diff --git a/expat-requires.py b/expat-requires.py
new file mode 100644
index 0000000..fe23fa9
--- /dev/null
+++ b/expat-requires.py
@@ -0,0 +1,50 @@
+import pathlib
+import pyexpat
+import sys
+
+
+# This will determine the version of currently installed expat
+EXPAT_VERSION = pyexpat.EXPAT_VERSION.removeprefix('expat_')
+MAJOR, MINOR, PATCH = (int(i) for i in EXPAT_VERSION.split('.'))
+EXPAT_COMBINED_VERSION = 10000*MAJOR + 100*MINOR + PATCH
+
+# For the listed files, we find all XML_COMBINED_VERSION-based #ifs
+SRC = pathlib.Path.cwd()
+SOURCES = [
+    SRC / 'Modules/pyexpat.c',
+    SRC / 'Modules/clinic/pyexpat.c.h',
+]
+versions = set()
+for source in SOURCES:
+    for line in source.read_text().splitlines():
+        if 'XML_COMBINED_VERSION' not in line:
+            continue
+        words = line.split()
+        if words[0] == '#define':
+            continue
+        if len(words) != 4:
+            continue
+        if words[0] not in ('#if', '#elif'):
+            continue
+        if words[1].startswith('(') and words[-1].endswith(')'):
+            words[1] = words[1][1:]
+            words[-1] = words[-1][:-1]
+        if words[1] == 'XML_COMBINED_VERSION':
+            version = int(words[3])
+            if words[2] == '>':
+                versions.add(version+1)
+                continue
+            if words[2] == '>=':
+                versions.add(version)
+                continue
+        raise ValueError(
+            'Unknown line with XML_COMBINED_VERSION, adjust this script:\n\n'
+            f'{line}'
+        )
+
+# We need the highest satisfiable version used in the #ifs, in x.y.z notation
+v = max({v for v in versions if v <= EXPAT_COMBINED_VERSION})
+major, minor_patch = divmod(v, 10000)
+minor, patch = divmod(minor_patch, 100)
+print(f"{major}.{minor}.{patch}")
+
diff --git a/python3.12.spec b/python3.12.spec
index 6233c5f..f96d8c2 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -20,7 +20,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -328,6 +328,9 @@ Source5: pathfix_py3_12.py
 # Originally written by bkabrda
 Source8: check-pyc-timestamps.py
 
+# A script that determines the required expat version
+Source9: expat-requires.py
+
 # Desktop menu entry for idle3
 Source10: idle3.desktop
 
@@ -574,6 +577,15 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
+# The requirement on libexpat is generated, but we need to version it.
+# When built with newer expat, but installed with older expat, we get:
+#   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
+#   undefined symbol: XML_SetReparseDeferralEnabled
+# This breaks many things, including python -m venv.
+# Other subpackages (like -debug) also need this, but they all depend on -libs.
+%global expat_min_version 2.4.0
+Requires: expat%{_isa} >= %{expat_min_version}
+
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
 - the majority of the Python standard library
@@ -1251,6 +1263,12 @@ for Module in %{buildroot}/%{dynload_dir}/*.so ; do
     esac
 done
 
+# Check the expat compatibility
+expat_found=$(LD_LIBRARY_PATH="%{buildroot}%{_libdir}" PYTHONPATH="%{buildroot}%{pylibdir}" %{buildroot}%{_bindir}/python%{pybasever} %{SOURCE9})
+if [ "${expat_found}" != "%{expat_min_version}" ]; then
+    echo "Found expat version is different than the declared one, found: ${expat_found}" ; exit 1
+fi
+
 
 # ======================================================
 # Running the upstream test suite
@@ -1904,6 +1922,10 @@ fi
 # ======================================================
 
 %changelog
+* Mon Sep 07 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.14-2
+- Add versioned expat requirement and check for its version
+Resolves: RHEL-251328
+
 * Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.12.14-1
 - Update to Python 3.12.14
 Resolves: RHEL-227198