diff --git a/gnutls-3.8.9-fips-mldsa.patch b/gnutls-3.8.9-fips-mldsa.patch
new file mode 100644
index 0000000..3e58640
--- /dev/null
+++ b/gnutls-3.8.9-fips-mldsa.patch
@@ -0,0 +1,34 @@
+From 5eec368c91f49e5c9aa6422a8ca163644807b9fd Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 25 Jun 2025 13:12:51 +0900
+Subject: [PATCH] gnutls-3.8.9-fips-mldsa.patch
+
+---
+ lib/nettle/pk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
+index cd40eb3..a352331 100644
+--- a/lib/nettle/pk.c
++++ b/lib/nettle/pk.c
+@@ -2560,7 +2560,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 	case GNUTLS_PK_MLDSA44:
+ 	case GNUTLS_PK_MLDSA65:
+ 	case GNUTLS_PK_MLDSA87:
+-#if !defined(HAVE_LEANCRYPTO) && defined(HAVE_LIBOQS)
++#if defined(HAVE_LEANCRYPTO) || defined(HAVE_LIBOQS)
+ 		/* As of liboqs 0.12.0, liboqs implementation lacks
+ 		 * sufficient checks for ML-DSA.
+ 		 */
+@@ -2939,7 +2939,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
+ 	case GNUTLS_PK_MLDSA44:
+ 	case GNUTLS_PK_MLDSA65:
+ 	case GNUTLS_PK_MLDSA87:
+-#if !defined(HAVE_LEANCRYPTO) && defined(HAVE_LIBOQS)
++#if defined(HAVE_LEANCRYPTO) || defined(HAVE_LIBOQS)
+ 		/* As of liboqs 0.12.0, liboqs implementation lacks
+ 		 * sufficient checks for ML-DSA.
+ 		 */
+-- 
+2.49.0
+
diff --git a/gnutls.spec b/gnutls.spec
index a847c82..4ade6f5 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -40,6 +40,8 @@ Patch: gnutls-3.8.9-leancrypto-init.patch
 Patch: gnutls-3.8.9-year2038-tests.patch
 # upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1938
 Patch: gnutls-3.8.9-tls-mldsa.patch
+# upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1945
+Patch: gnutls-3.8.9-fips-mldsa.patch
 
 %bcond_without bootstrap
 %bcond_without dane