diff --git a/suricata-6.0.9-python.patch b/suricata-6.0.9-python.patch
new file mode 100644
index 0000000..2f3f84c
--- /dev/null
+++ b/suricata-6.0.9-python.patch
@@ -0,0 +1,9 @@
+diff -urp suricata-6.0.9.orig/python/suricata/sc/suricatasc.py suricata-6.0.9/python/suricata/sc/suricatasc.py
+--- suricata-6.0.9.orig/python/suricata/sc/suricatasc.py	2022-11-28 01:31:05.000000000 -0500
++++ suricata-6.0.9/python/suricata/sc/suricatasc.py	2022-12-13 17:17:12.651749381 -0500
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ # Copyright(C) 2012-2020 Open Information Security Foundation
+ 
+ # This program is free software; you can redistribute it and/or modify
diff --git a/suricata.spec b/suricata.spec
index e85c8c6..7a37de5 100644
--- a/suricata.spec
+++ b/suricata.spec
@@ -23,6 +23,8 @@ Patch4: suricata-5.0.4-geolite-path-fixup.patch
 Patch5: suricata-6.0.3-log-path-fixup.patch
 # update deprecated API calls
 Patch6: suricata-6.0.6-ebpf-update-deprecated-API-calls.patch
+# Build fails with ambiguous python shebang
+Patch7: suricata-6.0.9-python.patch
 
 BuildRequires: make
 BuildRequires: gcc gcc-c++