diff --git a/rpm.spec b/rpm.spec
index 4c4e903..1862264 100644
--- a/rpm.spec
+++ b/rpm.spec
@@ -197,7 +197,7 @@ Requires(meta): %{name} = %{version}-%{release}
 # >= 1.4.0 required for pgpVerifySignature2() and pgpPrtParams2()
 Requires: rpm-sequoia%{_isa} >= 1.9.0
 # Most systems should have a central package operations log
-Recommends: rpm-plugin-audit
+Requires(meta): (rpm-plugin-audit if audit)
 Requires(meta): (rpm-plugin-syslog if syslog)
 %endif
 
@@ -674,6 +674,7 @@ fi
 - Add support for database parking (RHEL-126405)
 - Make syslog plugin actually useful and also required (RHEL-155272)
 - Fix buffer overruns with long language strings (RHEL-169755)
+- Require rpm-plugin-audit instead of just recommending (RHEL-139071)
 
 * Thu Feb 05 2026 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-23
 - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112394)