diff --git a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
index b56fa60a9..185cdb4e5 100644
--- a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
+++ b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
@@ -385,6 +385,9 @@ exit 0
 
 # No-one should need access to anything under share/GUI
 %defattr(400,root,root,400)
+# We can change these configuration files as part of masterfiles policy so need to mark as configs
+%config(noreplace) %prefix/share/GUI/application/config/config.php
+%config(noreplace) %prefix/share/GUI/api/modules/inventory/config/config.php
 %prefix/share/GUI
 
 # Base policy
diff --git a/packaging/cfengine-nova-hub/debian/conffiles b/packaging/cfengine-nova-hub/debian/conffiles
new file mode 100644
index 000000000..887c97b90
--- /dev/null
+++ b/packaging/cfengine-nova-hub/debian/conffiles
@@ -0,0 +1,2 @@
+/var/cfengine/share/GUI/application/config/config.php
+/var/cfengine/share/GUI/api/modules/inventory/config/config.php