diff --git a/host-interaction/bootloader/manipulate-safe-mode-programs.yml b/host-interaction/bootloader/manipulate-safe-mode-programs.yml
index 4b4f3bb9..7a76fdbb 100644
--- a/host-interaction/bootloader/manipulate-safe-mode-programs.yml
+++ b/host-interaction/bootloader/manipulate-safe-mode-programs.yml
@@ -9,8 +9,10 @@ rule:
     examples:
       - 3446b3889a52d81119d8c482a2a282b9:0x409AA8
   features:
-    - or:
-      - substring: "Control\\SafeBoot\\Minimal\\"
-        description: registry key for safe mode, no networking
-      - substring: "Control\\SafeBoot\\Network\\"
-        description: registry key for safe mode, with networking
+    - and:
+      - os: windows
+      - or:
+        - substring: "Control\\SafeBoot\\Minimal\\"
+          description: registry key for safe mode, no networking
+        - substring: "Control\\SafeBoot\\Network\\"
+          description: registry key for safe mode, with networking