolete language standards are
-accepted during package builds.  Packages can set
-`%build_type_safety_c` to higher values to adopt future
-distribution-wide type-safety increases early.
+safety level.  The default level is 1, see below.  It can be set to 0
+to get historic levels of type safety.  Changing the type safety level
+may depend on correct `CFLAGS` propagation during the build.  The
+`%build_type_safety_c` macro needs to be set before `CFLAGS`-related
+macros are expanded by RPM (that is, earlier in the file works
+better).
 
-When changing the `%build_type_safety_c` level to increase it, spec
-file should use a construct like this to avoid *lowering* a future
-default:
+Packages can set `%build_type_safety_c` to higher values to adopt
+future distribution-wide type-safety increases early.  When changing
+the `%build_type_safety_c` level to increase it, spec file should use
+a construct like this to avoid *lowering* a future default:
 
 ```
 %if %build_type_safety_c < 2
@@ -133,6 +135,10 @@ default:
 %endif
 ```
 
+At level 0, all C constructs that GCC accepts for backwards
+compatibility with obsolete language standards are accepted during
+package builds.
+
 At level 1, the following additional error categories are enabled:
 
 * `-Werror=implicit-int`: Reject declarations and definitions that
diff --git a/macros b/macros
index 866d76c..46ff156 100644
--- a/macros
+++ b/macros
@@ -393,7 +393,7 @@ for k,_ in pairs(stripped_flags) do print(k .. " ") end
 
 # This can be set to a positive integer to obtain increasing type
 # safety levels for C.  See buildflags.md.
-%build_type_safety_c 0
+%build_type_safety_c 1
 
 # Some linkers default to a build-id algorithm that is not supported by rpmbuild,
 # so we need to specify the right algorithm to use.
diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index ef8d51f..e8eba52 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -4,7 +4,7 @@
 # 2) When making changes, increment the version (in baserelease) by 1.
 #    rpmdev-bumpspec and other tools update the macro below, which is used
 #    in Version: to get the desired effect.
-%global baserelease 266
+%global baserelease 267
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
@@ -254,6 +254,9 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
 %doc buildflags.md
 
 %changelog
+* Tue Sep 26 2023 Florian Weimer <fweimer@redhat.com> - 267-1
+- Switch %%build_type_safety_c to 1 (#2142177)
+
 * Thu Sep 07 2023 Maxwell G <maxwell@gtmx.me> - 266-1
 - Split out forge macros to forge-srpm-macros package