diff --git a/SOURCES/ndb_query_ro_media.patch b/SOURCES/ndb_query_ro_media.patch
new file mode 100644
index 0000000..92393eb
--- /dev/null
+++ b/SOURCES/ndb_query_ro_media.patch
@@ -0,0 +1,23 @@
+From 93e482be29ee683011c71f23b3b0096889e50331 Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Mon, 3 Feb 2020 11:37:30 +0100
+Subject: [PATCH] Permit ndb database queries on read-only media
+
+See also commit a429c99e13fbe9926243f29b78df8d64222c4469 for db3.
+---
+ lib/backend/ndb/glue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/backend/ndb/glue.c b/lib/backend/ndb/glue.c
+index 90c10f8894..d19da7c5cd 100644
+--- a/lib/backend/ndb/glue.c
++++ b/lib/backend/ndb/glue.c
+@@ -161,7 +161,7 @@ static int ndb_Open(rpmdb rdb, rpmDbiTagVal rpmtag, dbiIndex * dbip, int flags)
+ 	    /* Open indexes readwrite if possible */
+ 	    ioflags = O_RDWR;
+ 	    rc = rpmxdbOpen(&ndbenv->xdb, rdb->db_pkgs->dbi_db, path, ioflags, 0666);
+-	    if (rc && errno == EACCES) {
++	    if (rc && (errno == EACCES || errno == EROFS)) {
+ 		/* If it is not asked for rw explicitly, try to open ro */
+ 		if (!(oflags & O_RDWR)) {
+ 		    ioflags = O_RDONLY;
diff --git a/SPECS/rpm.spec b/SPECS/rpm.spec
index 84f603f..8c7b4b2 100644
--- a/SPECS/rpm.spec
+++ b/SPECS/rpm.spec
@@ -194,6 +194,8 @@ Patch1983: 0034-rpmsign-Adopting-PKCS11-opaque-keys-support-in-libfsverity-for-f
 
 %if %{with ndb}
 Patch9000: ndb_default.patch
+# GH#1040
+Patch9001: ndb_query_ro_media.patch
 %endif
 
 Patch9989: 1534.patch