diff --git a/rpmsign.c b/rpmsign.c
index 04738c052..578079a4d 100644
--- a/rpmsign.c
+++ b/rpmsign.c
@@ -119,9 +119,9 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
 	    fileSigningKeyPassword = get_fskpass();
 	}
 
-	rpmPushMacro(NULL, "_file_signing_key_password", NULL,
-	    fileSigningKeyPassword, RMIL_CMDLINE);
 	if (fileSigningKeyPassword) {
+	    rpmPushMacro(NULL, "_file_signing_key_password", NULL,
+			fileSigningKeyPassword, RMIL_CMDLINE);
 	    memset(fileSigningKeyPassword, 0, strlen(fileSigningKeyPassword));
 	    free(fileSigningKeyPassword);
 	}
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 5c04e9218..073136364 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -538,7 +538,7 @@ static rpmRC includeFileSignatures(FD_t fd, const char *rpm,
 
     key = rpmExpand("%{?_file_signing_key}", NULL);
 
-    keypass = rpmExpand("%{_file_signing_key_password}", NULL);
+    keypass = rpmExpand("%{?_file_signing_key_password}", NULL);
     if (rstreq(keypass, "")) {
 	free(keypass);
 	keypass = NULL;