diff --git a/.crypto-policies.metadata b/.crypto-policies.metadata
index 14dc5d5..7d189c5 100644
--- a/.crypto-policies.metadata
+++ b/.crypto-policies.metadata
@@ -1 +1 @@
-d3a2fedb0255dd8960066251b782765841f94bc9 SOURCES/crypto-policies-git6a67b8c.tar.gz
+bf586ce8a5b85e71c528d508094b567ad926c74e SOURCES/crypto-policies-git978ac26.tar.gz
diff --git a/.gitignore b/.gitignore
index 8545f0a..f873958 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/crypto-policies-git6a67b8c.tar.gz
+SOURCES/crypto-policies-git978ac26.tar.gz
diff --git a/SPECS/crypto-policies.spec b/SPECS/crypto-policies.spec
index 6ea328d..4ec4d5e 100644
--- a/SPECS/crypto-policies.spec
+++ b/SPECS/crypto-policies.spec
@@ -1,5 +1,5 @@
-%global git_date 20241104
-%global git_commit 6a67b8cde1e9f3a034c1008997b2fc2d5a3ea903
+%global git_date 20241105
+%global git_commit 978ac269655ae739f577a8fc78e6b672c78524f8
 %{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
 
 %global _python_bytecompile_extra 0
@@ -33,7 +33,7 @@ Conflicts: openssl-libs < 1:3.2
 Conflicts: nss < 3.101
 Conflicts: libreswan < 4.12
 Conflicts: openssh < 9.9p1
-Conflicts: gnutls < 3.8.3
+Conflicts: gnutls < 3.8.5
 
 %description
 This package provides pre-built configuration files with
@@ -251,6 +251,9 @@ exit 0
 
 
 %changelog
+* Tue Nov 05 2024 Alexander Sosedkin <asosedkin@redhat.com> - 20241105-1.git978ac26
+- gnutls: `allow-rsa-pkcs1-encrypt = false` everywhere but in LEGACY
+
 * Mon Nov 04 2024 Alexander Sosedkin <asosedkin@redhat.com> - 20241104-1.git6a67b8c
 - openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768