diff --git a/disable-pam_env-test.patch b/disable-pam_env-test.patch
new file mode 100644
index 0000000..6093897
--- /dev/null
+++ b/disable-pam_env-test.patch
@@ -0,0 +1,11 @@
+--- Linux-PAM-1.6.0/modules/pam_env/Makefile.am.old	2024-01-17 11:29:36.000000000 +0100
++++ Linux-PAM-1.6.0/modules/pam_env/Makefile.am	2024-01-18 16:45:11.923011145 +0100
+@@ -12,7 +12,7 @@
+ endif
+ XMLS = README.xml pam_env.conf.5.xml pam_env.8.xml
+ dist_check_SCRIPTS = tst-pam_env
+-TESTS = $(dist_check_SCRIPTS) $(check_PROGRAMS)
++TESTS = $(dist_check_SCRIPTS)
+ 
+ securelibdir = $(SECUREDIR)
+ if HAVE_VENDORDIR
diff --git a/pam.changes b/pam.changes
index da9abb7..4147492 100644
--- a/pam.changes
+++ b/pam.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jan 18 15:45:53 UTC 2024 - Thorsten Kukuk <kukuk@suse.com>
+
+- disable-pam_env-test.patch: disable tst-pam_env-retval.c as it is
+  broken
+
 -------------------------------------------------------------------
 Thu Jan 18 08:28:14 UTC 2024 - Thorsten Kukuk <kukuk@suse.com>
 
diff --git a/pam.spec b/pam.spec
index 8b9a6e3..65fef55 100644
--- a/pam.spec
+++ b/pam.spec
@@ -96,6 +96,7 @@ Source22:       postlogin-account.pamd
 Source23:       postlogin-password.pamd
 Source24:       postlogin-session.pamd
 Patch1:         pam-limit-nproc.patch
+Patch2:         disable-pam_env-test.patch
 BuildRequires:  audit-devel
 BuildRequires:  bison
 BuildRequires:  flex
@@ -206,6 +207,7 @@ building both PAM-aware applications and modules for use with PAM.
 %setup -q -n Linux-PAM-%{version}
 cp -a %{SOURCE12} .
 %patch1 -p1
+%patch2 -p1
 
 %build
 bash ./pam-login_defs-check.sh
@@ -280,7 +282,9 @@ mkdir -p -m 755 %{buildroot}%{_libdir}
 mkdir -p %{buildroot}%{_distconfdir}/pam.d
 
 %make_install
-/sbin/ldconfig -n %{buildroot}%{libdir}
+# XXX remove for now until we have a security review of the new module
+rm -f %{buildroot}%{_libdir}/security/pam_canonicalize_user.so
+/sbin/ldconfig -n %{buildroot}%{_libdir}
 # Install documentation
 %make_install -C doc
 # install /etc/security/namespace.d used by pam_namespace.so for namespace.conf iscript