diff --git a/libguestfs.changes b/libguestfs.changes
index 8d09081..0f4ff93 100644
--- a/libguestfs.changes
+++ b/libguestfs.changes
@@ -26,6 +26,11 @@ Thu Jan  4 13:10:51 MST 2024 - carnold@suse.com
   * In guestmount(1) avoid calling fclose(NULL) on error paths,
     which might have caused a crash on some platforms.
 
+-------------------------------------------------------------------
+Tue Dec 19 09:00:54 UTC 2023 - Bernhard Wiedemann <bwiedemann@suse.com>
+
+- Provide a tar-wrapper that creates bit-reproducible output (boo#1218191)
+
 -------------------------------------------------------------------
 Tue Dec 12 12:12:12 UTC 2023 - ohering@suse.de
 
diff --git a/libguestfs.spec b/libguestfs.spec
index b231396..3f11f78 100644
--- a/libguestfs.spec
+++ b/libguestfs.spec
@@ -91,8 +91,23 @@ schemes, qcow, qcow2, vmdk.
 %autosetup -p1
 
 sed -i 's|RPMVSF_MASK_NOSIGNATURES|_RPMVSF_NOSIGNATURES|' daemon/rpm-c.c
+sed -i 's/tar zcf/tar -zcf/' appliance/Makefile.am
 
 %build
+# provide a wrapper to tar that creates bit-reproducible output (boo#1218191)
+# used in supermin for base.tar.gz, in %install for zz-winsupport.tar.gz zz-scripts.tar.gz and in appliance/Makefile.am for 3 more .tar.gz files
+SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(date -r %{SOURCE0} +%%s)}
+mkdir ~/bin ; cat >~/bin/tar <<EOF
+#!/bin/sh
+exec /usr/bin/tar \
+  --sort=name --clamp-mtime --mtime=@$SOURCE_DATE_EPOCH \
+  --owner=0 --group=0 --numeric-owner \
+  --pax-option=exthdr.name=%%d/PaxHeaders/%%f,delete=atime,delete=ctime \
+  "\$@"
+EOF
+chmod a+x ~/bin/tar
+PATH=~/bin:$PATH
+
 %global _lto_cflags %{_lto_cflags} -ffat-lto-objects
 # use 'env LIBGUESTFS_HV=/path/to/kvm libguestfs-test-tool' to verify
 %define kvm_binary /bin/false
@@ -188,6 +203,7 @@ make \
 build_it %{?_smp_mflags} || build_it
 
 %install
+PATH=~/bin:$PATH
 %make_install \
 	INSTALLDIRS=vendor \
 	udevrulesdir=%{_udevrulesdir}
@@ -251,7 +267,7 @@ done
 cp %{S:101} winsupport
 
 pushd winsupport
-tar zcf %{buildroot}%{_libdir}/guestfs/supermin.d/zz-winsupport.tar.gz .
+tar -czf %{buildroot}%{_libdir}/guestfs/supermin.d/zz-winsupport.tar.gz .
 popd
 
 cat > %{buildroot}%{_libdir}/guestfs/supermin.d/zz-packages-winsupport << EOF