diff --git a/dovecot-2.3.11-bigkey.patch b/dovecot-2.3.11-bigkey.patch
new file mode 100644
index 0000000..c5b23d9
--- /dev/null
+++ b/dovecot-2.3.11-bigkey.patch
@@ -0,0 +1,10 @@
+diff -up dovecot-2.2.36/doc/dovecot-openssl.cnf.bigkey dovecot-2.2.36/doc/dovecot-openssl.cnf
+--- dovecot-2.2.36/doc/dovecot-openssl.cnf.bigkey	2017-06-23 13:18:28.000000000 +0200
++++ dovecot-2.2.36/doc/dovecot-openssl.cnf	2018-10-16 17:15:35.836205498 +0200
+@@ -1,5 +1,5 @@
+ [ req ]
+-default_bits = 1024
++default_bits = 3072
+ encrypt_key = yes
+ distinguished_name = req_dn
+ x509_extensions = cert_type
diff --git a/dovecot.spec b/dovecot.spec
index a169e8d..dac9610 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -5,7 +5,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.3.11.3
 %global prever %{nil}
-Release: 5%{?dist}
+Release: 7%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT and LGPLv2
 
@@ -35,6 +35,7 @@ Patch10: dovecot-2.3.0.1-libxcrypt.patch
 Patch12: dovecot-2.3.11.3-ftbfs1.patch
 Patch13: dovecot-2.3.11.3-ftbfs2.patch
 Patch14: dovecot-2.3.11.3-gssapi.patch
+Patch15: dovecot-2.3.11-bigkey.patch
 
 Source15: prestartscript
 
@@ -50,6 +51,7 @@ BuildRequires: quota-devel
 BuildRequires: xz-devel
 BuildRequires: lz4-devel
 BuildRequires: libzstd-devel
+BuildRequires: libsodium-devel
 BuildRequires: libicu-devel
 BuildRequires: libexttextcat-devel
 BuildRequires: libstemmer-devel
@@ -73,6 +75,7 @@ BuildRequires: clucene-core-devel
 %global ssldir %{_sysconfdir}/pki/%{name}
 
 BuildRequires: libcurl-devel expat-devel
+BuildRequires: make
 
 %global restart_flag /run/%{name}/%{name}-restart-after-rpm-install
 
@@ -121,6 +124,7 @@ This package provides the development files for dovecot.
 %patch12 -p1 -b .ftbfs1
 %patch13 -p1 -b .ftbfs2
 %patch14 -p1 -b .gssapi
+%patch15 -p1 -b .bigkey
 
 #pushd dovecot-2*3-pigeonhole-%{pigeonholever}
 #popd
@@ -138,6 +142,7 @@ mkdir -p m4
 autoreconf -I . -fiv #required for aarch64 support
 %configure                       \
     INSTALL_DATA="install -c -p -m644" \
+    --localstatedir=%{_rundir}   \
     --docdir=%{_docdir}/%{name}  \
     --disable-static             \
     --disable-rpath              \
@@ -444,6 +449,12 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Wed Oct 21 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.11.3-7
+- change run directory from /var/run to /run (#1777922)
+
+* Wed Oct 21 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.11.3-6
+- use bigger default key size (#1882939)
+
 * Wed Sep 02 2020 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.11.3-5
 - fix gssapi issue