diff --git a/openssh-9.3p1-upstream-cve-2023-38408.patch b/openssh-9.3p1-upstream-cve-2023-38408.patch
index 43d97bc..d6498b1 100644
--- a/openssh-9.3p1-upstream-cve-2023-38408.patch
+++ b/openssh-9.3p1-upstream-cve-2023-38408.patch
@@ -112,14 +112,12 @@ diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
 index 0b51e7753882..8e2b9cb97310 100644
 --- a/ssh-pkcs11.c
 +++ b/ssh-pkcs11.c
-@@ -1532,15 +1532,17 @@ pkcs11_register_provider(char *provider_id, char *pin,
+@@ -1532,15 +1532,15 @@ pkcs11_register_provider(char *provider_id, char *pin,
  		m->refcount++;
  	}
  
-+	if (lib_contains_symbol(provider_module, "C_GetFunctionList") != 0) {
-+		error("provider %s is not a PKCS11 library", provider_module);
-+		goto fail;
-+	}
++	if (lib_contains_symbol(provider_module, "C_GetFunctionList") != 0)
++		fatal("provider %s is not a PKCS11 library", provider_module);
  	/* open shared pkcs11-library */
  	if ((handle = dlopen(provider_module, RTLD_NOW)) == NULL) {
  		error("dlopen %s failed: %s", provider_module, dlerror());
diff --git a/openssh.spec b/openssh.spec
index a81a950..8a9e2f2 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -66,7 +66,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 31
+%global openssh_rel 32
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 8
 
@@ -860,6 +860,10 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Thu Aug 20 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-32
+- Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen()
+  Related: RHEL-234763
+
 * Wed Aug 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 8.0p1-31 + 0.10.3-8
 - CVE-2026-59995: Fix sftp download to server-controlled path when
   performing download on the commandline