diff --git a/gnutls.spec b/gnutls.spec
index 4d674d3..5f4731b 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -13,7 +13,7 @@ print(string.sub(hash, 0, 16))
 }
 
 Version: 3.7.6
-Release: 21%{?dist}
+Release: 22%{?dist}
 # not upstreamed
 Patch: gnutls-3.6.7-no-now-guile.patch
 Patch: gnutls-3.2.7-rpath.patch
@@ -353,7 +353,20 @@ ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac"
 
 %check
 %if %{with tests}
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
+
+xfail_tests=
+
+# With older kernel, key installation fails if the host is x86_64 and
+# the package is built with -m32:
+%ifarch %{ix86}
+case "$(uname -r)" in
+  4.*.x86_64)
+    xfail_tests="$xfail_tests ktls.sh"
+    ;;
+esac
+%endif
+
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
 %endif
 
 %files -f gnutls.lang
@@ -407,6 +420,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
 %endif
 
 %changelog
+* Tue Jul 18 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-22
+- Skip KTLS test on old kernel if host and target arches are different
+
 * Thu Jul 13 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-21
 - Require use of extended master secret in FIPS mode by default (#2157953)