diff --git a/SOURCES/0001-EL9-sqlite-upsert-and-perl532-signatures.patch b/SOURCES/0001-EL9-sqlite-upsert-and-perl532-signatures.patch
new file mode 100644
index 0000000..5478952
--- /dev/null
+++ b/SOURCES/0001-EL9-sqlite-upsert-and-perl532-signatures.patch
@@ -0,0 +1,38 @@
+--- a/b/lib/OpenQA/CacheService/Model/Cache.pm	2026-06-04 10:30:53.000000000 +0200
++++ b/lib/OpenQA/CacheService/Model/Cache.pm	2026-07-21 19:12:03.848668944 +0200
+@@ -182,13 +182,13 @@
+ }
+ 
+ sub _update_metric ($self, $name, $value) {
+-    $self->_exclusive_query(q{INSERT INTO metrics (name, value) VALUES ($1, $2) ON CONFLICT DO UPDATE SET value = $2},
++    $self->_exclusive_query(q{INSERT INTO metrics (name, value) VALUES ($1, $2) ON CONFLICT(name) DO UPDATE SET value = $2},
+         $name, $value);
+ }
+ 
+ sub _increase_metric ($self, $name, $by_value) {
+     $self->_exclusive_query(
+-        q{INSERT INTO metrics (name, value) VALUES ($1, $2) ON CONFLICT DO UPDATE SET value = value + $2},
++        q{INSERT INTO metrics (name, value) VALUES ($1, $2) ON CONFLICT(name) DO UPDATE SET value = value + $2},
+         $name, $by_value);
+ }
+ 
+--- a/t/24-worker-jobs.t	2026-06-04 10:30:53.000000000 +0200
++++ b/t/24-worker-jobs.t	2026-07-21 19:12:31.186410150 +0200
+@@ -93,7 +93,7 @@
+ # Fake client and engine
+ # uncoverable statement count:1
+ package Test::FakeClient {
+-    use Mojo::Base -base;
++    use Mojo::Base -base, -signatures;
+     has worker_id => 1;
+     has service_port_delta => 2;
+     has webui_host => 'not relevant here';
+@@ -139,7 +139,7 @@
+ }    # uncoverable statement count:1
+ 
+ package Test::FakeEngine {
+-    use Mojo::Base -base;
++    use Mojo::Base -base, -signatures;
+     has pid => 1;
+     has errored => 0;
+     has is_running => 1;
diff --git a/SPECS/openqa.spec b/SPECS/openqa.spec
index d239fa9..be18303 100644
--- a/SPECS/openqa.spec
+++ b/SPECS/openqa.spec
@@ -55,18 +55,19 @@
 # The following line is generated from dependencies.yaml (upstream)
 %define common_requires chrony perl-interpreter >= 5.20.0 perl(Carp::Always) >= 0.14.02 perl(Config::IniFiles) perl(Cpanel::JSON::XS) >= 4.09 perl(Cwd) perl(Data::Dump) perl(Data::Dumper) perl(Digest::MD5) perl(Feature::Compat::Try) perl(Filesys::Df) perl(Getopt::Long) perl(HTTP::Status) perl(Minion) >= 10.25 perl(Mojolicious) >= 9.34 perl(Regexp::Common) perl(Storable) perl(Text::Glob) perl(Time::Moment)
 # Diff from SUSE: we package bsdcat and bsdtar separately
-# AlmaLinux/EL9: only bsdtar is packaged (no /usr/bin/bsdcat on EL9), so
-# bsdcat is dropped -- matching the old 4.6 packaging.
+# AlmaLinux/EL9: bsdcat is not shipped in the stock repos, but OpenQA::Downloader
+# invokes it to decompress raw assets, so it is required; provide it by rebuilding
+# the libarchive bsdcat subpackage (RHEL builds but does not ship it).
