diff --git a/freeradius.spec b/freeradius.spec
index b9bc1e1..57715cd 100644
--- a/freeradius.spec
+++ b/freeradius.spec
@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
 Version: 3.0.15
-Release: 10%{?dist}
+Release: 11%{?dist}
 License: GPLv2+ and LGPLv2+
 Group: System Environment/Daemons
 URL: http://www.freeradius.org/
@@ -801,6 +801,9 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 3.0.15-11
+- Escape macros in %%changelog
+
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.15-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 
@@ -906,8 +909,8 @@ exit 0
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 
 * Mon Jan 16 2017 Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.11-5
-- Move tmpfiles.d config to %{_tmpfilesdir}
-- Install license files as %license
+- Move tmpfiles.d config to %%{_tmpfilesdir}
+- Install license files as %%license
 
 * Thu Jan 12 2017 Igor Gnatenko <ignatenko@redhat.com> - 3.0.11-4
 - Rebuild for readline 7.x
@@ -1163,7 +1166,7 @@ exit 0
     See raddb/sites-available/dhcp, src_ipaddr and src_interface.
   * DHCP capabilitiies are now compiled in by default.
     It runs as a DHCP server ONLY when manually enabled.
-  * Added one letter expansions: %G - request minute and %I request
+  * Added one letter expansions: %%G - request minute and %%I request
     ID.
   * Added script to convert ISC DHCP lease files to SQL pools.
     See scripts/isc2ippool.pl
@@ -1208,10 +1211,10 @@ exit 0
     identities changing.  Bug reported by Microsoft EAP team.
   * Use home server src_ipaddr when sending Status-Server packets
   * Decrypt encrypted ERX attributes in CoA packets.
-  * Fix registration of internal xlat's so %{mschap:...} doesn't
+  * Fix registration of internal xlat's so %%{mschap:...} doesn't
     disappear after a HUP.
   * Can now reference tagged attributes in expansions.
-    e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work.
+    e.g. %%{Tunnel-Type:1} and %%{Tunnel-Type:1[0]} now work.
   * Correct calculation of Message-Authenticator for CoA and Disconnect
     replies.  Patch from Jouni Malinen
   * Install rad_counter, for managing rlm_counter files.
@@ -1284,7 +1287,7 @@ exit 0
   * Added support for elliptical curve cryptography.
     See ecdh_curve in raddb/eap.conf.
   * Added support for 802.1X MIBs in checkrad
-  * Added support for %{rand:...}, which generates a uniformly
+  * Added support for %%{rand:...}, which generates a uniformly
     distributed number between 0 and the number you specify.
   * Created "man" pages for all installed commands, and documented
     options for all commands.  Patch from John Dennis.
@@ -1300,7 +1303,7 @@ exit 0
   * Fix "failed to insert event"
   * Allow virtual servers to be reloaded on HUP.
     It no longer complains about duplicate virtual servers.
-  * Fix %{string:...} expansion
+  * Fix %%{string:...} expansion
   * Fix "server closed socket" loop in radmin
   * Set ownership of control socket when starting up
   * Always allow root to connect to control socket, even if