diff --git a/syft/pkg/cataloger/rpm/cataloger_test.go b/syft/pkg/cataloger/rpm/cataloger_test.go
index ca8907e2101..92b920532cd 100644
--- a/syft/pkg/cataloger/rpm/cataloger_test.go
+++ b/syft/pkg/cataloger/rpm/cataloger_test.go
@@ -16,6 +16,9 @@ func Test_DBCataloger_Globs(t *testing.T) {
 			name:    "obtain DB files",
 			fixture: "test-fixtures/glob-paths",
 			expected: []string{
+				"usr/share/rpm/Packages",
+				"usr/share/rpm/Packages.db",
+				"usr/share/rpm/rpmdb.sqlite",
 				"var/lib/rpm/Packages",
 				"var/lib/rpm/Packages.db",
 				"var/lib/rpm/rpmdb.sqlite",
diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages
new file mode 100644
index 00000000000..882b6040c5d
--- /dev/null
+++ b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages
@@ -0,0 +1 @@
+bogus
\ No newline at end of file
diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages.db b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages.db
new file mode 100644
index 00000000000..882b6040c5d
--- /dev/null
+++ b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages.db
@@ -0,0 +1 @@
+bogus
\ No newline at end of file
diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/rpmdb.sqlite b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/rpmdb.sqlite
new file mode 100644
index 00000000000..882b6040c5d
--- /dev/null
+++ b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/rpmdb.sqlite
@@ -0,0 +1 @@
+bogus
\ No newline at end of file
diff --git a/syft/pkg/rpm_metadata.go b/syft/pkg/rpm_metadata.go
index 1491b4900d7..899147d1765 100644
--- a/syft/pkg/rpm_metadata.go
+++ b/syft/pkg/rpm_metadata.go
@@ -8,10 +8,12 @@ import (
 	"github.com/anchore/syft/syft/file"
 )
 
+// /var/lib/rpm/... is the typical path for most distributions
+// /usr/share/rpm/... is common for rpm-ostree distributions (coreos-like)
 // Packages is the legacy Berkely db based format
 // Packages.db is the "ndb" format used in SUSE
 // rpmdb.sqlite is the sqlite format used in fedora + derivates
-const RpmDBGlob = "**/var/lib/rpm/{Packages,Packages.db,rpmdb.sqlite}"
+const RpmDBGlob = "**/{var/lib,usr/share}/rpm/{Packages,Packages.db,rpmdb.sqlite}"
 
 // Used in CBL-Mariner distroless images
 const RpmManifestGlob = "**/var/lib/rpmmanifest/container-manifest-2"