diff --git a/libreswan-5.1-whack-ctlsocket.patch b/libreswan-5.1-whack-ctlsocket.patch
new file mode 100644
index 0000000..6019302
--- /dev/null
+++ b/libreswan-5.1-whack-ctlsocket.patch
@@ -0,0 +1,26 @@
+From 43e5255728845f9314049a20644fc19a745cde81 Mon Sep 17 00:00:00 2001
+From: Tuomo Soini <tis@foobar.fi>
+Date: Fri, 11 Oct 2024 18:28:24 +0300
+Subject: [PATCH] ipsec: fix duplicate --ctlsocket option for whack
+
+github issue: whack error: duplicated flag ctlsocket #1840
+---
+ programs/ipsec/ipsec.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
+index 1510d238d0..fbceac682b 100755
+--- a/programs/ipsec/ipsec.in
++++ b/programs/ipsec/ipsec.in
+@@ -1203,7 +1203,7 @@ while [ ${#} -gt 0 ]; do
+ 	    # We need to make sure we don't give it twice
+ 	    shift
+ 	    case " ${@} " in
+-		--ctlsocket)
++		*" --ctlsocket "*)
+ 		    exec ${dry_run} "${IPSEC_EXECDIR}/whack" "${@}"
+ 		    ;;
+ 		*)
+-- 
+2.48.1
+
diff --git a/libreswan.spec b/libreswan.spec
index 4816959..83ace66 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -48,6 +48,7 @@ Patch1: libreswan-4.15-ipsec_import.patch
 Patch2: libreswan-5.1-rereadsecrets.patch
 Patch3: libreswan-5.1-opt-protoport.patch
 Patch4: libreswan-5.1-pexpect-negotiating-ike-sa.patch
+Patch5: libreswan-5.1-whack-ctlsocket.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison