diff --git a/.gitignore b/.gitignore
index 4a92541..77cad2f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
+/results_python-cryptography
+/*.src.rpm
 /cryptography-1.3.1.tar.gz
 /cryptography-1.5.3.tar.gz
 /cryptography-1.7.1.tar.gz
@@ -47,3 +49,9 @@
 /cryptography-37.0.2-vendor.tar.bz2
 /cryptography-39.0.2.tar.gz
 /cryptography-39.0.2-vendor.tar.bz2
+/cryptography-40.0.0.tar.gz
+/cryptography-40.0.0-vendor.tar.bz2
+/cryptography-40.0.1.tar.gz
+/cryptography-40.0.1-vendor.tar.bz2
+/cryptography-40.0.2.tar.gz
+/cryptography-40.0.2-vendor.tar.bz2
diff --git a/python-cryptography.spec b/python-cryptography.spec
index 38888b0..6dc34f5 100644
--- a/python-cryptography.spec
+++ b/python-cryptography.spec
@@ -5,8 +5,8 @@
 %global srcname cryptography
 
 Name:           python-%{srcname}
-Version:        39.0.2
-Release:        2%{?dist}
+Version:        40.0.2
+Release:        1%{?dist}
 Summary:        PyCA's cryptography library
 
 # cryptography is dual licensed under the Apache-2.0 and BSD-3-Clause,
@@ -34,6 +34,8 @@ BuildRequires:  python%{python3_pkgversion}-cffi >= 1.12
 BuildRequires:  python%{python3_pkgversion}-devel
 BuildRequires:  python%{python3_pkgversion}-setuptools
 BuildRequires:  python%{python3_pkgversion}-setuptools-rust >= 0.11.4
+# test_load_with_other_sections in 40.0 fails with pem 1.1.0
+BuildRequires:  rust-pem-devel >= 1.1.1
 
 %if %{with tests}
 %if 0%{?fedora}
@@ -45,7 +47,7 @@ BuildRequires:  python%{python3_pkgversion}-pytz
 %endif
 BuildRequires:  python%{python3_pkgversion}-pytest >= 6.2.0
 BuildRequires:  python%{python3_pkgversion}-pytest-benchmark
-BuildRequires:  python%{python3_pkgversion}-pytest-subtests >= 0.3.2
+BuildRequires:  python%{python3_pkgversion}-pytest-subtests >= 0.5.0
 %endif
 
 %description
@@ -84,8 +86,12 @@ cd src/rust
 cd ../..
 %endif
 
+# Remove cosmetical pytest-subtests 0.10.0 option
+sed -i 's,--no-subtests-shortletter,,' pyproject.toml
+
 %build
 export RUSTFLAGS="%build_rustflags"
+export OPENSSL_NO_VENDOR=1
 %py3_build
 
 %install
@@ -125,6 +131,9 @@ PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
 %{python3_sitearch}/%{srcname}-%{version}-py*.egg-info
 
 %changelog
+* Tue Apr 18 2023 Christian Heimes <cheimes@redhat.com> - 40.0.2-1
+- Update to 40.0.2, resolves rhbz#2181430
+
 * Thu Mar 09 2023 Miro Hrončok <mhroncok@redhat.com> - 39.0.2-2
 - Don't run tests requiring pytz on RHEL
 - Don't try to run tests of vendored dependencies in %%check
diff --git a/sources b/sources
index 3ce6c7a..3532c84 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (cryptography-39.0.2.tar.gz) = 06ae3e2c0c2a5fa9e80dab7181a7c8b64aa9359bfd149837f179e65372a90acc905aae7476516ba8da4c4137bd25ba115d911728858551d2862280352b09b95e
-SHA512 (cryptography-39.0.2-vendor.tar.bz2) = 4e92ec50e01f99e160ab6c5e12fbd7e1297aaa2dfb5f0f35019308a44661e938a082c9a4ce0d9b5fbe1ed94cde49ae6b193c3f3f7035e9f5f5a97f2108595667
+SHA512 (cryptography-40.0.2.tar.gz) = 4f49a71cc7348cf90ff4e67d73486a07e065efdc3e321c7f2a642dd459057a90b1c26055bdbed076ebe5b8ea4ec544aaa62b9811fd62f0d818af7e0687b4aa9e
+SHA512 (cryptography-40.0.2-vendor.tar.bz2) = d45692545b50a1995837ec61b193f395bf4de021e3c4f059e3c3cc705b1b09628b1e8f00efd1d0f3f0936dc66e39cb2ac9defe484f952552e7b0e402e947fd6d