diff --git a/s390-tools-2.16.0-no-genprotimg.patch b/s390-tools-2.16.0-no-genprotimg.patch
new file mode 100644
index 0000000..58f4468
--- /dev/null
+++ b/s390-tools-2.16.0-no-genprotimg.patch
@@ -0,0 +1,12 @@
+diff -up s390-tools-2.16.0/Makefile.orig s390-tools-2.16.0/Makefile
+--- s390-tools-2.16.0/Makefile.orig	2021-06-02 13:19:47.774533339 +0200
++++ s390-tools-2.16.0/Makefile	2021-06-02 13:19:54.563698060 +0200
+@@ -9,7 +9,7 @@ TOOL_DIRS = zipl zdump fdasd dasdfmt das
+ 	   vmconvert vmcp man mon_tools dasdinfo vmur cpuplugd ipl_tools \
+ 	   ziomon iucvterm hyptop cmsfs-fuse qethqoat zfcpdump zdsfs cpumf \
+ 	   systemd hmcdrvfs cpacfstats zdev dump2tar zkey netboot etc zpcictl \
+-	   genprotimg lsstp hsci
++	   lsstp hsci
+ 
+ SUB_DIRS = $(LIB_DIRS) $(TOOL_DIRS)
+ 
diff --git a/s390utils.spec b/s390utils.spec
index d0bcf08..06a1b80 100644
--- a/s390utils.spec
+++ b/s390utils.spec
@@ -3,10 +3,12 @@
 %global signzipl 1
 %endif
 
+%global with_openssl3 1
+
 Name:           s390utils
 Summary:        Utilities and daemons for IBM z Systems
 Version:        2.16.0
-Release:        3%{?dist}
+Release:        4%{?dist}
 Epoch:          2
 License:        MIT
 ExclusiveArch:  s390 s390x
@@ -41,6 +43,9 @@ Patch100:       s390-tools-2.16.0-zkey.patch
 # https://github.com/ibm-s390-linux/s390-tools/commit/b6bdd7744aba06d82f30b0c84012f0b06ccb01de
 Patch101:       s390-tools-2.16.0-genprotimg.patch
 
+# OpenSSL 3.0 workaround until there is an upstream fix
+Patch200:       s390-tools-2.16.0-no-genprotimg.patch
+
 Requires:       s390utils-core = %{epoch}:%{version}-%{release}
 Requires:       s390utils-base = %{epoch}:%{version}-%{release}
 Requires:       s390utils-osasnmpd = %{epoch}:%{version}-%{release}
@@ -71,6 +76,10 @@ be used together with the zSeries (s390) Linux kernel and device drivers.
 %patch100 -p1
 %patch101 -p1
 
+%if 0%{?with_openssl3}
+%patch200 -p1
+%endif
+
 # remove --strip from install
 find . -name Makefile | xargs sed -i 's/$(INSTALL) -s/$(INSTALL)/g'
 
@@ -453,7 +462,9 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
 %{_sbindir}/znetconf
 %{_sbindir}/zpcictl
 %{_bindir}/dump2tar
+%if ! 0%{?with_openssl3}
 %{_bindir}/genprotimg
+%endif
 %{_bindir}/mk-s390image
 %{_bindir}/vmconvert
 %{_bindir}/zkey
@@ -486,7 +497,9 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
 %{_mandir}/man8/dasdstat.8*
 %{_mandir}/man8/dasdview.8*
 %{_mandir}/man8/dumpconf.8*
+%if ! 0%{?with_openssl3}
 %{_mandir}/man8/genprotimg.8.*
+%endif
 %{_mandir}/man8/hsci.8*
 %{_mandir}/man8/hyptop.8*
 %{_mandir}/man8/lschp.8*
@@ -516,7 +529,9 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
 %{_mandir}/man8/znetconf.8*
 %{_mandir}/man8/zpcictl.8*
 %dir %{_datadir}/s390-tools/
+%if ! 0%{?with_openssl3}
 %{_datadir}/s390-tools/genprotimg/
+%endif
 %{_datadir}/s390-tools/netboot/
 %dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey
 %dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey/repository
@@ -816,6 +831,10 @@ User-space development files for the s390/s390x architecture.
 
 
 %changelog
+* Wed Jun 02 2021 Dan Horák <dan[at]danny.cz> - 2:2.16.0-4
+- omit genprotimg to allow build against OpenSSL 3.0 (#1964818)
+- Resolves: #1964818
+
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2:2.16.0-3
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937