diff --git a/SOURCES/0001-gnome-session-don-t-validate-shell-before-using-it.patch b/SOURCES/0001-gnome-session-don-t-validate-shell-before-using-it.patch
new file mode 100644
index 0000000..95a877c
--- /dev/null
+++ b/SOURCES/0001-gnome-session-don-t-validate-shell-before-using-it.patch
@@ -0,0 +1,53 @@
+From ae60cb25636b6f68d087591de11fd681f6f8c918 Mon Sep 17 00:00:00 2001
+From: Ray Strode <rstrode@redhat.com>
+Date: Tue, 19 Nov 2019 09:29:16 -0500
+Subject: [PATCH] gnome-session: don't validate shell before using it
+
+Users sometimes set their shell to an invalid shell to prevent
+login from proceeding.
+
+GNOME on Wayland still allows login in these cases.
+
+This commit makes the behavior match expectations by skipping
+shell validity checks when deciding to run though a login shell.
+---
+ gnome-session/gnome-session.in | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/gnome-session/gnome-session.in b/gnome-session/gnome-session.in
+index ce63df56..7d967d34 100755
+--- a/gnome-session/gnome-session.in
++++ b/gnome-session/gnome-session.in
+@@ -1,28 +1,25 @@
+ #!/bin/sh
+ 
+ if [ "x$XDG_SESSION_TYPE" = "xwayland" ] &&
+    [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
+-   [  -n "$SHELL" ] &&
+-   grep -q "$SHELL" /etc/shells &&
+-   ! (echo "$SHELL" | grep -q "false") &&
+-   ! (echo "$SHELL" | grep -q "nologin"); then
++   [  -n "$SHELL" ]; then
+   if [ "$1" != '-l' ]; then
+     exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
+   else
+     shift
+   fi
+ fi
+ 
+ SETTING=$(gsettings get org.gnome.system.locale region)
+ REGION=${SETTING#\'}
+ REGION=${REGION%\'}
+ 
+ if [ -n "$REGION" ]; then
+   export LC_TIME=$REGION
+   export LC_NUMERIC=$REGION
+   export LC_MONETARY=$REGION
+   export LC_MEASUREMENT=$REGION
+   export LC_PAPER=$REGION
+ fi
+ 
+ exec @libexecdir@/gnome-session-binary "$@"
+-- 
+2.21.0
+
diff --git a/SPECS/gnome-session.spec b/SPECS/gnome-session.spec
index e3d9f64..8185899 100644
--- a/SPECS/gnome-session.spec
+++ b/SPECS/gnome-session.spec
@@ -9,7 +9,7 @@
 
 Name: gnome-session
 Version: 3.28.1
-Release: 6%{?dist}
+Release: 7%{?dist}
 Summary: GNOME session manager
 
 License: GPLv2+
@@ -64,6 +64,8 @@ Requires: dbus-x11
 
 Conflicts: gnome-settings-daemon < 3.27.90
 
+Patch0: 0001-gnome-session-don-t-validate-shell-before-using-it.patch
+
 %description
 gnome-session manages a GNOME desktop or GDM login session. It starts up
 the other core GNOME components and handles logout and saving the session.
@@ -129,6 +131,10 @@ cp $RPM_SOURCE_DIR/gnome-xorg.desktop $RPM_BUILD_ROOT%{_datadir}/xsessions/gnome
 %{_datadir}/glib-2.0/schemas/org.gnome.SessionManager.gschema.xml
 
 %changelog
+* Tue Nov 19 2019 Ray Strode <rstrode@redhat.com> - 3.28.1-7
+- make /sbin/nologin fail on wayland
+  Resolves: #1752493
+
 * Mon Jan 14 2019 Ray Strode <rstrode@redhat.com> - 3.28.1-6
 - Update desktop file names
   Related: #1647713