diff --git a/debian/changelog b/debian/changelog
index 5f1b565f5..9227974f5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -330,6 +330,7 @@ linux (4.13.9-1) UNRELEASED; urgency=medium
   * Revert "bpf: one perf event close won't free bpf program attached ..."
     to avoid an ABI change
   * [armel] security: Enable SECURITY_APPARMOR and disable SECURITY_SELINUX
+  * security: Enable DEFAULT_SECURITY_APPARMOR
 
  -- Ben Hutchings <ben@decadent.org.uk>  Wed, 18 Oct 2017 20:03:01 +0100
 
diff --git a/debian/config/config b/debian/config/config
index 31ce57602..cea4b05ad 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -7109,7 +7109,7 @@ CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
 CONFIG_LOCK_DOWN_KERNEL=y
 ## choice: Default security module
-CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY_APPARMOR=y
 ## end choice
 
 ##