diff --git a/unbound-1.16-control-key-perms.patch b/unbound-1.16-control-key-perms.patch
new file mode 100644
index 0000000..de3597c
--- /dev/null
+++ b/unbound-1.16-control-key-perms.patch
@@ -0,0 +1,14 @@
+diff --git a/unbound-1.16.2/smallapp/unbound-control-setup.sh.in b/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
+index 4a358f6bd..c2a79a242 100644
+--- a/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
++++ b/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
+@@ -204,7 +204,8 @@ fi
+ # remove unused permissions
+ chmod o-rw \
+       "$SVR_BASE.pem" \
+-      "$SVR_BASE.key" \
++      "$SVR_BASE.key"
++chmod g+r,o-rw \
+       "$CTL_BASE.pem" \
+       "$CTL_BASE.key"
+ 
diff --git a/unbound.spec b/unbound.spec
index 1bab0fe..379551d 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -30,7 +30,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 19%{?extra_version:.%{extra_version}}%{?dist}
+Release: 20%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
 Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@@ -67,6 +67,8 @@ Patch4: unbound-1.16-CVE-2023-50387-CVE-2023-50868.patch
 Patch5: unbound-1.16-control-t-flag.patch
 # https://github.com/NLnetLabs/unbound/commit/b7c61d7cc256d6a174e6179622c7fa968272c259
 Patch6: unbound-1.21-CVE-2024-8508.patch
+# https://github.com/NLnetLabs/unbound/commit/b48958c983f60af40358cca168c403e57bde30d2
+Patch7: unbound-1.16-control-key-perms.patch
 
 BuildRequires: gcc, make
 BuildRequires: flex, openssl-devel
@@ -433,7 +435,7 @@ popd
 %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.pem
 %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.key
 %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.pem
-%ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.key
+%ghost %attr(0600,root,unbound) %{_sysconfdir}/%{name}/unbound_server.key
 %{_sbindir}/unbound
 %{_sbindir}/unbound-checkconf
 %{_sbindir}/unbound-control
@@ -498,6 +500,10 @@ popd
 %{_prefix}/lib/dracut/modules.d/99unbound
 
 %changelog
+* Wed Jul 16 2025 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-20
+- Fix verification of unbound-control key files
+- Resolves: RHEL-65396
+
 * Tue Jun 24 2025 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-19
 - Fix regression on update introduced by local-root symlink
 - Resolves: RHEL-92255