diff --git a/Restore-krb5_set_default_tgs_ktypes.patch b/Restore-krb5_set_default_tgs_ktypes.patch
new file mode 100644
index 0000000..742e302
--- /dev/null
+++ b/Restore-krb5_set_default_tgs_ktypes.patch
@@ -0,0 +1,54 @@
+From faa975dd74df535960bf8f82990f352d022a12a5 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 12 Feb 2021 15:11:25 -0500
+Subject: [PATCH] Restore krb5_set_default_tgs_ktypes()
+
+Samba only uses the correct name (krb5_set_default_tgs_enctypes) if it
+cannot find the old one in the library, so removing the name causes a
+linker error for existing builds.
+
+(cherry picked from commit 17ee97788611f8f8f4a6bd69968a9499f4db2215)
+
+ticket: 8985
+version_fixed: 1.19.1
+
+(cherry picked from commit 3e36b25712d940a8e325abc407143634365b51d0)
+---
+ src/lib/krb5/krb/init_ctx.c  | 11 +++++++++++
+ src/lib/krb5/libkrb5.exports |  1 +
+ 2 files changed, 12 insertions(+)
+
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index d2b70acad..bfa99d9eb 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -375,6 +375,17 @@ krb5_set_default_tgs_enctypes(krb5_context context, const krb5_enctype *etypes)
+     return 0;
+ }
+ 
++/* Old name for above function.  This is not a public API, but Samba (as of
++ * 2021-02-12) uses this name if it finds it in the library. */
++krb5_error_code
++krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes);
++
++krb5_error_code
++krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes)
++{
++    return krb5_set_default_tgs_enctypes(context, etypes);
++}
++
+ /*
+  * Add etype to, or remove etype from, the zero-terminated list *list_ptr,
+  * reallocating if the list size changes.  Filter out weak enctypes if
+diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
+index 25141dfc5..df6e2ffbe 100644
+--- a/src/lib/krb5/libkrb5.exports
++++ b/src/lib/krb5/libkrb5.exports
+@@ -567,6 +567,7 @@ krb5_set_config_files
+ krb5_set_debugging_time
+ krb5_set_default_realm
+ krb5_set_default_tgs_enctypes
++krb5_set_default_tgs_ktypes
+ krb5_set_error_message
+ krb5_set_password
+ krb5_set_password_using_ccache
diff --git a/krb5.spec b/krb5.spec
index 96be371..a2f4234 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19
-Release: %{?zdpd}2%{?dist}
+Release: %{?zdpd}3%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -73,6 +73,7 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
 Patch8: Add-APIs-for-marshalling-credentials.patch
 Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch
 Patch10: Support-host-based-GSS-initiator-names.patch
+Patch11: Restore-krb5_set_default_tgs_ktypes.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -631,6 +632,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Feb 17 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-3
+- Restore krb5_set_default_tgs_ktypes()
+
 * Fri Feb 05 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-2
 - No code change; just coping with reverted autoconf