diff --git a/nss-pam-ldapd.spec b/nss-pam-ldapd.spec
index 2212b87..296858c 100644
--- a/nss-pam-ldapd.spec
+++ b/nss-pam-ldapd.spec
@@ -12,6 +12,18 @@
 %global tmpfiles 0
 %endif
 
+# Fedora had it in F17, but moving things around in already-released versions
+# is a bad idea, so pretend it didn't happen until F19.
+%if 0%{?fedora} > 18 || 0%{?rhel} > 6
+%global separate_usr 0
+%global nssdir %{_libdir}
+%global pamdir %{_libdir}/security
+%else
+%global separate_usr 1
+%global nssdir /%{_lib}
+%global pamdir /%{_lib}/security
+%endif
+
 Name:		nss-pam-ldapd
 Version:	0.8.12
 Release:	1%{?dist}
@@ -70,7 +82,7 @@ nsswitch module.
 autoreconf -f -i
 
 %build
-%configure --libdir=/%{_lib}
+%configure --libdir=%{nssdir} --with-pam-seclib-dir=%{pamdir}
 make %{?_smp_mflags}
 
 %check
@@ -86,7 +98,9 @@ install -p -m755 %{SOURCE2} $RPM_BUILD_ROOT/%{_initddir}/nslcd
 %if %{systemd}
 install -p -m755 %{SOURCE4} $RPM_BUILD_ROOT/lib/systemd/system/
 %endif
+
 %if 0%{?fedora} > 13 || 0%{?rhel} > 5
+%if %{separate_usr}
 # Follow glibc's convention and provide a .so symlink so that people who know
 # what to expect can link directly with the module.
 if test %{_libdir} != /%{_lib} ; then
@@ -99,7 +113,11 @@ if test %{_libdir} != /%{_lib} ; then
 		$RPM_BUILD_ROOT/%{_libdir}/libnss_ldap.so
 	rm $RPM_BUILD_ROOT/rootfile
 fi
+%else
+ln -s libnss_ldap.so.2 $RPM_BUILD_ROOT/%{nssdir}/libnss_ldap.so
+%endif
 %endif
+
 sed -i -e 's,^uid.*,uid nslcd,g' -e 's,^gid.*,gid ldap,g' \
 $RPM_BUILD_ROOT/%{_sysconfdir}/nslcd.conf
 touch -r nslcd.conf $RPM_BUILD_ROOT/%{_sysconfdir}/nslcd.conf
@@ -116,8 +134,8 @@ rm -rf $RPM_BUILD_ROOT
 %defattr(-,root,root)
 %doc AUTHORS ChangeLog COPYING HACKING NEWS README TODO
 %{_sbindir}/*
-/%{_lib}/*.so.*
-/%{_lib}/security/pam_ldap.so
+%{nssdir}/*.so.*
+%{pamdir}/pam_ldap.so
 %{_mandir}/*/*
 %attr(0600,root,root) %config(noreplace) %verify(not md5 size mtime) /etc/nslcd.conf
 %if %{tmpfiles}