diff --git a/bind.spec b/bind.spec
index bf98af4..0923b7a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -13,23 +13,16 @@
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
-%bcond_without PKCS11
+%bcond_with PKCS11
 %bcond_without JSON
-%bcond_without DLZ
+%bcond_with DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
-%if 0%{?fedora} >= 28
-# Disabled temporarily until kyua is fixed on rawhide, bug #1926779
-%bcond_with UNITTEST
-%bcond_without DNSTAP
-%bcond_without LMDB
-%bcond_without DOC
-%else
+# kyua no longer in buildroot in RHEL9
 %bcond_with    UNITTEST
 %bcond_with    DNSTAP
 %bcond_with    LMDB
 %bcond_with    DOC
-%endif
 # Because of issues with PDF rebuild, include only HTML pages
 %bcond_with    DOCPDF
 %bcond_with    TSAN
@@ -62,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.15
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1138,6 +1131,9 @@ fi;
 %endif
 
 %changelog
+* Thu Jun 24 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.15-3
+- Disable building of DLZ and PKCS11
+
 * Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 32:9.16.15-2
 - Rebuilt for RHEL 9 BETA for openssl 3.0
   Related: rhbz#1971065