diff --git a/.gitignore b/.gitignore
index 36b5c11..9d784f4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,8 @@
 /sscg-3.0.5.tar.gz
 /sscg-3.0.6.tar.gz
 /sscg-3.0.7.tar.gz
+/sscg-3.0.8.tar.gz
+/sscg-4.0.0.tar.gz
+/sscg-4.0.1.tar.gz
+/sscg-4.0.2.tar.gz
+/sscg-4.0.3.tar.gz
diff --git a/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
new file mode 100644
index 0000000..c80dc87
--- /dev/null
+++ b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
@@ -0,0 +1,38 @@
+From 0c37e7ace585cfb550a0ffd9d5c331d059fd687f Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Tue, 2 Dec 2025 12:12:26 -0500
+Subject: [PATCH] Avoid segfault on receiving bad CLI arguments
+
+Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
+---
+ src/sscg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/sscg.c b/src/sscg.c
+index b9b191f109300f6447262858f57a3a8321a14966..00e2862c2d6be5c44a4a362fc926e1a07d31d7bf 100644
+--- a/src/sscg.c
++++ b/src/sscg.c
+@@ -59,7 +59,7 @@ int
+ main (int argc, const char **argv)
+ {
+   int ret, sret;
+-  struct sscg_options *options;
++  struct sscg_options *options = NULL;
+   bool build_client_cert = false;
+   char *dhparams_file = NULL;
+ 
+@@ -342,7 +342,10 @@ main (int argc, const char **argv)
+ done:
+   if (ret != EOK)
+     {
+-      sscg_io_utils_delete_output_files (options->streams);
++      if (options)
++        {
++          sscg_io_utils_delete_output_files (options->streams);
++        }
+     }
+   talloc_zfree (main_ctx);
+   if (getenv ("SSCG_TALLOC_REPORT"))
+-- 
+2.52.0
+
diff --git a/sources b/sources
index 4d52610..ebbdfd3 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sscg-3.0.7.tar.gz) = d9cb1700b835c5d4d358d821a1022f285bed1a199fdd140fe31339248c5e859a438a26bc8cd55f1d3a8eadaed77e1aa655a22d6a4e483d4fb26db007c4248009
+SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96
diff --git a/sscg.spec b/sscg.spec
index bf8137a..4a60e76 100644
--- a/sscg.spec
+++ b/sscg.spec
@@ -9,9 +9,9 @@
 %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs}
 
 Name:           sscg
-Version:        3.0.7
+Version:        4.0.3
 Release:        %autorelease
-Summary:        Simple SSL certificate generator
+Summary:        Simple Signed Certificate Generator
 
 License:        GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception
 URL:            https://%{provider_prefix}
@@ -21,11 +21,14 @@ BuildRequires:  libtalloc-devel
 BuildRequires:  openssl
 BuildRequires:  openssl-devel
 BuildRequires:  popt-devel
-BuildRequires:  libpath_utils-devel
 BuildRequires:  meson
 BuildRequires:  ninja-build
 BuildRequires:  help2man
 
+# Upstream patch to avoid segfaults when receiving bad CLI arguments
+# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f
+Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
+
 
 %description
 A utility to aid in the creation of more secure "self-signed"