diff --git a/postgresql-pqc-ssl-groups-tests.patch b/postgresql-pqc-ssl-groups-tests.patch
new file mode 100644
index 0000000..3109b94
--- /dev/null
+++ b/postgresql-pqc-ssl-groups-tests.patch
@@ -0,0 +1,37 @@
+--- a/src/test/ssl/t/001_ssltests.pl
++++ b/src/test/ssl/t/001_ssltests.pl
+@@ -120,6 +120,22 @@
+ command_ok(
+ 	[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
+ 	'restart succeeds with correct SSL protocol bounds');
++
++# Test parsing colon-separated groups in ssl_ecdh_curve. Writing to
++# sslconfig.conf ensures these values get overwritten by the next call to
++# switch_server_cert (which truncates and rewrites sslconfig.conf).
++$node->append_conf('sslconfig.conf', qq{ssl_ecdh_curve='bad:value'});
++my $log_size = -s $node->logfile;
++command_fails(
++	[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
++	'restart fails with incorrect ECDH groups');
++ok( $node->log_contains(
++		qr/ECDH: could not set group names from ssl_ecdh_curve/, $log_size),
++	'error message mentions ssl_ecdh_curve');
++$node->append_conf('sslconfig.conf', qq{ssl_ecdh_curve='prime256v1'});
++command_ok(
++	[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
++	'restart succeeds after correcting ssl_ecdh_curve');
+ 
+ ### Run client-side tests.
+ ###
+
+--- a/src/test/ssl/t/SSL/Server.pm
++++ b/src/test/ssl/t/SSL/Server.pm
+@@ -299,6 +299,8 @@
+ 	open my $sslconf, '>', "$pgdata/sslconfig.conf";
+ 	print $sslconf "ssl=on\n";
+ 	print $sslconf $backend->set_server_cert(\%params);
++	# use lists of ECDH curves for syntax testing
++	print $sslconf "ssl_ecdh_curve='prime256v1:secp521r1'\n";
+ 	print $sslconf "ssl_passphrase_command='"
+ 	  . $params{passphrase_cmd} . "'\n"
+ 	  if defined $params{passphrase_cmd};
diff --git a/postgresql16.spec b/postgresql16.spec
index 6af387e..bf53cc4 100644
--- a/postgresql16.spec
+++ b/postgresql16.spec
@@ -48,7 +48,7 @@
 Summary: PostgreSQL client programs
 Name: %{majorname}%{majorversion}
 Version: %{majorversion}.14
-Release: 2%{?dist}
+Release: 3%{?dist}
 
 # The PostgreSQL license is very similar to other MIT licenses, but the OSI
 # recognizes it as an independent license, so we do as well.
@@ -96,6 +96,7 @@ Patch9: postgresql-server-pg_config.patch
 Patch10: postgresql-datalayout-mismatch-on-s390.patch
 Patch12: postgresql-no-libecpg.patch
 Patch13: postgresql-pqc-ssl-groups-v2.patch
+Patch14: postgresql-pqc-ssl-groups-tests.patch
 
 # This macro is used for package names in the files section
 %if %?postgresql_default
@@ -522,6 +523,7 @@ goal of accelerating analytics queries.
 %patch 9 -p1
 %patch 10 -p1
 %patch 13 -p1
+%patch 14 -p1
 
 
 %if ! %external_libpq
@@ -1352,6 +1354,11 @@ make -C postgresql-setup-%{setup_version} check
 
 
 %changelog
+* Mon Jul 20 2026 Filip Janus <fjanus@redhat.com> - 16.14-3
+- Add SSL test coverage for colon-separated ssl_ecdh_curve group list
+- Backport test from upstream commit 3d1ef3a15c3 (adapted for PG16)
+- Resolves: RHEL-119229
+
 * Mon Jul 20 2026 Filip Janus <fjanus@redhat.com> - 16.14-2
 - Enable PQC-compatible TLS group negotiation via ssl_ecdh_curve
 - Backport SSL_CTX_set1_groups_list() from PG18 (upstream commit 3d1ef3a15c3)