diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 5d75771..77cced3 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -28,7 +28,7 @@
 %global libedit 1
 
 %global openssh_ver 8.7p1
-%global openssh_rel 1
+%global openssh_rel 2
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -151,6 +151,8 @@ Patch974: openssh-8.0p1-keygen-strip-doseol.patch
 Patch975: openssh-8.0p1-preserve-pam-errors.patch
 # CVE-2021-41617
 Patch978: openssh-8.7p1-upstream-cve-2021-41617.patch
+# fix ssh-keygen -Y find-principals -f /dev/null -s /dev/null
+Patch979: openssh-8.7p1-find-principals-fix.patch
 
 # Fix issue with read-only ssh buffer during gssapi key exchange (#1938224)
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/19
@@ -300,6 +302,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch974 -p1 -b .keygen-strip-doseol
 %patch975 -p1 -b .preserve-pam-errors
 %patch978 -p1 -b .cve-2021-41617
+%patch979 -p1 -b .find-princ
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race
@@ -497,6 +500,9 @@ getent passwd sshd >/dev/null || \
 %attr(0644,root,root) %{_unitdir}/gsisshd-keygen.target
 
 %changelog
+* Wed Dec 01 2021 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.7p1-2
+- Based on openssh-8.7p1-3.fc35
+
 * Sun Oct 24 2021 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.7p1-1
 - Based on openssh-8.7p1-2.fc35
 
diff --git a/openssh-8.7p1-find-principals-fix.patch b/openssh-8.7p1-find-principals-fix.patch
new file mode 100644
index 0000000..4c6594b
--- /dev/null
+++ b/openssh-8.7p1-find-principals-fix.patch
@@ -0,0 +1,13 @@
+diff -up openssh-8.7p1/ssh-keygen.c.find-princ openssh-8.7p1/ssh-keygen.c
+--- openssh-8.7p1/ssh-keygen.c.find-princ	2021-11-29 15:27:03.032070863 +0100
++++ openssh-8.7p1/ssh-keygen.c	2021-11-29 15:27:34.736342968 +0100
+@@ -2700,7 +2700,8 @@ sig_process_opts(char * const *opts, siz
+ 	time_t now;
+ 
+ 	*verify_timep = 0;
+-	*print_pubkey = 0;
++	if (print_pubkey)
++		*print_pubkey = 0;
+ 	for (i = 0; i < nopts; i++) {
+ 		if (strncasecmp(opts[i], "verify-time=", 12) == 0) {
+ 			if (parse_absolute_time(opts[i] + 12,