diff --git a/cups.spec b/cups.spec
index 6249282..45191ce 100644
--- a/cups.spec
+++ b/cups.spec
@@ -7,6 +7,13 @@
 # but we use lib for compatibility with 3rd party drivers (at upstream request).
 %global cups_serverbin %{_exec_prefix}/lib/cups
 
+# we still need something for python2...
+%if 0%{?rhel} >= 8 || 0%{?fedora}
+%bcond_without python3
+%else
+%bcond_with python3
+%endif
+
 #%%global prever rc1
 #%%global VERSION %%{version}%%{prever}
 %global VERSION %{version}
@@ -15,7 +22,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.4.6
-Release: 4%{?dist}
+Release: 5%{?dist}
 # backend/failover.c - BSD-3-Clause
 # cups/md5* - Zlib
 # scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@@ -33,7 +40,7 @@ Source1: cupsprinter.png
 Source2: macros.cups
 # upgrade script for CUPS-Get-Document fix
 # remove after Fedora 40 is EOL and C10S is released
-Source3: upgrade_get_document.py
+Source3: upgrade_get_document.py.in
 
 # PAM enablement, very old patch, not even git can track when or why
 # the patch was added.
@@ -476,6 +483,13 @@ s:.*\('%{_datadir}'/\)\([^/_]\+\)\(.*\.po$\):%lang(\2) \1\2\3:
 # C10S is released and Fedora 40 is EOL
 install -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/upgrade_get_document
 
+# adjust shebang for old python2 if needed - remove once C10S is released and F40 EOL
+%if %{with python3}
+  sed -i 's,@PYTHON_SHEBANG@,#!/usr/bin/python3,' %{buildroot}%{_sbindir}/upgrade_get_document
+%else
+  sed -i 's,@PYTHON_SHEBANG@,#!/usr/bin/python,' %{buildroot}%{_sbindir}/upgrade_get_document
+%endif
+
 %post
 # remove after CentOS Stream 10 is released
 # Require authentication for accessing /admin location
@@ -778,6 +792,9 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man7/ippeveps.7.gz
 
 %changelog
+* Mon Aug 14 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.6-5
+- comply the upgrade script with python2 as well if needed
+
 * Thu Aug 10 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.6-4
 - add upgrade script for setting authentication for CUPS-Get-Document operation
 
diff --git a/upgrade_get_document.py b/upgrade_get_document.py.in
similarity index 96%
rename from upgrade_get_document.py
rename to upgrade_get_document.py.in
index 7e54594..91d393f 100755
--- a/upgrade_get_document.py
+++ b/upgrade_get_document.py.in
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+@PYTHON_SHEBANG@
 
 """
 Upgrade script to enable authentication for CUPS-Get-Document in
@@ -18,7 +18,7 @@ def get_cupsd_conf():
         return None
 
     lines = []
-    with open('/etc/cups/cupsd.conf', encoding="utf-8") as conf:
+    with open('/etc/cups/cupsd.conf', 'r') as conf:
         lines = conf.readlines()
 
     return lines
@@ -152,7 +152,7 @@ def apply_changes(lines):
     if not os.path.exists('/etc/cups/cupsd.conf.rpmsave'):
         copy('/etc/cups/cupsd.conf', '/etc/cups/cupsd.conf.rpmsave')
 
-    with open('/etc/cups/cupsd.conf', 'w', encoding='utf-8') as conf:
+    with open('/etc/cups/cupsd.conf', 'w') as conf:
         conf.writelines(lines)