diff --git a/openssh-7.5p1-sandbox-typo.patch b/openssh-7.5p1-sandbox-typo.patch
deleted file mode 100644
index dd5f1fa..0000000
--- a/openssh-7.5p1-sandbox-typo.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 3a1aedce72c2..a8d472a63ccb 100644
---- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -235,7 +235,7 @@ static const struct sock_filter preauth_insns[] = {
- 	 * x86-64 syscall under some circumstances, e.g.
- 	 * https://bugs.debian.org/849923
- 	 */
--	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT);
-+	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
- #endif
- 
- 	/* Default deny */
diff --git a/openssh-7.5p1-sandbox.patch b/openssh-7.5p1-sandbox.patch
new file mode 100644
index 0000000..7d09632
--- /dev/null
+++ b/openssh-7.5p1-sandbox.patch
@@ -0,0 +1,23 @@
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 3a1aedce72c2..a8d472a63ccb 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -50,6 +50,9 @@
+ #include <elf.h>
+ 
+ #include <asm/unistd.h>
++#ifdef __s390__
++#include <asm/zcrypt.h>
++#endif
+ 
+ #include <errno.h>
+ #include <signal.h>
+@@ -235,7 +235,7 @@ static const struct sock_filter preauth_insns[] = {
+ 	 * x86-64 syscall under some circumstances, e.g.
+ 	 * https://bugs.debian.org/849923
+ 	 */
+-	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT);
++	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
+ #endif
+ 
+ 	/* Default deny */
diff --git a/openssh.spec b/openssh.spec
index f07d64d..5b95119 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -228,8 +228,8 @@ Patch942: openssh-7.2p2-chroot-capabilities.patch
 Patch944: openssh-7.3p1-x11-max-displays.patch
 # Help systemd to track the running service
 Patch948: openssh-7.4p1-systemd.patch
-# Fix typo in sandbox code
-Patch949: openssh-7.5p1-sandbox-typo.patch
+# Fix typo in sandbox code; missing header for s390
+Patch949: openssh-7.5p1-sandbox.patch
 
 
 License: BSD