diff --git a/postgresql-openssl3-tests.patch b/postgresql-openssl3-tests.patch
new file mode 100644
index 0000000..d7f16bf
--- /dev/null
+++ b/postgresql-openssl3-tests.patch
@@ -0,0 +1,26 @@
+diff -up postgresql-13.3/contrib/pgcrypto/Makefile.ssl30-tests-off postgresql-13.3/contrib/pgcrypto/Makefile
+--- postgresql-13.3/contrib/pgcrypto/Makefile.ssl30-tests-off	2021-06-29 16:08:03.203650968 +0200
++++ postgresql-13.3/contrib/pgcrypto/Makefile	2021-06-30 08:58:01.665202733 +0200
+@@ -5,7 +5,7 @@ INT_SRCS = md5.c sha1.c internal.c inter
+ INT_TESTS = sha2
+ 
+ OSSL_SRCS = openssl.c pgp-mpi-openssl.c
+-OSSL_TESTS = sha2 des 3des cast5
++OSSL_TESTS = sha2
+ 
+ ZLIB_TST = pgp-compression
+ ZLIB_OFF_TST = pgp-zlib-DISABLED
+@@ -49,11 +49,10 @@ DATA = pgcrypto--1.3.sql pgcrypto--1.2--
+ 	pgcrypto--1.0--1.1.sql
+ PGFILEDESC = "pgcrypto - cryptographic functions"
+ 
+-REGRESS = init md5 sha1 hmac-md5 hmac-sha1 blowfish rijndael \
++REGRESS = init md5 sha1 hmac-md5 hmac-sha1 \
+ 	$(CF_TESTS) \
+ 	crypt-des crypt-md5 crypt-blowfish crypt-xdes \
+-	pgp-armor pgp-decrypt pgp-encrypt $(CF_PGP_TESTS) \
+-	pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-info
++	pgp-armor $(CF_PGP_TESTS)
+ 
+ EXTRA_CLEAN = gen-rtab
+ 
diff --git a/postgresql.spec b/postgresql.spec
index bc6157c..54a5d18 100644
--- a/postgresql.spec
+++ b/postgresql.spec
@@ -63,7 +63,7 @@ Summary: PostgreSQL client programs
 Name: postgresql
 %global majorversion 13
 Version: %{majorversion}.3
-Release: 2%{?dist}
+Release: 3%{?dist}
 
 # The PostgreSQL license is very similar to other MIT licenses, but the OSI
 # recognizes it as an independent license, so we do as well.
@@ -111,6 +111,7 @@ Patch5: postgresql-var-run-socket.patch
 Patch8: postgresql-external-libpq.patch
 Patch9: postgresql-server-pg_config.patch
 Patch12: postgresql-no-libecpg.patch
+Patch13: postgresql-openssl3-tests.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -422,6 +423,7 @@ goal of accelerating analytics queries.
 %patch12 -p1
 %endif
 %patch9 -p1
+%patch13 -p1
 
 # We used to run autoconf here, but there's no longer any real need to,
 # since Postgres ships with a reasonably modern configure script.
@@ -579,12 +581,7 @@ test_failure=0
 	run_testsuite "src/test/regress"
 	make clean -C "src/test/regress"
 	run_testsuite "src/pl"
-	# FIXME: work-arounding issues with openssl 3
-	# we ignore test failures in the contrib part only
-	# see more at RHBZ#1964848
-	test_failure_save="$test_failure"
 	run_testsuite "contrib"
-	test_failure="$test_failure_save"
 %endif
 
 # "assert(ALL_TESTS_OK)"
@@ -1219,6 +1216,10 @@ make -C postgresql-setup-%{setup_version} check
 
 
 %changelog
+* Wed Jul 21 2021 Honza Horak <hhorak@redhat.com> - 13.3-3
+- Turn off tests that expectedly fail with OpenSSL 3.0.0
+  Related: #1964848
+
 * Mon Jul 19 2021 Filip Januš <fjanus@redhat.com> - 13.3-2
 - Enable SSL for upgrade server
   Resolves: #1983632