diff --git a/libica-3.3.3-noexecstack.patch b/libica-3.3.3-noexecstack.patch
new file mode 100644
index 0000000..c3962b0
--- /dev/null
+++ b/libica-3.3.3-noexecstack.patch
@@ -0,0 +1,23 @@
+From 524659f8e042aed45015e1aca930a3cfe5ffa628 Mon Sep 17 00:00:00 2001
+From: Patrick Steuer <patrick.steuer@de.ibm.com>
+Date: Tue, 12 Jun 2018 14:36:45 +0200
+Subject: [PATCH] Add non-executable gnu stack markings in the assembly.
+
+Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
+---
+ src/mp.pl | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/mp.pl b/src/mp.pl
+index 3c73736..e249f61 100755
+--- a/src/mp.pl
++++ b/src/mp.pl
+@@ -505,4 +505,8 @@
+ LONG	(0x10000102,0x03040506,0x10071819,0x1a1b1c1d);
+ LONG	(0x00000000,0x00000018,0x00191a1b,0x1c1d1e1f);
+ 
++VERBATIM("#if defined(__linux__) && defined(__ELF__)\n");
++SECTION	(".note.GNU-stack,\"\",%progbits");
++VERBATIM("#endif\n");
++
+ PERLASM_END();
diff --git a/libica.spec b/libica.spec
index ac053cc..2188657 100644
--- a/libica.spec
+++ b/libica.spec
@@ -1,15 +1,16 @@
 Summary: Library for accessing ICA hardware crypto on IBM z Systems
 Name: libica
 Version: 3.3.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: CPL
 Group: System Environment/Libraries
 URL: https://github.com/opencryptoki/
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+# https://github.com/opencryptoki/libica/commit/524659f8e042aed45015e1aca930a3cfe5ffa628
+Patch0: %{name}-3.3.3-noexecstack.patch
 BuildRequires: gcc
 BuildRequires: openssl-devel
 BuildRequires: autoconf
-BuildRequires: autoconf-archive
 BuildRequires: automake
 BuildRequires: libtool
 ExclusiveArch: s390 s390x
@@ -32,7 +33,7 @@ IBM z Systems.
 
 
 %prep
-%autosetup
+%autosetup -p1
 
 sh ./bootstrap.sh
 
@@ -75,6 +76,9 @@ fi
 
 
 %changelog
+* Wed Jun 13 2018 Dan Horák <dan[at]danny.cz> - 3.3.3-2
+- fix executable stack in assembler code
+
 * Tue Jun 12 2018 Dan Horák <dan[at]danny.cz> - 3.3.3-1
 - updated to 3.3.3