diff --git a/0019-FIPS-Force-fips-provider-on.patch b/0019-FIPS-Force-fips-provider-on.patch
index f8b7415..afb8550 100644
--- a/0019-FIPS-Force-fips-provider-on.patch
+++ b/0019-FIPS-Force-fips-provider-on.patch
@@ -51,6 +51,8 @@ index f2e76ac402..a2a8a9942c 100644
 +        OSSL_LIB_CTX *libctx = NCONF_get0_libctx((CONF *)cnf);
 +#  define FIPS_LOCAL_CONF           OPENSSLDIR "/fips_local.cnf"
 +
++        if (EVP_default_properties_enable_fips(libctx, 1) != 1)
++            return 0;
 +        if (access(FIPS_LOCAL_CONF, R_OK) == 0) {
 +            CONF *fips_conf = NCONF_new_ex(libctx, NCONF_default());
 +            if (NCONF_load(fips_conf, FIPS_LOCAL_CONF, NULL) <= 0)
@@ -67,8 +69,6 @@ index f2e76ac402..a2a8a9942c 100644
 +        }
 +        if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1)
 +            return 0;
-+        if (EVP_default_properties_enable_fips(libctx, 1) != 1)
-+            return 0;
 +    }
 +
      return 1;
diff --git a/openssl.spec b/openssl.spec
index 300e9a8..13f5b70 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
 Version: 3.5.7
-Release: 2%{?dist}
+Release: 3%{?dist}
 Epoch: 1
 Source0: openssl-%{version}.tar.gz
 Source1: fips-hmacify.sh
@@ -460,6 +460,11 @@ touch $RPM_BUILD_ROOT/%{_prefix}/include/openssl/engine.h
 %ldconfig_scriptlets libs
 
 %changelog
+* Thu Aug 13 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.7-3
+- In FIPS mode when neither FIPS provider nor FIPS provider configuration is
+  present, OpenSSL silently falls back to the default provider.
+  Resolves: RHEL-213740
+
 * Tue Jul 07 2026 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.7-2
 - Backport https://github.com/openssl/openssl/pull/31818
   Resolves: RHEL-192992