diff --git a/copr_script.sh b/copr_script.sh
index 18cfca6..9d7ff0c 100644
--- a/copr_script.sh
+++ b/copr_script.sh
@@ -595,6 +595,8 @@ sed --sandbox -i \
 # all end up in CONFIG_SYSTEM_TRUSTED_KEYS and thus .builtin_trusted_keys.
 cat "${script_dir}"/trusted-keys/*.pem > secureblue-certs.pem
 
+cp "${script_dir}/correct-spectre-flag-behavior.patch" .
+
 git apply "${script_dir}"/patches/*.patch
 
 mv ./* "${build_dir}"
diff --git a/correct-spectre-flag-behavior.patch b/correct-spectre-flag-behavior.patch
new file mode 100644
index 0000000..b684c9d
--- /dev/null
+++ b/correct-spectre-flag-behavior.patch
@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: Copyright 2026 The Secureblue Authors
+#
+# SPDX-License-Identifier: MIT
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -2236,7 +2236,8 @@
+ 
+ static void __init spectre_v2_update_mitigation(void)
+ {
+-	if (spectre_v2_cmd == SPECTRE_V2_CMD_AUTO &&
++	if ((spectre_v2_cmd == SPECTRE_V2_CMD_AUTO ||
++	     spectre_v2_cmd == SPECTRE_V2_CMD_FORCE) &&
+ 	    !spectre_v2_in_eibrs_mode(spectre_v2_enabled)) {
+ 		if (IS_ENABLED(CONFIG_MITIGATION_IBRS_ENTRY) &&
+ 		    boot_cpu_has_bug(X86_BUG_RETBLEED) &&
diff --git a/patches/add-spectre-patch.patch b/patches/add-spectre-patch.patch
new file mode 100644
index 0000000..4d59d7b
--- /dev/null
+++ b/patches/add-spectre-patch.patch
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright 2026 The Secureblue Authors
+#
+# SPDX-License-Identifier: MIT
+
+--- a/kernel.spec
++++ b/kernel.spec
+@@ -1216,6 +1216,8 @@
+ Patch1: patch-%{patchversion}-redhat.patch
+ %endif
+ 
++Patch999998: correct-spectre-flag-behavior.patch
++
+ # empty final patch to facilitate testing of kernel patches
+ Patch999999: linux-kernel-test.patch
+ 
+@@ -2192,6 +2194,8 @@
+ ApplyOptionalPatch patch-%{patchversion}-redhat.patch
+ %endif
+ 
++ApplyPatch correct-spectre-flag-behavior.patch
++
+ ApplyOptionalPatch linux-kernel-test.patch
+ 
+ %{log_msg "End of patch applications"}