diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2db1664
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+/sec-2.9.2.tar.gz
+/sec-2.9.3.tar.gz
+/sec-2.9.4.tar.gz
diff --git a/Makefile b/Makefile
deleted file mode 100644
index a45a953..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: sec
-# $Id$
-NAME := sec
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/conf.README b/conf.README
new file mode 100644
index 0000000..252ae6f
--- /dev/null
+++ b/conf.README
@@ -0,0 +1,12 @@
+This is the SEC configuration directory. Because SEC usage varies so widely
+from user to user, this package is configured by default to not run.
+
+The commented-out default settings in /etc/sysconfig/sec will load any file in
+this directory with a .sec suffix. You can find several example rules at
+
+    https://github.com/simple-evcorr/rulesets
+
+and install the ones you want here (taking into account that the examples are
+generic and some of them may need to be tweaked to work with your setup). You
+should also read the SEC man page so you have at least a basic understanding of
+the SEC configuration commands.
diff --git a/sec.logrotate b/sec.logrotate
new file mode 100644
index 0000000..917a7bc
--- /dev/null
+++ b/sec.logrotate
@@ -0,0 +1,8 @@
+/var/log/sec {
+    missingok
+    notifempty
+    sharedscripts
+    postrotate
+        [ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid`
+    endscript
+}
diff --git a/sec.service b/sec.service
new file mode 100644
index 0000000..7b05795
--- /dev/null
+++ b/sec.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Simple Event Correlator script to filter log file entries
+After=syslog.target
+
+[Service]
+Type=forking
+PIDFile=/run/sec.pid
+ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS
+EnvironmentFile=/etc/sysconfig/sec
+
+[Install]
+WantedBy=multi-user.target
diff --git a/sec.spec b/sec.spec
new file mode 100644
index 0000000..54db3fc
--- /dev/null
+++ b/sec.spec
@@ -0,0 +1,80 @@
+Name:           sec
+Version:        2.9.4
+Release:        1%{?dist}
+Summary:        Simple Event Correlator script to filter log file entries
+License:        GPLv2+
+URL:            https://simple-evcorr.github.io/
+Source0:        https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz
+Source1:        sec.service
+Source2:        sec@.service
+Source3:        sec.logrotate
+Source4:        sec.sysconfig
+Source5:        conf.README
+BuildArch:      noarch
+
+BuildRequires:  perl-generators
+BuildRequires:  systemd
+
+Requires:       logrotate
+
+Requires(post):   systemd
+Requires(preun):  systemd
+Requires(postun): systemd
+
+%description
+SEC is a simple event correlation tool that reads lines from files, named
+pipes, or standard input, and matches the lines with regular expressions,
+Perl subroutines, and other patterns for recognizing input events.
+Events are then correlated according to the rules in configuration files,
+producing output events by executing user-specified shell commands, by
+writing messages to pipes or files, etc.
+
+%prep
+%setup -q
+
+%build
+
+%install
+# Install SEC and its associated files
+install -D -m 0755 -p sec        %{buildroot}%{_bindir}/sec
+install -D -m 0644 -p sec.man    %{buildroot}%{_mandir}/man1/sec.1
+install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service
+install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service
+install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec
+install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec
+install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README
+
+# Remove executable bits because these files get packed as docs
+chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
+
+%post
+%systemd_post sec.service
+
+%preun
+%systemd_preun sec.service
+
+%postun
+%systemd_postun_with_restart sec.service
+
+%files
+%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl
+%config(noreplace) %{_sysconfdir}/%{name}
+%config(noreplace) %{_sysconfdir}/logrotate.d/sec
+%config(noreplace) %{_sysconfdir}/sysconfig/sec
+%{_bindir}/sec
+%{_mandir}/man1/sec.1*
+%{_unitdir}/sec.service
+%{_unitdir}/sec@.service
+
+%changelog
+* Thu Feb 12 2026 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.4-1
+- New upstream release
+
+* Sat Nov 02 2024 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.3-1
+- New upstream release
+
+* Mon Jun 05 2023 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.2-1
+- New upstream release
+
+* Thu Oct 20 2022 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.1-1
+- Initial EPEL 9 build
diff --git a/sec.sysconfig b/sec.sysconfig
new file mode 100644
index 0000000..a240503
--- /dev/null
+++ b/sec.sysconfig
@@ -0,0 +1,19 @@
+# Command line options for SEC
+
+OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents"
+
+# This is an example config if multiple instances of SEC should be started.
+# These settings should be used together with the systemd service file
+#     sec@.service
+# which allows to run multiple sec instances.
+#
+#
+# Below you find an example configuration of two instances named FOO and BAR.
+# The instances can be started via the commands
+#     systemctl start sec@FOO     and     systemctl start sec@BAR
+# For further configuration options, consult the systemd file:
+#     /lib/systemd/system/sec@.service
+
+#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents"
+
+#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents"
diff --git a/sec@.service b/sec@.service
new file mode 100644
index 0000000..dbf83af
--- /dev/null
+++ b/sec@.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Simple Event Correlator (instance %I)
+After=syslog.target
+
+[Service]
+Type=forking
+PIDFile=/run/sec-%I.pid
+ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I
+EnvironmentFile=/etc/sysconfig/sec
+
+[Install]
+WantedBy=multi-user.target
diff --git a/sources b/sources
index e69de29..30a16bf 100644
--- a/sources
+++ b/sources
@@ -0,0 +1 @@
+SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9