diff --git a/cups-system-auth.patch b/cups-system-auth.patch
index 60117a9..dee6a31 100644
--- a/cups-system-auth.patch
+++ b/cups-system-auth.patch
@@ -1,38 +1,55 @@
-diff -up cups-1.5b1/conf/cups.password-auth.system-auth cups-1.5b1/conf/cups.password-auth
---- cups-1.5b1/conf/cups.password-auth.system-auth	2011-05-23 17:27:27.000000000 +0200
-+++ cups-1.5b1/conf/cups.password-auth	2011-05-23 17:27:27.000000000 +0200
+diff --git a/conf/pam.password b/conf/pam.password
+new file mode 100644
+index 000000000..6146a9134
+--- /dev/null
++++ b/conf/pam.password
 @@ -0,0 +1,4 @@
 +#%PAM-1.0
 +# Use password-auth common PAM configuration for the daemon
-+auth        include     password-auth
-+account     include     password-auth
-diff -up cups-1.5b1/conf/cups.system-auth.system-auth cups-1.5b1/conf/cups.system-auth
---- cups-1.5b1/conf/cups.system-auth.system-auth	2011-05-23 17:27:27.000000000 +0200
-+++ cups-1.5b1/conf/cups.system-auth	2011-05-23 17:27:27.000000000 +0200
++auth     include  password-auth
++account  include  password-auth
+diff --git a/conf/pam.system b/conf/pam.system
+new file mode 100644
+index 000000000..9e7c820f4
+--- /dev/null
++++ b/conf/pam.system
 @@ -0,0 +1,3 @@
 +#%PAM-1.0
-+auth	include		system-auth
-+account	include		system-auth
-diff -up cups-1.5b1/conf/Makefile.system-auth cups-1.5b1/conf/Makefile
---- cups-1.5b1/conf/Makefile.system-auth	2011-05-12 07:21:56.000000000 +0200
-+++ cups-1.5b1/conf/Makefile	2011-05-23 17:27:27.000000000 +0200
-@@ -90,10 +90,16 @@ install-data:
- 	done
- 	-if test x$(PAMDIR) != x; then \
- 		$(INSTALL_DIR) -m 755 $(BUILDROOT)$(PAMDIR); \
--		if test -r $(BUILDROOT)$(PAMDIR)/cups ; then \
--			$(INSTALL_DATA) $(PAMFILE) $(BUILDROOT)$(PAMDIR)/cups.N ; \
-+		if test -f /etc/pam.d/password-auth; then \
-+			$(INSTALL_DATA) cups.password-auth $(BUILDROOT)$(PAMDIR)/cups; \
-+		elif test -f /etc/pam.d/system-auth; then \
-+			$(INSTALL_DATA) cups.system-auth $(BUILDROOT)$(PAMDIR)/cups; \
- 		else \
--			$(INSTALL_DATA) $(PAMFILE) $(BUILDROOT)$(PAMDIR)/cups ; \
-+			if test -r $(BUILDROOT)$(PAMDIR)/cups ; then \
-+				$(INSTALL_DATA) $(PAMFILE) $(BUILDROOT)$(PAMDIR)/cups.N ; \
-+			else \
-+				$(INSTALL_DATA) $(PAMFILE) $(BUILDROOT)$(PAMDIR)/cups ; \
-+			fi ; \
- 		fi ; \
- 	fi
++auth     include  system-auth
++account  include  system-auth
+diff --git a/config-scripts/cups-pam.m4 b/config-scripts/cups-pam.m4
+index cf983b031..f4d6ecbd9 100644
+--- a/config-scripts/cups-pam.m4
++++ b/config-scripts/cups-pam.m4
+@@ -71,6 +71,10 @@ AS_IF([test x$enable_pam != xno], [
+ 	    PAMMOD="pam_${with_pam_module}.so"
+ 	], [test -f /etc/pam.d/common-auth], [
+ 	    PAMFILE="pam.common"
++	], [test -f /etc/pam.d/password-auth], [
++	    PAMFILE="pam.password"
++	], [test -f /etc/pam.d/system-auth], [
++	    PAMFILE="pam.system"
+ 	], [
+ 	    moddir=""
+ 	    for dir in /lib/security /lib64/security /lib/x86_64-linux-gnu/security /var/lib/pam; do
+diff --git a/configure b/configure
+index 7af3d1c9c..1921738cf 100755
+--- a/configure
++++ b/configure
+@@ -10396,6 +10396,16 @@ then :
  
+ 	    PAMFILE="pam.common"
+ 
++elif test -f /etc/pam.d/password-auth
++then :
++
++	    PAMFILE="pam.password"
++
++elif test -f /etc/pam.d/system-auth
++then :
++
++	    PAMFILE="pam.system"
++
+ else $as_nop
+ 
+ 	    moddir=""
diff --git a/cups.spec b/cups.spec
index 81cea4c..a9fe9ab 100644
--- a/cups.spec
+++ b/cups.spec
@@ -44,6 +44,7 @@ Source3: upgrade_get_document.py.in
 
 # PAM enablement, very old patch, not even git can track when or why
 # the patch was added.
+# merged upstream https://github.com/OpenPrinting/cups/pull/892
 Patch1: cups-system-auth.patch
 # cups-config from devel package conflicted on multilib arches,
 # fixed hack with pkg-config calling for gnutls' libdir variable
@@ -816,6 +817,7 @@ rm -f %{cups_serverbin}/backend/smb
 %changelog
 * Wed Feb 14 2024 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.7-10
 - require authselect-libs, since we use PAM modules password-auth or system-auth
+- got pam downstream patch upstream, use the commit from there
 
 * Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.4.7-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild