diff --git a/0002-Make-sure-template-dictionary-has-WSGI_PREFIX_DIR-wh.patch b/0002-Make-sure-template-dictionary-has-WSGI_PREFIX_DIR-wh.patch
new file mode 100644
index 0000000..2eef556
--- /dev/null
+++ b/0002-Make-sure-template-dictionary-has-WSGI_PREFIX_DIR-wh.patch
@@ -0,0 +1,27 @@
+From ffa274fc72e0d56bca3389d3ba973459053c25f3 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Tue, 20 Mar 2018 09:35:51 +0200
+Subject: [PATCH 2/2] Make sure template dictionary has WSGI_PREFIX_DIR when
+ upgrading ipa.conf.template
+
+Fixes https://pagure.io/freeipa/issue/7454
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ ipaserver/install/server/upgrade.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
+index a38f4115c..807d674d7 100644
+--- a/ipaserver/install/server/upgrade.py
++++ b/ipaserver/install/server/upgrade.py
+@@ -1651,6 +1651,7 @@ def upgrade_configuration():
+ 
+         ds_dirname = dsinstance.config_dirname(ds_serverid)
+ 
++        sub_dict['WSGI_PREFIX_DIR'] = paths.WSGI_PREFIX_DIR
+         upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
+                      os.path.join(paths.USR_SHARE_IPA_DIR,
+                                   "ipa.conf.template"))
+-- 
+2.14.3
+
diff --git a/freeipa.spec b/freeipa.spec
index 9a928b0..09ec5fa 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -100,7 +100,7 @@
 
 Name:           freeipa
 Version:        %{VERSION}
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
@@ -109,6 +109,7 @@ URL:            https://www.freeipa.org/
 Source0:        https://releases.pagure.org/freeipa/freeipa-%{VERSION}.tar.gz
 Source1:        https://releases.pagure.org/freeipa/freeipa-%{VERSION}.tar.gz.asc
 Patch0001:      0001-Processing-of-server-roles-should-ignore-errors.Empt.patch
+Patch0002:      0002-Make-sure-template-dictionary-has-WSGI_PREFIX_DIR-wh.patch
 
 # For the timestamp trick in patch application
 BuildRequires:  diffstat
@@ -1717,6 +1718,9 @@ fi
 %endif # with_ipatests
 
 %changelog
+* Tue Mar 20 2018 Alexander Bokovoy <abokovoy@redhat.com> - 4.6.90.pre1-3
+- Fix upgrade from F27 to F28 (#1558354)
+
 * Mon Mar 19 2018 Rob Crittenden <rcritten@redhat.com> - 4.6.90.pre1-2
 - Patch to fix GUI login for non-admin users (#1557609)