diff --git a/bind.spec b/bind.spec
index bf11fcf..2f216cf 100644
--- a/bind.spec
+++ b/bind.spec
@@ -13,7 +13,7 @@
 %bcond_without GSSTSIG
 # it is not possible to build the package without PKCS11 sub-package
 # due to extensive changes to Makefiles
-%bcond_with PKCS11
+%bcond_without PKCS11
 %bcond_without DEVEL
 %bcond_without JSON
 %bcond_with    BDB
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.2
-Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1159,6 +1159,9 @@ fi;
 
 
 %changelog
+* Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-4
+- Enable PKCS#11 builds again
+
 * Mon Apr 27 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.2-3
 - Correct trust anchors