diff --git a/.gitignore b/.gitignore
index a9960c0..0d5518e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 /rpm-sequoia-1.2.0.crate
 /rpm-sequoia-1.3.0.crate
 /rpm-sequoia-1.4.0.crate
+/rpm-sequoia-1.4.0-vendor.tar.xz
diff --git a/rust-rpm-sequoia.spec b/rust-rpm-sequoia.spec
index 364e853..6fd7b58 100644
--- a/rust-rpm-sequoia.spec
+++ b/rust-rpm-sequoia.spec
@@ -1,6 +1,13 @@
 # Generated by rust2rpm 24
 %bcond_without check
 
+# RHEL does not have packages for Rust dependencies
+%if 0%{?rhel}
+%global bundled_rust_deps 1
+%else
+%global bundled_rust_deps 0
+%endif
+
 %global crate rpm-sequoia
 
 Name:           rust-rpm-sequoia
@@ -11,11 +18,22 @@ Summary:        Implementation of the RPM PGP interface using Sequoia
 License:        LGPL-2.0-or-later
 URL:            https://crates.io/crates/rpm-sequoia
 Source:         %{crates_source}
+# To create the vendor tarball:
+#   tar xf %%{crate}-%%{version}.crate ; pushd %%{crate}-%%{version} ; \
+#   patch -p1 < ../rpm-sequoia-fix-metadata.diff ; \
+#   cargo vendor && tar Jcvf ../%%{crate}-%%{version}-vendor.tar.xz vendor/ ; popd
+Source1:        %{crate}-%{version}-vendor.tar.xz
 # Manually created patch for downstream crate metadata changes
 # * default to the OpenSSL crypto backend of sequoia-openpgp
 Patch:          rpm-sequoia-fix-metadata.diff
 
+%if 0%{?bundled_rust_deps}
+BuildRequires:  rust-toolset
+# vendored openssl-sys
+BuildRequires:  openssl-devel
+%else
 BuildRequires:  rust-packaging >= 23
+%endif
 
 %global _description %{expand:
 An implementation of the RPM PGP interface using Sequoia.}
@@ -57,18 +75,22 @@ Requires:       %{crate}%{?_isa} = %{version}-%{release}
 
 %prep
 %autosetup -n %{crate}-%{version_no_tilde} -p1
+%if 0%{?bundled_rust_deps}
+%cargo_prep -V 1
+%else
 %cargo_prep
 
 %generate_buildrequires
 %cargo_generate_buildrequires
+%endif
 
 %build
 # build script uses environment variables to populate the pkgconfig file
 export PREFIX="%{_prefix}"
 export LIBDIR="%{_libdir}"
 %cargo_build
-%cargo_license_summary
-%{cargo_license} > LICENSE.dependencies
+%{?cargo_license_summary}
+%{?cargo_license} > LICENSE.dependencies
 
 %install
 # install shared library
diff --git a/sources b/sources
index d93d10b..75978aa 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (rpm-sequoia-1.4.0.crate) = ecb4afce1ab4697e652ab44eed1f4b778bf43f06f4befef92c2c1dba47b10f78f5bc5f769d838a55edb0e5e9abbe565c2e59c95a93d35df9bd2ef2fec20bd90e
+SHA512 (rpm-sequoia-1.4.0-vendor.tar.xz) = ce6f3b6ba06f1e1144d690a4a4a7751911bc770072714c4ef76a18c05945da3c5696b37d416dfd70e6a8a8cfe38083e88f5b83ac9c0c0ad105bebe4a140ffb4f