diff --git a/unbound.spec b/unbound.spec
index 8d9e8d9..360ad8a 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -31,7 +31,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.24.2
-Release: 2%{?extra_version:.%{extra_version}}%{?dist}
+Release: 3%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
 Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@@ -321,6 +321,8 @@ install -p -m 0644 %{SOURCE27} %{buildroot}%{_tmpfilesdir}/unbound-libs.conf
 # install root - we keep a copy of the root key in old location,
 # in case user has changed the configuration and we wouldn't update it there
 install -p -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/unbound/
+# Creates duplicate copy of the same file to improve backward compatibility
+install -p -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/unbound/dnssec-root.key
 install -p -m 0644 %{SOURCE13} %{buildroot}%{_sharedstatedir}/unbound/root.key
 
 # local root zone fetch to separated configuration file
@@ -499,6 +501,7 @@ popd
 %{_unitdir}/unbound-anchor.service
 %dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name}
 %attr(0644,unbound,unbound) %verify(not md5 mtime size) %config %{_sharedstatedir}/%{name}/root.key
+%attr(0644,root,root) %config %{_sysconfdir}/%{name}/dnssec-root.key
 # just left for backwards compat with user changed unbound.conf files - format is different!
 %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
 
@@ -506,6 +509,9 @@ popd
 %{_prefix}/lib/dracut/modules.d/99unbound
 
 %changelog
+* Wed Feb 25 2026 Petr Menšík <pemensik@redhat.com> - 1.24.2-3
+- Install correct trust anchor source in Image Mode (RHEL-127540)
+
 * Mon Feb 09 2026 Petr Menšík <pemensik@redhat.com> - 1.24.2-2
 - Switch TLS configuration to follow TLS sockets by crypto-policy again
   (RHEL-147860)