diff --git a/libica-3.8.0-configure.patch b/libica-3.8.0-configure.patch
new file mode 100644
index 0000000..d157510
--- /dev/null
+++ b/libica-3.8.0-configure.patch
@@ -0,0 +1,67 @@
+From a70dfe13b7dd2914ad29175ae026284bd5461e0e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
+Date: Mon, 24 May 2021 12:21:55 +0000
+Subject: [PATCH] fix handling of --disable-foo options
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Currently passing eg. --disable-debug actually enables the debug build
+as one would expect from --enable-debug. The fix is to omit setting the
+enable_foo variable as the "action-if-given" parameter of AC_ARG_ENABLE,
+because it handles both the --enable and --disable forms.
+
+Signed-off-by: Dan Horák <dan@danny.cz>
+---
+ configure.ac | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index ae6370c..9dc4786 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -35,7 +35,7 @@ FLAGS="-Wall -Wextra -mzarch"
+ dnl --- enable_debug
+ AC_ARG_ENABLE(debug,
+               [  --enable-debug          turn on debugging flags],
+-              [enable_debug="yes"],[enable_debug="no"])
++              [],[enable_debug="no"])
+ AM_CONDITIONAL(DEBUG, test x$enable_debug = xyes)
+ 
+ if test "x$enable_debug" = xyes; then
+@@ -46,7 +46,7 @@ fi
+ dnl --- enable_coverage
+ AC_ARG_ENABLE(coverage,
+               [  --enable-coverage       turn on coverage testing],
+-              [enable_coverage="yes"],[enable_coverage="no"])
++              [],[enable_coverage="no"])
+ AM_CONDITIONAL(COVERAGE, test x$enable_coverage = xyes)
+ 
+ if test "x$enable_coverage" = xyes; then
+@@ -57,7 +57,7 @@ fi
+ dnl --- enable_fips
+ AC_ARG_ENABLE(fips,
+               [  --enable-fips           built with FIPS mode support],
+-              [enable_fips="yes"],[enable_fips="no"])
++              [],[enable_fips="no"])
+ AM_CONDITIONAL(ICA_FIPS, test x$enable_fips = xyes)
+ 
+ if test "x$enable_fips" = xyes; then
+@@ -74,7 +74,7 @@ fi
+ dnl --- enable_sanitizer
+ AC_ARG_ENABLE(sanitizer,
+               [  --enable-sanitizer      turn on sanitizer (may not work on all systems)],
+-              [enable_sanitizer="yes"],[enable_sanitizer="no"])
++              [],[enable_sanitizer="no"])
+ AM_CONDITIONAL(SANITIZER, test x$enable_sanitizer = xyes)
+ 
+ if test "x$enable_sanitizer" = xyes; then
+@@ -86,7 +86,7 @@ fi
+ dnl --- enable_internal tests
+ AC_ARG_ENABLE(internal_tests,
+               [  --enable-internal-tests built internal tests],
+-              [enable_internal_tests="yes"],[enable_internal_tests="no"])
++              [],[enable_internal_tests="no"])
+ AM_CONDITIONAL(ICA_INTERNAL_TESTS, test x$enable_internal_tests = xyes)
+ 
+ if test "x$enable_internal_tests" = xyes; then
diff --git a/libica.spec b/libica.spec
index 1f7c480..cd09742 100644
--- a/libica.spec
+++ b/libica.spec
@@ -1,7 +1,9 @@
+%global with_fips 1
+
 Summary: Library for accessing ICA hardware crypto on IBM z Systems
 Name: libica
 Version: 3.8.0
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: CPL
 URL: https://github.com/opencryptoki/
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -9,6 +11,8 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630582
 # https://github.com/opencryptoki/libica/pull/24
 Patch0: %{name}-3.8.0-annotate.patch
+# https://github.com/opencryptoki/libica/commit/a70dfe13b7dd2914ad29175ae026284bd5461e0e
+Patch1: %{name}-3.8.0-configure.patch
 BuildRequires: gcc
 BuildRequires: openssl-devel
 BuildRequires: openssl
@@ -44,7 +48,12 @@ sh ./bootstrap.sh
 
 
 %build
-%configure --disable-static --enable-fips
+%configure --disable-static \
+%if %{with_fips}
+    --enable-fips
+%else
+    --disable-fips
+%endif
 %make_build
 
 
@@ -67,8 +76,10 @@ fi
 %{_bindir}/icainfo
 %{_bindir}/icainfo-cex
 %{_bindir}/icastats
+%if %{with_fips}
 %{_libdir}/.libica.*.hmac
 %{_libdir}/.libica-cex.*.hmac
+%endif
 %{_libdir}/libica.so.*
 %{_libdir}/libica-cex.so.*
 %{_mandir}/man1/icainfo.1*
@@ -82,6 +93,9 @@ fi
 
 
 %changelog
+* Mon May 24 2021 Dan Horák <dan[at]danny.cz> - 3.8.0-2
+- conditionalize FIPS support
+
 * Fri May 21 2021 Dan Horák <dan[at]danny.cz> - 3.8.0-1
 - updated to 3.8.0