diff --git a/Make-ksu-honor-KRB5CCNAME-again.patch b/Make-ksu-honor-KRB5CCNAME-again.patch
new file mode 100644
index 0000000..19f05ae
--- /dev/null
+++ b/Make-ksu-honor-KRB5CCNAME-again.patch
@@ -0,0 +1,79 @@
+From 59f2a9dd6a83a3721cdffe852343d96ffaa5c18a Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 6 Apr 2020 20:45:10 -0400
+Subject: [PATCH] Make ksu honor KRB5CCNAME again
+
+Commit d439e370b70f7af4ed2da9c692a3be7dcf7b4ac6 (ticket 8800) caused
+ksu to ignore KRB5CCNAME from the environment.  ksu uses euid
+switching to access the source cache, and should honor KRB5CCNAME to
+find the ccache to potentially authorize the su operation.
+
+Add a helper function init_ksu_context() to create the ksu context,
+with explicit code to honor KRB5CCNAME using
+krb5_cc_set_default_name().
+
+ticket: 8895
+tags: pullup
+target_version: 1.18-next
+
+(cherry picked from commit f040a3ac73947312e1b08c76f75f3389ffb4ba75)
+---
+ src/clients/ksu/main.c | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
+index 21a4d02bb..508242e0e 100644
+--- a/src/clients/ksu/main.c
++++ b/src/clients/ksu/main.c
+@@ -54,6 +54,7 @@ int force_fork = 0;
+ static int set_env_var (char *, char *);
+ static void sweep_up (krb5_context, krb5_ccache);
+ static char * ontty (void);
++static krb5_error_code init_ksu_context(krb5_context *);
+ static krb5_error_code set_ccname_env(krb5_context, krb5_ccache);
+ static void print_status( const char *fmt, ...)
+ #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7)
+@@ -135,7 +136,7 @@ main (argc, argv)
+ 
+     unsetenv ("KRB5_CONFIG");
+ 
+-    retval = krb5_init_secure_context(&ksu_context);
++    retval = init_ksu_context(&ksu_context);
+     if (retval) {
+         com_err(argv[0], retval, _("while initializing krb5"));
+         exit(1);
+@@ -878,6 +879,34 @@ main (argc, argv)
+     }
+ }
+ 
++static krb5_error_code
++init_ksu_context(krb5_context *context_out)
++{
++    krb5_error_code retval;
++    const char *env_ccname;
++    krb5_context context;
++
++    *context_out = NULL;
++
++    retval = krb5_init_secure_context(&context);
++    if (retval)
++        return retval;
++
++    /* We want to obey KRB5CCNAME in this context even though this is a setuid
++     * program.  (It will only be used when operating as the real uid.) */
++    env_ccname = getenv(KRB5_ENV_CCNAME);
++    if (env_ccname != NULL) {
++        retval = krb5_cc_set_default_name(context, env_ccname);
++        if (retval) {
++            krb5_free_context(context);
++            return retval;
++        }
++    }
++
++    *context_out = context;
++    return 0;
++}
++
+ /* Set KRB5CCNAME in the environment to point to ccache.  Print an error
+  * message on failure. */
+ static krb5_error_code
diff --git a/krb5.spec b/krb5.spec
index 9c9022c..6913a3b 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.18
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 11%{?dist}
+Release: 12%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz
@@ -59,6 +59,7 @@ Patch13: Add-finalization-safety-check-to-com_err.patch
 Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch
 Patch15: Correctly-import-service-GSS-host-based-name.patch
 Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch
+Patch17: Make-ksu-honor-KRB5CCNAME-again.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -636,6 +637,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue Apr 07 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-12
+- Make ksu honor KRB5CCNAME again
+
 * Thu Apr 02 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-11
 - Do expiration warnings for all init_creds APIs