diff --git a/baselibs.conf b/baselibs.conf
index 9076461..3da805e 100644
--- a/baselibs.conf
+++ b/baselibs.conf
@@ -1,2 +1,9 @@
 libp11-kit0
 p11-kit
+    +/usr/lib(64)?/pkcs11/*.so
+    requires "p11-kit = <version>"
+p11-kit-nss-trust
+    +/usr/lib(64)?/*.so
+    requires "p11-kit = <version>"
+    conflicts "mozilla-nss-certs-<targettype>"
+    provides "libnssckbi.so"
diff --git a/p11-kit-biarch.patch b/p11-kit-biarch.patch
new file mode 100644
index 0000000..683a309
--- /dev/null
+++ b/p11-kit-biarch.patch
@@ -0,0 +1,33 @@
+From c1b85c3a59ab7b809e9531e1fb4bf38d9476fefc Mon Sep 17 00:00:00 2001
+From: Stanislav Brabec <sbrabec@suse.com>
+Date: Tue, 22 Nov 2016 14:44:21 +0100
+Subject: [PATCH] move privatedir from libdir to libexecdir
+
+According to the GNU Coding Standards[1], private executables should be
+installed to libexecdir, not libdir.
+
+Move privatedir to libexecdir.
+
+[1] https://www.gnu.org/prep/standards/
+
+https://bugs.freedesktop.org/show_bug.cgi?id=98817
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 64f0b5a..5cb1f17 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -498,7 +498,7 @@ esac
+ AC_DEFINE_UNQUOTED(SHLEXT, ["$SHLEXT"], [File extension for shared libraries])
+ AC_SUBST(SHLEXT)
+ 
+-privatedir='${libdir}/p11-kit'
++privatedir='${libexecdir}/p11-kit'
+ AC_SUBST(privatedir)
+ 
+ AC_CONFIG_FILES([Makefile
+-- 
+2.10.2
+
diff --git a/p11-kit.changes b/p11-kit.changes
index 3da5f53..8e89566 100644
--- a/p11-kit.changes
+++ b/p11-kit.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Tue Nov 22 14:57:50 CET 2016 - sbrabec@suse.com
+
+- 32-bit compatibility fixes:
+  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
+  * Add p11-kit-nss-trust-32bit NSS module
+  * Fix potential bi-arch issue with private binaries
+    (fdo#98817, p11-kit-biarch.patch)
+
 -------------------------------------------------------------------
 Mon Feb  8 21:25:45 UTC 2016 - mpluskal@suse.com
 
diff --git a/p11-kit.spec b/p11-kit.spec
index f7f2221..d450534 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -32,10 +32,15 @@ Source0:        http://p11-glue.freedesktop.org/releases/%{name}-%{version}.tar.
 Source1:        http://p11-glue.freedesktop.org/releases/%{name}-%{version}.tar.gz.sig
 Source98:       p11-kit.keyring
 Source99:       baselibs.conf
+Patch:          p11-kit-biarch.patch
 BuildRequires:  gtk-doc
 BuildRequires:  pkg-config
 BuildRequires:  pkgconfig(libffi) >= 3.0.0
 BuildRequires:  pkgconfig(libtasn1) >= 2.3
+# autotools are needed for p11-kit-biarch.patch
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -88,8 +93,11 @@ to be installed intead of mozilla-nss-certs.
 
 %prep
 %setup -q
+%patch -p1
 
 %build
+# autoreconf needed for p11-kit-biarch.patch
+autoreconf -f -i
 %configure --with-trust-paths=%{trustdir_cfg}:%{trustdir_static}
 make %{?_smp_mflags} V=1
 
@@ -120,8 +128,8 @@ FIN
 ln -s %{_libdir}/pkcs11/p11-kit-trust.so %{buildroot}%{_libdir}/libnssckbi.so
 #
 # call update-ca-certificates when trust changes
-rm %{buildroot}%{_libdir}/%{name}/trust-extract-compat
-ln -s ../../sbin/update-ca-certificates %{buildroot}%{_libdir}/%{name}/p11-kit-extract-trust
+rm %{buildroot}%{_libexecdir}/%{name}/trust-extract-compat
+ln -s ../../sbin/update-ca-certificates %{buildroot}%{_libexecdir}/%{name}/p11-kit-extract-trust
 export NO_BRP_STALE_LINK_ERROR=yes # *grr*
 
 %check
@@ -146,9 +154,9 @@ make %{?_smp_mflags} check
 %dir %{trustdir_static}/blacklist
 %{_datadir}/%{name}/modules/p11-kit-trust.module
 %{_libdir}/pkcs11/p11-kit-trust.so
-%dir %{_libdir}/%{name}
-%{_libdir}/%{name}/p11-kit-remote
-%{_libdir}/%{name}/p11-kit-extract-trust
+%dir %{_libexecdir}/%{name}
+%{_libexecdir}/%{name}/p11-kit-remote
+%{_libexecdir}/%{name}/p11-kit-extract-trust
 
 %files -n libp11-kit0
 %defattr(-,root,root)