 # runtime requirements for the main package that are not required by other sub-packages
 # The following line is generated from dependencies.yaml (upstream)
-%define main_requires %assetpack_requires bsdtar git-core hostname openssh-clients perl(BSD::Resource) perl(Carp) perl(CommonMark) perl(DBD::Pg) >= 3.7.4 perl(DBI) >= 1.632 perl(DBIx::Class) >= 0.082801 perl(DBIx::Class::DeploymentHandler) perl(DBIx::Class::DynamicDefault) perl(DBIx::Class::OptimisticLocking) perl(DBIx::Class::ResultClass::HashRefInflator) perl(DBIx::Class::Schema::Config) perl(DBIx::Class::Storage::Statistics) perl(Date::Format) perl(DateTime) perl(DateTime::Duration) perl(DateTime::Format::Pg) perl(Exporter) perl(Fcntl) perl(File::Basename) perl(File::Copy) perl(File::Copy::Recursive) perl(File::Path) perl(File::Spec) perl(FindBin) perl(Getopt::Long::Descriptive) perl(IO::Handle) perl(IPC::Run) perl(JSON::Validator) perl(LWP::UserAgent) perl(Module::Load::Conditional) perl(Module::Pluggable) perl(Mojo::Base) perl(Mojo::ByteStream) perl(Mojo::IOLoop) perl(Mojo::JSON) perl(Mojo::Pg) perl(Mojo::RabbitMQ::Client) >= 0.2 perl(Mojo::URL) perl(Mojo::Util) perl(Mojolicious::Commands) perl(Mojolicious::Plugin) perl(Mojolicious::Plugin::OAuth2) perl(Mojolicious::Static) perl(Net::OpenID::Consumer) perl(POSIX) perl(Pod::POM) perl(SQL::Translator) perl(Scalar::Util) perl(Sort::Versions) perl(Text::Diff) perl(Time::HiRes) perl(Time::ParseDate) perl(Time::Piece) perl(Time::Seconds) perl(URI::Escape) perl(YAML::PP) >= 0.026 perl(YAML::XS) perl(aliased) perl(base) perl(constant) perl(diagnostics) perl(strict) perl(warnings)
+%define main_requires %assetpack_requires bsdcat bsdtar git-core hostname openssh-clients perl(BSD::Resource) perl(Carp) perl(CommonMark) perl(DBD::Pg) >= 3.7.4 perl(DBI) >= 1.632 perl(DBIx::Class) >= 0.082801 perl(DBIx::Class::DeploymentHandler) perl(DBIx::Class::DynamicDefault) perl(DBIx::Class::OptimisticLocking) perl(DBIx::Class::ResultClass::HashRefInflator) perl(DBIx::Class::Schema::Config) perl(DBIx::Class::Storage::Statistics) perl(Date::Format) perl(DateTime) perl(DateTime::Duration) perl(DateTime::Format::Pg) perl(Exporter) perl(Fcntl) perl(File::Basename) perl(File::Copy) perl(File::Copy::Recursive) perl(File::Path) perl(File::Spec) perl(FindBin) perl(Getopt::Long::Descriptive) perl(IO::Handle) perl(IPC::Run) perl(JSON::Validator) perl(LWP::UserAgent) perl(Module::Load::Conditional) perl(Module::Pluggable) perl(Mojo::Base) perl(Mojo::ByteStream) perl(Mojo::IOLoop) perl(Mojo::JSON) perl(Mojo::Pg) perl(Mojo::RabbitMQ::Client) >= 0.2 perl(Mojo::URL) perl(Mojo::Util) perl(Mojolicious::Commands) perl(Mojolicious::Plugin) perl(Mojolicious::Plugin::OAuth2) perl(Mojolicious::Static) perl(Net::OpenID::Consumer) perl(POSIX) perl(Pod::POM) perl(SQL::Translator) perl(Scalar::Util) perl(Sort::Versions) perl(Text::Diff) perl(Time::HiRes) perl(Time::ParseDate) perl(Time::Piece) perl(Time::Seconds) perl(URI::Escape) perl(YAML::PP) >= 0.026 perl(YAML::XS) perl(aliased) perl(base) perl(constant) perl(diagnostics) perl(strict) perl(warnings)
 # The following line is generated from dependencies.yaml (upstream)
 %define client_requires curl git-core jq perl(Getopt::Long::Descriptive) perl(IO::Socket::SSL) >= 2.009 perl(IPC::Run) perl(JSON::Validator) perl(LWP::Protocol::https) perl(LWP::UserAgent) perl(Test::More) perl(YAML::PP) >= 0.020 perl(YAML::XS)
 # Diff from SUSE 1: case (they have openQA-client, we have openqa-client)
 # Diff from SUSE 2: we have 'sqlite' not 'sqlite3'
 # Diff from SUSE 3: we package bsdcat and bsdtar separately
 # The following line is generated from dependencies.yaml (upstream)
-%define worker_requires bsdtar openqa-client optipng os-autoinst perl(Capture::Tiny) perl(File::Map) perl(Minion::Backend::SQLite) >= 5.0.7 perl(Mojo::IOLoop::ReadWriteProcess) >= 0.26 perl(Mojo::SQLite) psmisc sqlite >= 3.24.0
+%define worker_requires bsdcat bsdtar openqa-client optipng os-autoinst perl(Capture::Tiny) perl(File::Map) perl(Minion::Backend::SQLite) >= 5.0.7 perl(Mojo::IOLoop::ReadWriteProcess) >= 0.26 perl(Mojo::SQLite) psmisc sqlite >= 3.24.0
 # Diff from SUSE: we don't have perl(MCP) packaged currently
 # The following line is generated from dependencies.yaml (upstream)
 %define mcp_requires %{nil}
@@ -152,6 +153,11 @@ Patch:          0001-t-Skip-earlier-in-tests_dependencies.t.patch
 # https://github.com/os-autoinst/openQA/pull/7509
 # Support invent.kde.org as a bug tracker (for bug links)
 Patch:          0001-fix-Support-invent.kde.org-and-work_items-in-bug-URL.patch
+# AlmaLinux/EL9: give the cache-service metrics upsert an explicit ON CONFLICT
+# target (EL9 SQLite 3.34 rejects target-less DO UPDATE), and enable -signatures
+# on the fake worker packages in t/24-worker-jobs.t (EL9 Perl 5.32 warns that
+# sub signatures are experimental).
+Patch:          0001-EL9-sqlite-upsert-and-perl532-signatures.patch
 
 BuildRequires: make
 BuildRequires:  %{python_scripts_requires}