diff --git a/SOURCES/tang.tmpfiles b/SOURCES/tang.tmpfiles
new file mode 100644
index 0000000..9bba134
--- /dev/null
+++ b/SOURCES/tang.tmpfiles
@@ -0,0 +1,2 @@
+d /var/db/tang 0700 tang tang -
+Z /var/db/tang 0700 tang tang -
diff --git a/SPECS/tang.spec b/SPECS/tang.spec
index 99bbd22..77ebcdd 100644
--- a/SPECS/tang.spec
+++ b/SPECS/tang.spec
@@ -1,12 +1,13 @@
 Name:           tang
 Version:        14
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Network Presence Binding Daemon
 
 License:        GPLv3+
 URL:            https://github.com/latchset/%{name}
 Source0:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
 Source1:        tang.sysusers
+Source2:        tang.tmpfiles
 
 BuildRequires:  gcc
 BuildRequires:  meson
@@ -52,6 +53,7 @@ Tang is a small daemon for binding data to the presence of a third party.
 %install
 %meson_install
 install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/tang.conf
+install -p -D -m 0644 %{SOURCE2} %{buildroot}%{_tmpfilesdir}/tang.conf
 grep "User=%{name}" $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service || echo "User=%{name}" >> $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service
 %{__mkdir_p} $RPM_BUILD_ROOT/%{_localstatedir}/db/%{name}
 
@@ -98,8 +100,13 @@ fi
 %{_mandir}/man1/tang-show-keys.1*
 %{_mandir}/man1/tangd-rotate-keys.1.*
 %{_sysusersdir}/tang.conf
+%{_tmpfilesdir}/tang.conf
 
 %changelog
+* Mon Aug 04 2025 Sergio Correia <scorreia@redhat.com> - 14.3
+- Fix image mode deployment of directory keys
+  Resolves: RHEL-105012
+
 * Thu Jun 29 2023 Sergio Arroutbi <sarroutb@redhat.com> - 14-2
 - Fix service start up