diff --git a/unbound.spec b/unbound.spec
index 3365001..ab3321b 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -30,7 +30,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 22%{?extra_version:.%{extra_version}}%{?dist}
+Release: 23%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
 Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@@ -504,7 +504,7 @@ popd
 %{_unitdir}/unbound-anchor.timer
 %{_unitdir}/unbound-anchor.service
 %dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name}
-%attr(0644,unbound,unbound) %config %{_sharedstatedir}/%{name}/root.key
+%attr(0644,unbound,unbound) %verify(not md5 mtime size) %config %{_sharedstatedir}/%{name}/root.key
 # just left for backwards compat with user changed unbound.conf files - format is different!
 %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
 
@@ -512,6 +512,9 @@ popd
 %{_prefix}/lib/dracut/modules.d/99unbound
 
 %changelog
+* Tue Nov 11 2025 Petr Menšík <pemensik@redhat.com> - 1.16.2-23
+- Do not verify root.key in libs (RHEL-64339)
+
 * Tue Nov 11 2025 Petr Menšík <pemensik@redhat.com> - 1.16.2-22
 - Create root key if missing automatically (RHEL-127540)