diff --git a/SPECS/opencryptoki.spec b/SPECS/opencryptoki.spec
index 4bfc84d..4f6935b 100644
--- a/SPECS/opencryptoki.spec
+++ b/SPECS/opencryptoki.spec
@@ -1,7 +1,7 @@
 Name:			opencryptoki
 Summary:		Implementation of the PKCS#11 (Cryptoki) specification v3.0
 Version:		3.17.0
-Release:		7%{?dist}
+Release:		8%{?dist}
 License:		CPL
 URL:			https://github.com/opencryptoki/opencryptoki
 Source0:		https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -206,12 +206,28 @@ configured with Enterprise PKCS#11 (EP11) firmware.
 %install
 %make_install CHGRP=/bin/true
 
+%pre
+# don't touch opencryptoki.conf even if it is unchanged due to new tokversion
+# backup config file
+%global cfile /etc/opencryptoki/opencryptoki.conf
+%global csuffix .rpmsave.XyoP
+if test $1 -gt 1 && test -f %{cfile} ; then
+    cp -p %{cfile} %{cfile}%{csuffix}
+fi
 
 %pre libs
 getent group pkcs11 >/dev/null || groupadd -r pkcs11
 exit 0
 
 %post
+# restore the config file from %pre
+if test $1 -gt 1 && test -f %{cfile} ; then
+    if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then
+        cp -p %{cfile} %{cfile}.rpmnew
+    fi
+    cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix}
+fi
+
 %systemd_post pkcsslotd.service
 if test $1 -eq 1; then
 	%tmpfiles_create %{name}.conf
@@ -323,6 +339,9 @@ fi
 
 
 %changelog
+* Mon Sep 12 2022 Than Ngo <than@redhat.com> - 3.17.0-8
+- Resolves: #2127873, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
+
 * Wed Aug 03 2022 Than Ngo <than@redhat.com> - 3.17.0-7
 - Resolves: #2114913, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL