diff --git a/0013-Turn-off-free-nonheap-object.patch b/0013-Turn-off-free-nonheap-object.patch
new file mode 100644
index 0000000..3e62bd8
--- /dev/null
+++ b/0013-Turn-off-free-nonheap-object.patch
@@ -0,0 +1,35 @@
+From 59428daf4863f192419eee4afec15cd099e99c9b Mon Sep 17 00:00:00 2001
+From: Jeff Law <law@redhat.com>
+Date: Mon, 16 Nov 2020 12:07:59 -0700
+Subject: [PATCH] Turn off -Wfree-nonheap-object
+
+authvar.c has a call to free (tokenname) where tokenname is set to a string constant
+and never changed.  That triggers GCC to issue a diagnostic that the value should not
+be passed to free.
+
+This is a false positive from GCC as the call is guarded by a suitable condition that
+always happens to be false.  But pesign is being built without optimization and thus
+the condition and free call are not optimized away.
+
+This patch just disables the warning.  A better solution would be to fix the sources
+or build with the optimizer enabled.
+---
+ Make.defaults | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Make.defaults b/Make.defaults
+index d4cd626..705cc3a 100644
+--- a/Make.defaults
++++ b/Make.defaults
+@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto
+ cflags	= $(CFLAGS) $(ARCH3264) \
+ 	-Wall -Wextra -Wsign-compare -Wno-unused-result \
+ 	-Wno-unused-function -Wno-missing-field-initializers \
+-	-Werror -Wno-error=cpp \
++	-Werror -Wno-error=cpp -Wno-free-nonheap-object \
+ 	-std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \
+ 	-D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \
+ 	$(if $(filter $(CC),clang),$(clang_cflags), ) \
+-- 
+2.28.0
+
diff --git a/pesign.spec b/pesign.spec
index 76c6a72..a2bdb04 100644
--- a/pesign.spec
+++ b/pesign.spec
@@ -3,7 +3,7 @@
 Name:    pesign
 Summary: Signing utility for UEFI binaries
 Version: 113
-Release: 13%{?dist}
+Release: 14%{?dist}
 License: GPLv2
 URL:     https://github.com/vathpela/pesign
 
@@ -54,6 +54,7 @@ Patch0009: 0009-pesign-authorize-shellcheck.patch
 Patch0010: 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch
 Patch0011: 0011-kernel-building-hack.patch
 Patch0012: 0012-Use-run-not-var-run.patch
+Patch0013: 0013-Turn-off-free-nonheap-object.patch
 
 %description
 This package contains the pesign utility for signing UEFI binaries as
@@ -166,6 +167,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
 %{python3_sitelib}/mockbuild/plugins/pesign.*
 
 %changelog
+* Mon Nov 16 2020 Jeff Law <law@redhat.com> - 113-14
+- Turn off -Wfree-nonheap-object
+
 * Mon Aug 03 2020 Peter Jones <pjones@redhat.com> - 113-13
 - Add the rundir related stuff that was staged on my f32 checkout.