diff --git a/0001-Drop-attempt-to-add-nocrypto-to-tsflags.patch b/0001-Drop-attempt-to-add-nocrypto-to-tsflags.patch
new file mode 100644
index 0000000..9539973
--- /dev/null
+++ b/0001-Drop-attempt-to-add-nocrypto-to-tsflags.patch
@@ -0,0 +1,52 @@
+From 18883ab79be8186363e48418feb34c7890e1c30d Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Wed, 26 Sep 2018 18:45:41 -0700
+Subject: [PATCH] Drop attempt to add 'nocrypto' to tsflags
+
+This has not actually *worked* since DNF 3.0, due to
+https://bugzilla.redhat.com/show_bug.cgi?id=1595917 . You can
+check this for yourself quite easily, with DNF 3.0 to 3.5.1:
+
+>>> import dnf.base
+>>> base = dnf.base.Base()
+>>> base.conf.tsflags
+[]
+>>> base.conf.tsflags.append('nocrypto')
+>>> base.conf.tsflags
+[]
+>>>
+
+If you try this on DNF 3.6, you will notice that it errors out,
+because in DNF 3.6, these types of config options are presented
+as tuples rather than lists, as a way to try and spot now-broken
+usages like this.
+
+I suggest we just drop this entirely, because if it was actually
+*necessary* any more, we would've been running into the problem
+this was supposed to work around - #1006280 - ever since DNF 3.0
+landed and it became a no-op. As we have *not* been (AFAIK)
+running into any such problems, let's just drop it.
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ pyanaconda/payload/dnfpayload.py | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/pyanaconda/payload/dnfpayload.py b/pyanaconda/payload/dnfpayload.py
+index 15f4ca997..82abd388f 100644
+--- a/pyanaconda/payload/dnfpayload.py
++++ b/pyanaconda/payload/dnfpayload.py
+@@ -670,10 +670,6 @@ class DNFPayload(payload.PackagePayload):
+ 
+         self._base.conf.substitutions.update_from_etc(conf.installroot)
+ 
+-        # NSS won't survive the forking we do to shield out chroot during
+-        # transaction, disable it in RPM:
+-        conf.tsflags.append('nocrypto')
+-
+         if self.data.packages.multiLib:
+             conf.multilib_policy = "all"
+ 
+-- 
+2.19.0
+
diff --git a/anaconda.spec b/anaconda.spec
index 67d187c..2bd3a15 100644
--- a/anaconda.spec
+++ b/anaconda.spec
@@ -7,7 +7,7 @@
 Summary: Graphical system installer
 Name:    anaconda
 Version: 30.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+ and MIT
 Group:   Applications/System
 URL:     http://fedoraproject.org/wiki/Anaconda
@@ -18,6 +18,10 @@ URL:     http://fedoraproject.org/wiki/Anaconda
 # ./autogen.sh
 # make dist
 Source0: %{name}-%{version}.tar.bz2
+# Fix DNF 3.6 compat
+# https://github.com/rhinstaller/anaconda/pull/1627
+# https://bugzilla.redhat.com/show_bug.cgi?id=1595917
+Patch0: 0001-Drop-attempt-to-add-nocrypto-to-tsflags.patch
 
 # Versions of required components (done so we make sure the buildrequires
 # match the requires versions of things).
@@ -251,6 +255,7 @@ runtime on NFS/HTTP/FTP servers or local disks.
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 # use actual build-time release number, not tarball creation time release number
@@ -348,6 +353,9 @@ update-desktop-database &> /dev/null || :
 %{_prefix}/libexec/anaconda/dd_*
 
 %changelog
+* Wed Sep 26 2018 Adam Williamson <awilliam@redhat.com> - 30.3-2
+- Backport #1627 to fix DNF 3.6 compat (#1595917)
+
 * Tue Sep 11 2018 Martin Kolman <mkolman@redhat.com> - 30.3-1
 - Save lsblk output to the Anaconda traceback file (vtrefny)
 - Remove librepo imports from Anaconda (#1626609) (jkonecny)