diff --git a/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch
new file mode 100644
index 0000000..5c53868
--- /dev/null
+++ b/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch
@@ -0,0 +1,31 @@
+From 59d3ecdab7210e87ec475f4ae0d64888d5416b29 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 9 Jan 2023 22:39:52 +0100
+Subject: [PATCH] [downstream] Do not set root as ksu file owner
+
+Upstream Makefile uses the install command to set root as owner of the
+ksu executable file. However, this is no longer supported on latest
+versions of the Mock build environment.
+
+In case of ksu, the owner, group, and mode are already set using %attr()
+in the specfile.
+---
+ src/config/pre.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 7eaa2f351c..e9ae71471e 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+ INSTALL_SCRIPT=@INSTALL_PROGRAM@
+ INSTALL_DATA=@INSTALL_DATA@
+ INSTALL_SHLIB=@INSTALL_SHLIB@
+-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
++INSTALL_SETUID=$(INSTALL)
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+ prefix=@prefix@
+-- 
+2.38.1
+
diff --git a/krb5.spec b/krb5.spec
index 3593e7d..0f6e58d 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -10,7 +10,7 @@
 #
 # baserelease is what we have standardized across Fedora and what
 # rpmdev-bumpspec knows how to handle.
-%global baserelease 4
+%global baserelease 5
 
 # This should be e.g. beta1 or %%nil
 %global pre_release %nil
@@ -73,6 +73,7 @@ Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch
 Patch12: 0012-Add-and-use-ts_interval-helper.patch
 Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch
 Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch
+Patch15: 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -709,6 +710,9 @@ exit 0
 %{_datarootdir}/%{name}-tests/
 
 %changelog
+* Mon Jan 09 2023 Julien Rische <jrische@redhat.com> - 1.20.1-5
+- Strip debugging data from ksu executable file
+
 * Thu Jan 05 2023 Julien Rische <jrische@redhat.com> - 1.20.1-4
 - Include missing OpenSSL FIPS header
 - Make tests compatible with sssd_krb5_locator_plugin.so