diff --git a/registries.conf b/registries.conf
index 4f20fba..910f856 100644
--- a/registries.conf
+++ b/registries.conf
@@ -111,3 +111,5 @@ unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.
 # # 2. example-mirror-1.local/mirrors/foo/image:latest
 # # 3. internal-registry-for-example.net/bar/myimage:latest
 # # in order, and use the first one that exists.
+# Enforcing mode for short names is default for RHEL9.
+short-name-mode = "enforcing"
diff --git a/skopeo.spec b/skopeo.spec
index 8c08f9a..94b4585 100644
--- a/skopeo.spec
+++ b/skopeo.spec
@@ -29,7 +29,7 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
 Epoch: 1
 Name: skopeo
 Version: 1.2.1
-Release: 11%{?dist}
+Release: 12%{?dist}
 Summary: Inspect container images and repositories on registries
 License: ASL 2.0
 URL: %{git0}
@@ -237,6 +237,9 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
 %{_datadir}/%{name}/test
 
 %changelog
+* Thu Feb 18 2021 Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-12
+- configure short-name-mode = "enforcing" for RHEL9
+
 * Thu Feb 18 2021 Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-11
 - disable LTO
 
diff --git a/update.sh b/update.sh
index b76ead4..c64ec9f 100755
--- a/update.sh
+++ b/update.sh
@@ -12,3 +12,10 @@ then
   sed -i '/^default_capabilities/a \
     "NET_RAW",' containers.conf
 fi
+if ! grep ^short-name-mode.*= registries.conf
+then
+  echo "# Enforcing mode for short names is default for RHEL9." >> registries.conf
+  echo 'short-name-mode = "enforcing"' >> registries.conf
+else
+  sed -i 's/^short-name-mode.*=.*/short-name-mode = "enforcing"/'
+fi