diff --git a/setup.spec b/setup.spec
index a06dac7..14a731c 100644
--- a/setup.spec
+++ b/setup.spec
@@ -1,7 +1,7 @@
 Summary: A set of system configuration and setup files
 Name: setup
 Version: 2.13.7
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: Public Domain
 Group: System Environment/Base
 URL: https://pagure.io/setup/
@@ -68,6 +68,13 @@ rm -f %{buildroot}/etc/shadowconvert.sh
 rm -f %{buildroot}/etc/setup.spec
 rm -rf %{buildroot}/etc/contrib
 
+# make setup a protected package
+install -p -d -m 755 %{buildroot}/etc/dnf/protected.d/
+touch %{name}.conf
+echo setup > %{name}.conf
+install -p -c -m 0644 %{name}.conf %{buildroot}/etc/dnf/protected.d/
+rm -f %{name}.conf
+
 #throw away useless and dangerous update stuff until rpm will be able to
 #handle it ( http://rpm.org/ticket/6 )
 %post -p <lua>
@@ -116,8 +123,12 @@ end
 %config(noreplace) %verify(not md5 size mtime) /etc/shells
 %ghost %verify(not md5 size mtime) %config(noreplace,missingok) /etc/fstab
 %{_tmpfilesdir}/%{name}.conf
+/etc/dnf/protected.d/%{name}.conf
 
 %changelog
+* Wed Dec 21 2022 Martin Osvald <mosvald@redhat.com> - 2.13.7-9
+- make setup protected package (#2155529)
+
 * Thu Nov 24 2022 Martin Osvald <mosvald@redhat.com> - 2.13.7-8
 - Set default umask for non-login shell only if it is set to 0 (#2062601)