diff --git a/Make-unsafe-subinterpreter-support-available-via-cfg.patch b/Make-unsafe-subinterpreter-support-available-via-cfg.patch
new file mode 100644
index 0000000..7391612
--- /dev/null
+++ b/Make-unsafe-subinterpreter-support-available-via-cfg.patch
@@ -0,0 +1,40 @@
+From d59176bc05aa37838fd4a8dd253f47c962f61118 Mon Sep 17 00:00:00 2001
+From: Fabio Valentini <decathorpe@gmail.com>
+Date: Tue, 23 Jul 2024 14:41:04 +0200
+Subject: [PATCH] Make unsafe subinterpreter support available via cfg flag
+
+---
+ src/impl_/pymodule.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/vendor/pyo3-0.25.1/src/impl_/pymodule.rs
++++ b/vendor/pyo3-0.25.1/src/impl_/pymodule.rs
+@@ -100,7 +100,7 @@ impl ModuleDef {
+         // that static data is not reused across interpreters.
+         //
+         // PyPy does not have subinterpreters, so no need to check interpreter ID.
+-        #[cfg(not(any(PyPy, GraalPy)))]
++        #[cfg(not(any(PyPy, GraalPy, pyo3_unsafe_allow_subinterpreters)))]
+         {
+             // PyInterpreterState_Get is only available on 3.9 and later, but is missing
+             // from python3.dll for Windows stable API on 3.9
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -29,3 +29,6 @@ openssl-sys = "0.9.108"
+ 
+ [profile.release]
+ overflow-checks = true
++
++[patch.crates-io]
++pyo3 = { path="vendor/pyo3-0.25.1" }
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -269,8 +269,6 @@ dependencies = [
+ [[package]]
+ name = "pyo3"
+ version = "0.25.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8970a78afe0628a3e3430376fc5fd76b6b45c4d43360ffd6cdd40bdde72b682a"
+ dependencies = [
+  "indoc",
+  "libc",
diff --git a/python-cryptography.changes b/python-cryptography.changes
index b319346..8699907 100644
--- a/python-cryptography.changes
+++ b/python-cryptography.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Sep  1 14:46:55 UTC 2025 - James Oakley <jfunk@opensuse.org>
+
+- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
+  to allow ceph-mgr to load modules (boo#1248987)
+
 -------------------------------------------------------------------
 Sat Jul 12 08:36:08 UTC 2025 - Dirk Müller <dmueller@suse.com>
 
diff --git a/python-cryptography.spec b/python-cryptography.spec
index 81e0774..3642f1b 100644
--- a/python-cryptography.spec
+++ b/python-cryptography.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package python-cryptography
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -41,6 +41,8 @@ Source4:        python-cryptography.keyring
 # PATCH-FEATURE-OPENSUSE no-pytest_benchmark.patch mcepl@suse.com
 # We don't need no benchmarking and coverage measurement
 Patch4:         no-pytest_benchmark.patch
+# PATCH-FIX-OPENSUSE Make-unsafe-subinterpreter-support-available-via-cfg.patch boo#1248987
+Patch5:         Make-unsafe-subinterpreter-support-available-via-cfg.patch
 BuildRequires:  %{python_module cffi >= 1.12}
 BuildRequires:  %{python_module devel}
 BuildRequires:  %{python_module exceptiongroup}
@@ -94,7 +96,8 @@ export CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=off
 # https://pyo3.rs/main/building-and-distribution#configuring-the-python-version
 %python_expand export PYO3_PYTHON="%{_bindir}/$python"
 %global _lto_cflags %{nil}
-export RUSTFLAGS=%{rustflags}
+RUSTFLAGS=%{rustflags}
+export RUSTFLAGS="$RUSTFLAGS --cfg pyo3_unsafe_allow_subinterpreters"
 export CFLAGS="%{optflags} -fno-strict-aliasing"
 %pyproject_wheel
 
diff --git a/vendor.tar.zst b/vendor.tar.zst
index c2d8b05..6b5d751 100644
--- a/vendor.tar.zst
+++ b/vendor.tar.zst
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:cb3f6d6b8893372db6b9f1a6cecfe6094581ba75ddbd48011fdae58726bab5eb
-size 2638187
+oid sha256:66027fde33c455f0cb3d01f7daba90d0e8a87378f1b48bcc5cb23bc2fb9c98bb
+size 2651262