diff --git a/debian/changelog b/debian/changelog
index 74464b4c6..856a26ecc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,7 @@ freeipa (4.9.10-1) UNRELEASED; urgency=medium
   * patches: Drop upstreamed patches.
   * source: Extend diff-ignore.
   * ldap-so-path.diff: Don't hardcode path to bind/ldap.so.
+  * libsofthsm-path.diff: Use multiarch path for libsofthsm2.so.
 
  -- Timo Aaltonen <tjaalton@debian.org>  Tue, 29 Mar 2022 12:04:21 +0300
 
diff --git a/debian/patches/libsofthsm-path.diff b/debian/patches/libsofthsm-path.diff
new file mode 100644
index 000000000..200aa0630
--- /dev/null
+++ b/debian/patches/libsofthsm-path.diff
@@ -0,0 +1,11 @@
+--- a/ipaplatform/debian/paths.py
++++ b/ipaplatform/debian/paths.py
+@@ -80,7 +80,7 @@ class DebianPathNamespace(BasePathNamesp
+     BIND_LDAP_DNS_IPA_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/"
+     BIND_LDAP_DNS_ZONE_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/master/"
+     LIBARCH = "/{0}".format(MULTIARCH)
+-    LIBSOFTHSM2_SO = "/usr/lib/softhsm/libsofthsm2.so"
++    LIBSOFTHSM2_SO = "/usr/lib/{0}/softhsm/libsofthsm2.so".format(MULTIARCH)
+     PAM_KRB5_SO = "/usr/lib/{0}/security/pam_krb5.so".format(MULTIARCH)
+     LIB_SYSTEMD_SYSTEMD_DIR = "/lib/systemd/system/"
+     LIBEXEC_CERTMONGER_DIR = "/usr/lib/certmonger"
diff --git a/debian/patches/series b/debian/patches/series
index e5a3a5426..3a84c8249 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,6 +1,7 @@
 # upstreamed
 
 # not upstreamable
+libsofthsm-path.diff
 ldap-so-path.diff
 dnssec-race-wa.diff
 fix-sssd-socket-activation.diff