diff --git a/postgresql-default-ssl-config.patch b/postgresql-default-ssl-config.patch
new file mode 100644
index 0000000..dd5495b
--- /dev/null
+++ b/postgresql-default-ssl-config.patch
@@ -0,0 +1,12 @@
+diff -Naur postgresql-17.9/src/backend/utils/misc/postgresql.conf.sample postgresql-17.9_patched/src/backend/utils/misc/postgresql.conf.sample
+--- postgresql-17.9/src/backend/utils/misc/postgresql.conf.sample	2026-02-23 22:58:47.000000000 +0100
++++ postgresql-17.9_patched/src/backend/utils/misc/postgresql.conf.sample	2026-05-12 11:35:30.531633102 +0200
+@@ -110,7 +110,7 @@
+ #ssl_crl_file = ''
+ #ssl_crl_dir = ''
+ #ssl_key_file = 'server.key'
+-#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'	# allowed SSL ciphers
++ssl_ciphers = 'PROFILE=SYSTEM'	# allowed SSL ciphers, default: 'HIGH:MEDIUM:+3DES:!aNULL'
+ #ssl_prefer_server_ciphers = on
+ #ssl_ecdh_curve = 'prime256v1'
+ #ssl_min_protocol_version = 'TLSv1.2'
diff --git a/postgresql17.spec b/postgresql17.spec
index 067673c..911f05e 100644
--- a/postgresql17.spec
+++ b/postgresql17.spec
@@ -95,6 +95,7 @@ Patch9: postgresql-server-pg_config.patch
 # rhbz#1940964
 Patch10: postgresql-datalayout-mismatch-on-s390.patch
 Patch12: postgresql-no-libecpg.patch
+Patch13: postgresql-default-ssl-config.patch
 
 # This macro is used for package names in the files section
 %if %?postgresql_default
@@ -520,6 +521,7 @@ goal of accelerating analytics queries.
 %endif
 %patch 9 -p1
 %patch 10 -p1
+%patch 13 -p1
 
 
 %if ! %external_libpq