diff --git a/SOURCES/grub.macros b/SOURCES/grub.macros
index 3fac42f..ef7a35c 100644
--- a/SOURCES/grub.macros
+++ b/SOURCES/grub.macros
@@ -222,7 +222,11 @@
 
 %ifarch x86_64
 %global with_efi_common 1
-%global with_legacy_modules 0
+# Build grub2-pc-modules on x86_64 (upstream behavior). Without it, grub2-pc
+# requires a sibling that is never built, so it is uninstallable and cannot be
+# upgraded in lockstep with the rest of the stack (dnf "protected package"
+# removal error on any box that already has the stock grub2-pc).
+%global with_legacy_modules 1
 %global with_legacy_common 0
 %else
 %global with_efi_common 0
@@ -289,6 +293,8 @@ Provides:	%{name}-efi = %{evr}					\
 # Add ciq-shim requirement, ONLY on ciq secureboot supported arches    \
 %ifarch x86_64 aarch64 \
 Requires: ciq-shim >= 15.8          \
+Provides:	ciq-grub2 = %{evr}					\
+Provides:	ciq-grub2-%{1} = %{evr}				\
 %endif   \
 %{?legacy_provides:Provides:	%{name} = %{evr}}			\
 %{-o:Obsoletes:	%{name}-efi < %{evr}}					\
diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec
index af012e0..dad5fb7 100644
--- a/SPECS/grub2.spec
+++ b/SPECS/grub2.spec
@@ -5,9 +5,9 @@
 %global _configure_gnuconfig_hack 0
 
 Name:                 grub2
-Epoch:                1
+Epoch:                5
 Version:              2.02
-Release:              167%{?dist}.ciq.0.1.3
+Release:              167%{?dist}.ciq.0.1.5
 Summary:              Bootloader with support for Linux, Multiboot and more
 Group:                System Environment/Base
 License:              GPLv3+
@@ -543,6 +543,18 @@ fi
 %endif
 
 %changelog
+* Fri Jul 31 2026 Jason Rodriguez <jrodriguez@ciq.com> - 2.02-167.ciq.0.1.5
+- Release bump only: .0.1.4 was already published without the with_legacy_modules
+  fix below despite the changelog entry claiming it (spec was edited in place
+  post-publish instead of getting a new release). Republishing under the same
+  NVR isn't safe, so this rebuild carries no other changes.
+
+* Fri Jun 26 2026 Jason Rodriguez <jrodriguez@ciq.com> - 2.02-167.ciq.0.1.4
+- Epoch 1 -> 5 so CIQ grub2 outranks Rocky's on a plain dnf upgrade (pairs with shim Epoch 5 + kernel Requires ciq-shim).
+- Enable with_legacy_modules on x86_64 so grub2-pc-modules is built; without it
+  grub2-pc (which Requires grub2-pc-modules) is uninstallable and dnf upgrade
+  fails with "removing protected packages: grub2-pc" on stock-grub2-pc boxes.
+
 * Thu Apr 03 2026 Linux Engineering <le-team@ciq.com> - 2.02-167.3
 - Bump SBAT level grub,3 -> grub,5 to reflect CVE patches already present
 - Port patches 0678-0683 from grub2-rl8 (Rocky Linux 8):