diff --git a/gnupg2-aead.patch b/gnupg2-aead.patch
new file mode 100644
index 0000000..acb60d1
--- /dev/null
+++ b/gnupg2-aead.patch
@@ -0,0 +1,13 @@
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 6106d98ba..945494a8b 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -568,7 +568,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 		    for (i=0; i<naead; i++)
+ 		      {
+ 			opt.personal_aead_prefs[i].type = PREFTYPE_AEAD;
+-			opt.personal_aead_prefs[i].value = sym[i];
++			opt.personal_aead_prefs[i].value = aead[i];
+ 		      }
+ 
+ 		    opt.personal_aead_prefs[i].type = PREFTYPE_NONE;
diff --git a/gnupg2.spec b/gnupg2.spec
index bdbe0e6..fdad032 100644
--- a/gnupg2.spec
+++ b/gnupg2.spec
@@ -27,6 +27,8 @@ Patch21: gnupg-2.2.18-gpg-allow-import-of-previously-known-keys-even-without-UI.
 Patch22: gnupg-2.2.18-gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
 # Fixes for issues found in Coverity scan - reported upstream
 Patch30: gnupg-2.2.21-coverity.patch
+# https://dev.gnupg.org/T6019
+Patch31: gnupg2-aead.patch
 
 
 URL:     https://www.gnupg.org/
@@ -50,6 +52,8 @@ BuildRequires: gnutls-devel
 BuildRequires: sqlite-devel
 BuildRequires: fuse
 BuildRequires: make
+# for tests
+BuildRequires: openssh-clients
 
 Requires: libgcrypt >= 1.7.0
 Requires: libgpg-error >= 1.38
@@ -109,6 +113,7 @@ to the base GnuPG package
 %patch22 -p1 -b .good_revoc
 
 %patch30 -p1 -b .coverity
+%patch31 -p1 -b .aead
 
 # pcsc-lite library major: 0 in 1.2.0, 1 in 1.2.9+ (dlopen()'d in pcsc-wrapper)
 # Note: this is just the name of the default shared lib to load in scdaemon,