diff --git a/gnutls.spec b/gnutls.spec
index fb4877e..46ef5a6 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -1,6 +1,6 @@
 # This spec file has been automatically updated
 Version:	3.7.1
-Release: 3%{?dist}
+Release: 4%{?dist}
 Patch1:	gnutls-3.6.7-no-now-guile.patch
 Patch2:	gnutls-3.2.7-rpath.patch
 Patch3:	gnutls-3.7.1-aggressive-realloc-fixes.patch
@@ -13,6 +13,7 @@ Patch3:	gnutls-3.7.1-aggressive-realloc-fixes.patch
 %bcond_without guile
 %bcond_without fips
 %endif
+%bcond_with tpm12
 
 Summary: A TLS protocol implementation
 Name: gnutls
@@ -25,7 +26,9 @@ BuildRequires: automake, autoconf, gperf, libtool, texinfo
 BuildRequires: autogen-libopts-devel >= 5.18, autogen
 %endif
 BuildRequires: nettle-devel >= 3.5.1
+%if %{with tpm12}
 BuildRequires: trousers-devel >= 0.3.11.2
+%endif
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
 BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++
@@ -40,7 +43,9 @@ Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
 Requires: nettle >= 3.4.1
+%if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
+%endif
 
 %if %{with dane}
 BuildRequires: unbound-devel unbound-libs
@@ -186,7 +191,11 @@ export GUILD
            --disable-non-suiteb-curves \
            --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \
            --with-default-trust-store-pkcs11="pkcs11:" \
+%if %{with tpm12}
+           --without-tpm \
+%else
            --with-trousers-lib=%{_libdir}/libtspi.so.1 \
+%endif
            --htmldir=%{_docdir}/manual \
 %if %{with guile}
            --enable-guile \
@@ -262,7 +271,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
 %files utils
 %defattr(-,root,root,-)
 %{_bindir}/certtool
+%if %{with tpm12}
 %{_bindir}/tpmtool
+%endif
 %{_bindir}/ocsptool
 %{_bindir}/psktool
 %{_bindir}/p11tool
@@ -291,6 +302,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
 %endif
 
 %changelog
+* Thu May 27 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-4
+- Disable TPM support by default (#1927370)
+
 * Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-3
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937