diff --git a/SPECS/setup.spec b/SPECS/setup.spec
index a9081ef..daa5db9 100644
--- a/SPECS/setup.spec
+++ b/SPECS/setup.spec
@@ -1,7 +1,7 @@
 Summary: A set of system configuration and setup files
 Name: setup
 Version: 2.12.2
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: Public Domain
 Group: System Environment/Base
 URL: https://pagure.io/setup/
@@ -70,6 +70,13 @@ rm -f %{buildroot}/etc/shadowconvert.sh
 rm -f %{buildroot}/etc/setup.spec
 rm -rf %{buildroot}/etc/contrib
 
+# make setup a protected package
+install -p -d -m 755 %{buildroot}/etc/dnf/protected.d/
+touch %{name}.conf
+echo setup > %{name}.conf
+install -p -c -m 0644 %{name}.conf %{buildroot}/etc/dnf/protected.d/
+rm -f %{name}.conf
+
 #throw away useless and dangerous update stuff until rpm will be able to
 #handle it ( http://rpm.org/ticket/6 )
 %post -p <lua>
@@ -113,8 +120,12 @@ end
 %config(noreplace) %verify(not md5 size mtime) /etc/shells
 %ghost %attr(0644,root,root) %verify(not md5 size mtime) /var/log/lastlog
 %ghost %verify(not md5 size mtime) %config(noreplace,missingok) /etc/fstab
+/etc/dnf/protected.d/%{name}.conf
 
 %changelog
+* Wed Apr 15 2020 Pavel Zhukov <pzhukov@redhat.com> - 2.12.2-6
+- make setup protected package (#1755997)
+
 * Wed Oct 30 2019 Martin Osvald <mosvald@redhat.com> - 2.12.2-5
 - rebuilt to fix version