diff --git a/keylime-agent-rust.spec b/keylime-agent-rust.spec
index fa69edc..beb27b5 100644
--- a/keylime-agent-rust.spec
+++ b/keylime-agent-rust.spec
@@ -8,6 +8,7 @@
 %if 0%{?rhel}
 # RHEL: Use bundled deps as it doesn't ship Rust libraries
 %global bundled_rust_deps 1
+%global __brp_mangle_shebangs_exclude_from ^/usr/src/debug/.*$
 %else
 # Fedora: Use only system Rust libraries
 %global bundled_rust_deps 0
@@ -52,10 +53,14 @@ Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz
 #       --exclude-crate-path "libloading#tests"
 #   tar jcf rust-keylime-%%{version}-vendor.tar.xz vendor
 Source1:        rust-keylime-%{version}-vendor.tar.xz
+## Patches for building from system Rust libraries (Fedora)
 # Fix version requirement for clap to avoid FTBFS in Fedora
 Patch1:         rust-keylime-metadata.patch
 # Use API available on rust-config-0.12.0
 Patch2:         rust-keylime-config-separator.patch
+## Patches for building from bundled Rust libraries (RHEL)
+# Build tss-esapi extension from source (upstream commit)
+Patch100:       rust-keylime-metadata-bundled.patch
 
 ExclusiveArch:  %{rust_arches}
 
@@ -72,6 +77,8 @@ BuildRequires:  openssl-devel
 BuildRequires:  libarchive-devel
 BuildRequires:  tpm2-tss-devel
 %if 0%{?bundled_rust_deps}
+BuildRequires:  clang
+BuildRequires:  pkgconfig(libzmq) >= 4.1
 BuildRequires:  rust-toolset
 %else
 BuildRequires:  rust-packaging >= 21-2
@@ -85,11 +92,13 @@ Conflicts:      keylime-agent
 Rust agent for Keylime
 
 %prep
-%autosetup -n rust-keylime-%{version} -p1
+%autosetup -n rust-keylime-%{version} -N
 %if 0%{?bundled_rust_deps}
+%autopatch -m 100 -p1
 # Source1 is vendored dependencies
 %cargo_prep -V 1
 %else
+%autopatch -M 99 -p1
 %cargo_prep
 %generate_buildrequires
 %cargo_generate_buildrequires
diff --git a/rust-keylime-metadata-bundled.patch b/rust-keylime-metadata-bundled.patch
new file mode 100644
index 0000000..4150824
--- /dev/null
+++ b/rust-keylime-metadata-bundled.patch
@@ -0,0 +1,11 @@
+--- a/Cargo.toml	2022-11-01 11:14:11.349498931 +0100
++++ b/Cargo.toml	2022-11-01 14:22:01.934115151 +0100
+@@ -42,7 +42,7 @@
+ tempfile = "3.0.4"
+ tokio = {version = "1.13.1", features = ["full"]}
+ toml = "0.5"
+-tss-esapi = "7.1.0"
++tss-esapi = {version = "7.1.0", features = ["generate-bindings"]}
+ thiserror = "1.0"
+ uuid = {version = "0.8", features = ["v4"]}
+ zmq = {version = "0.9.2", optional = true}
diff --git a/sources b/sources
index 8185213..85832d4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (v0.1.0.tar.gz) = 204e5cdf0901d237ed22f5265ce8c9f4c13d7d8ad4c1b64419a469213d88e584f0555f6edfbf7aa9346d2e3a86d8f7f0a0d5056a3e0ab0dfe5d170f8910fc7cf
-SHA512 (rust-keylime-0.1.0-vendor.tar.xz) = e19fccc9e0f05a9dbcc2e2bae509724b5457031765527222497d5e301b096e9a606827a4ecadff56ec6bb2c122c8c643ef310717c3a4b84c578ad219dd36cd57
+SHA512 (rust-keylime-0.1.0-vendor.tar.xz) = 469726ac4176e8bab93620293402422fe8da794773fcdbff722a5e4ef7a7377008996b002e2a260012052aa59c127de94572e8d11b25d5daa46052c5a74d9ec3