diff --git a/0014-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0014-downstream-Do-not-set-root-as-ksu-file-owner.patch
new file mode 100644
index 0000000..8c5b484
--- /dev/null
+++ b/0014-downstream-Do-not-set-root-as-ksu-file-owner.patch
@@ -0,0 +1,31 @@
+From fb13766f8fbd78acfcf7a150332a4e5474e4f52a Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 9 Jan 2023 22:39:52 +0100
+Subject: [PATCH] [downstream] Do not set root as ksu file owner
+
+Upstream Makefile uses the install command to set root as owner of the
+ksu executable file. However, this is no longer supported on latest
+versions of the Mock build environment.
+
+In case of ksu, the owner, group, and mode are already set using %attr()
+in the specfile.
+---
+ src/config/pre.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 7eaa2f351c..e9ae71471e 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+ INSTALL_SCRIPT=@INSTALL_PROGRAM@
+ INSTALL_DATA=@INSTALL_DATA@
+ INSTALL_SHLIB=@INSTALL_SHLIB@
+-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
++INSTALL_SETUID=$(INSTALL)
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+ prefix=@prefix@
+-- 
+2.38.1
+
diff --git a/krb5.spec b/krb5.spec
index c2958d9..6ce3f23 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -34,7 +34,7 @@
 #
 # baserelease is what we have standardized across Fedora and what
 # rpmdev-bumpspec knows how to handle.
-%global baserelease 1
+%global baserelease 2
 
 # This should be e.g. beta1 or %%nil
 %global pre_release %nil
@@ -96,6 +96,7 @@ Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch
 Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch
 Patch12: 0012-Add-and-use-ts_interval-helper.patch
 Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch
+Patch14: 0014-downstream-Do-not-set-root-as-ksu-file-owner.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -660,6 +661,10 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue Jan 10 2022 Julien Rische <jrische@redhat.com> - 1.20.1-2
+- Strip debugging data from ksu executable file
+- Resolves: rhbz#2159643
+
 * Wed Dec 07 2022 Julien Rische <jrische@redhat.com> - 1.20.1-1
 - Make tests compatible with sssd-client
 - Resolves: rhbz#2151513