diff --git a/openssh-6.8p1-workaround-krb5-config-bug.patch b/openssh-6.8p1-workaround-krb5-config-bug.patch
new file mode 100644
index 0000000..17f5820
--- /dev/null
+++ b/openssh-6.8p1-workaround-krb5-config-bug.patch
@@ -0,0 +1,22 @@
+diff --git a/configure.ac b/configure.ac
+index 4e6abce..af08091 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -4173,7 +4173,7 @@ AC_ARG_WITH([kerberos5],
+ 			     [$KRB5ROOT/bin:$PATH])
+ 		if test -x $KRB5CONF ; then
+ 			K5CFLAGS="`$KRB5CONF --cflags`"
+-			K5LIBS="`$KRB5CONF --libs`"
++			K5LIBS="-lkrb5 -lk5crypto -lcom_err"
+ 			CPPFLAGS="$CPPFLAGS $K5CFLAGS"
+ 
+ 			AC_MSG_CHECKING([for gssapi support])
+@@ -4183,7 +4183,7 @@ AC_ARG_WITH([kerberos5],
+ 					[Define this if you want GSSAPI
+ 					support in the version 2 protocol])
+ 				GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
+-				GSSLIBS="`$KRB5CONF --libs gssapi`"
++				GSSLIBS="-lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err"
+ 				CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
+ 			else
+ 				AC_MSG_RESULT([no])
diff --git a/openssh.spec b/openssh.spec
index 25622f4..bcceff5 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -215,6 +215,8 @@ Patch924: openssh-6.7p1-seccomp-aarch64.patch
 Patch925: openssh-6.7p1-ssh-copy-id-truncated-keys.patch
 # Add sftp option to force mode of created files (#1191055)
 Patch926: openssh-6.7p1-sftp-force-permission.patch
+# Workaround krb5-config bug #1204646
+Patch927: openssh-6.8p1-workaround-krb5-config-bug.patch
 
 
 
@@ -435,6 +437,7 @@ popd
 %patch924 -p1 -b .seccomp
 %patch925 -p1 -b .newline
 %patch926 -p1 -b .sftp-force-mode
+%patch927 -p1 -b .bz1204646
 
 %patch200 -p1 -b .audit
 %patch700 -p1 -b .fips