diff --git a/rpm/generic/zfs-kmod.spec.in b/rpm/generic/zfs-kmod.spec.in
index 3c73e2ff2d..4cc075585d 100644
--- a/rpm/generic/zfs-kmod.spec.in
+++ b/rpm/generic/zfs-kmod.spec.in
@@ -150,6 +150,30 @@ for kernel_version in %{?kernel_versions}; do
 done
 
 
+# Module signing (modsign)
+#
+# This must be run _after_ find-debuginfo.sh runs, otherwise that will strip
+# the signature off of the modules.
+# (Based on Fedora's kernel.spec workaround)
+%define __modsign_install_post \
+    sign_pem="%{ksrc}/certs/signing_key.pem"; \
+    sign_x509="%{ksrc}/certs/signing_key.x509"; \
+    if [ -f "${sign_x509}" ]\
+    then \
+        echo "Signing kernel modules ..."; \
+        for kmod in $(find ${RPM_BUILD_ROOT}%{kmodinstdir_prefix}/*/extra/ -name \*.ko); do \
+            %{ksrc}/scripts/sign-file sha256 ${sign_pem} ${sign_x509} ${kmod}; \
+        done \
+    fi \
+%{nil}
+
+# hack to ensure signing happens after find-debuginfo.sh runs
+%define __spec_install_post \
+    %{?__debug_package:%{__debug_install_post}}\
+    %{__arch_install_post}\
+    %{__os_install_post}\
+    %{__modsign_install_post}
+
 %install
 rm -rf ${RPM_BUILD_ROOT}
 
diff --git a/rpm/redhat/zfs-kmod.spec.in b/rpm/redhat/zfs-kmod.spec.in
index f59551c0b4..9c836786ba 100644
--- a/rpm/redhat/zfs-kmod.spec.in
+++ b/rpm/redhat/zfs-kmod.spec.in
@@ -72,6 +72,30 @@ fi
         %{?kernel_llvm}
 make %{?_smp_mflags}
 
+# Module signing (modsign)
+#
+# This must be run _after_ find-debuginfo.sh runs, otherwise that will strip
+# the signature off of the modules.
+# (Based on Fedora's kernel.spec workaround)
+%define __modsign_install_post \
+        sign_pem="%{ksrc}/certs/signing_key.pem"; \
+        sign_x509="%{ksrc}/certs/signing_key.x509"; \
+        if [ -f "${sign_x509}" ]\
+        then \
+            echo "Signing kernel modules ..."; \
+            for kmod in $(find %{buildroot}/lib/modules/%{kverrel}/extra/ -name \*.ko); do \
+                    %{ksrc}/scripts/sign-file sha256 ${sign_pem} ${sign_x509} ${kmod}; \
+            done \
+        fi \
+%{nil}
+
+# hack to ensure signing happens after find-debuginfo.sh runs
+%define __spec_install_post \
+        %{?__debug_package:%{__debug_install_post}}\
+        %{__arch_install_post}\
+        %{__os_install_post}\
+        %{__modsign_install_post}
+
 %install
 make install \
         DESTDIR=${RPM_BUILD_ROOT} \