diff --git a/crypto-policies.spec b/crypto-policies.spec
index d965f3d..345a0c8 100644
--- a/crypto-policies.spec
+++ b/crypto-policies.spec
@@ -6,7 +6,7 @@
 
 Name:           crypto-policies
 Version:        %{git_date}
-Release:        3.git%{git_commit_hash}%{?dist}
+Release:        4.git%{git_commit_hash}%{?dist}
 Summary:        System-wide crypto policies
 
 License:        LGPLv2+
@@ -99,6 +99,10 @@ for d in LEGACY DEFAULT NEXT FUTURE FIPS ; do
     done
 done
 
+for f in %{buildroot}%{_datarootdir}/crypto-policies/DEFAULT/* ; do
+    ln -sf %{_datarootdir}/crypto-policies/DEFAULT/$(basename $f) %{buildroot}%{_sysconfdir}/crypto-policies/back-ends/$(basename $f .txt).config
+done
+
 %py_byte_compile %{__python3} %{buildroot}%{_datadir}/crypto-policies/python
 
 %check
@@ -120,18 +124,17 @@ make check %{?_smp_mflags}
 
 %config(noreplace) %{_sysconfdir}/crypto-policies/config
 
-%ghost %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/openssl.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/openssh.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/nss.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/bind.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/java.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/krb5.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/openjdk.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
-%ghost %{_sysconfdir}/crypto-policies/back-ends/libssh.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/openssl.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/openssh.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/nss.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/bind.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/java.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/krb5.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
+%config(noreplace) %{_sysconfdir}/crypto-policies/back-ends/libssh.config
 
 %{_mandir}/man7/crypto-policies.7*
 %{_datarootdir}/crypto-policies/LEGACY
@@ -159,8 +162,13 @@ make check %{?_smp_mflags}
 %{_mandir}/man8/fips-finish-install.8*
 
 %changelog
+* Tue Jan 14 2020 Tomáš Mráz <tmraz@redhat.com> - 20191128-4.gitcd267a5
+- the base package must ship the DEFAULT policy config symlinks in case
+  the scripts package is not installed via the weak dependency
+
 * Tue Jan 07 2020 Andrew Jeddeloh <ajeddelo@redhat.com> 20191128-3.gitcd267a5
-- split scripts into their own subpackage. See https://github.com/coreos/fedora-coreos-tracker/issues/280 for more details.
+- split scripts into their own subpackage. See
+  https://github.com/coreos/fedora-coreos-tracker/issues/280 for more details.
 
 * Mon Dec 16 2019 Tomáš Mráz <tmraz@redhat.com> - 20191128-2.gitcd267a5
 - move the pre-built .config files to /usr/share/crypto-policies/back-ends