diff --git a/tomcat-server b/tomcat-server
index 951b3ee..17ae385 100644
--- a/tomcat-server
+++ b/tomcat-server
@@ -13,8 +13,8 @@ OPTIONS="-Dcatalina.base=$CATALINA_BASE \
 -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"
 
 if [ "$1" = "start" ] ; then
+  FLAGS="${FLAGS} $CATALINA_OPTS"
   if [ "${SECURITY_MANAGER}" = "true" ] ; then
-    FLAGS="${FLAGS} $CATALINA_OPTS"
     OPTIONS="${OPTIONS} \
     -Djava.security.manager \
     -Djava.security.policy==${CATALINA_BASE}/conf/catalina.policy"
diff --git a/tomcat.spec b/tomcat.spec
index 7a661c0..76dedd4 100644
--- a/tomcat.spec
+++ b/tomcat.spec
@@ -54,7 +54,7 @@
 Name:          tomcat
 Epoch:         1
 Version:       %{major_version}.%{minor_version}.%{micro_version}
-Release:       1%{?dist}
+Release:       2%{?dist}
 Summary:       Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
 
 Group:         System Environment/Daemons
@@ -686,6 +686,9 @@ fi
 %attr(0644,root,root) %{_unitdir}/%{name}-jsvc.service
 
 %changelog
+* Tue Nov 11 2015 Robert Scheck <robert@fedoraproject.org> 1:8.0.26-2
+- CATALINA_OPTS are only read when SECURITY_MANAGER is true (#1147105)
+
 * Thu Aug 27 2015 Alexander Kurtakov <akurtako@redhat.com> 1:8.0.26-1
 - Update to 8.0.26.