diff --git a/SOURCES/dnssec-trigger-rh1254473.patch b/SOURCES/dnssec-trigger-rh1254473.patch
new file mode 100644
index 0000000..6edeebc
--- /dev/null
+++ b/SOURCES/dnssec-trigger-rh1254473.patch
@@ -0,0 +1,19 @@
+diff --git a/panel/attach.c b/panel/attach.c
+index 8f12403..ba491b2 100644
+--- a/panel/attach.c
++++ b/panel/attach.c
+@@ -501,9 +501,11 @@ void fetch_proberesults(char* buf, size_t len, const char* lf)
+ 		"results is used, but no queries are made.%s", lf, lf);
+ 			else if(strstr(p->str, "forced_insecure"))
+ 				n=snprintf(pos, left, 
+-		"DNS queries are sent to INSECURE servers, because of%s"
+-		"Hotspot Signon. Select Reprobe (from menu) after signon.%s"
+-		"Please, be careful out there.%s", lf, lf, lf);
++		"DNS queries are being sent to INSECURE servers%s"
++		"because Hotspot Sign-on mode was selected. Select%s"
++		"Reprobe (from menu) after sign-on. A red exclamation%s"
++		"mark in the icon warns you when DNSSEC is disabled.%s",
++				lf, lf, lf, lf);
+ 			else if(strstr(p->str, "http_insecure") &&
+ 				strstr(p->str, "insecure_mode")==NULL)
+ 				n=snprintf(pos, left, 
diff --git a/SPECS/dnssec-trigger.spec b/SPECS/dnssec-trigger.spec
index b567eaf..569594d 100644
--- a/SPECS/dnssec-trigger.spec
+++ b/SPECS/dnssec-trigger.spec
@@ -1,7 +1,9 @@
+%global _hardened_build 1
+
 Summary: NetworkManager plugin to update/reconfigure DNSSEC resolving
 Name: dnssec-trigger
 Version: 0.11
-Release: 21%{?dist}
+Release: 22%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/downloads/dnssec-trigger/
 Source: http://www.nlnetlabs.nl/downloads/dnssec-trigger/%{name}-%{version}.tar.gz
@@ -21,6 +23,7 @@ Patch2: dnssec-trigger-842455.patch
 # https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=489
 Patch3: dnssec-trigger-0.11-nl489.patch
 Patch4: dnssec-trigger-0.11-coverity_scan.patch
+Patch5: dnssec-trigger-rh1254473.patch
 
 Requires(postun): initscripts
 Requires: ldns >= 1.6.10, NetworkManager, NetworkManager-glib, unbound, xdg-utils
@@ -50,10 +53,9 @@ sed -i "s/-panel//" panel/dnssec-trigger-panel.desktop.in
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%patch5 -p1
 
 %build
-export LDFLAGS="$LDFLAGS -Wl,-z,now"
-
 %configure  --with-keydir=/etc/dnssec-trigger 
 %{__make} %{?_smp_mflags}
 
@@ -136,6 +138,10 @@ fi
 
 
 %changelog
+* Wed May 18 2016 Tomas Hozza <thozza@redhat.com> - 0.11-22
+- Improved text in the GUI panel in Hotspot sign-on mode (#1254473)
+- Build all binaries with PIE hardening (#1092526)
+
 * Tue Feb 11 2014 Tomas Hozza <thozza@redhat.com> - 0.11-21
 - handle IndexError exception in NM script until NM provides better API (#1063735)
 - restart NM when stopping dnssec-trigger daemon instead of handling