diff --git a/build-scripts/package b/build-scripts/package
index 9e137708c..4dfac89c3 100755
--- a/build-scripts/package
+++ b/build-scripts/package
@@ -178,6 +178,8 @@ case "$PACKAGING" in
     #     - argv[2] = a b
     # Also note that $RPMBUILD_OPTIONS might have spaces
     # which must be preserved
+    # rhel-10 rpmbuild is more picky about /var/cfengine/lib RPATH we need
+    export QA_RPATHS=2 # this is a set of bit flags, we just want 0x0002 here
     eval "$RPMBUILD_CMD" -bb \
       --define "'_topdir $BASEDIR/$PKG'" \
       --define "'buildprefix $BUILDPREFIX'" \
diff --git a/deps-packaging/apache/cfbuild-apache.spec b/deps-packaging/apache/cfbuild-apache.spec
index 2a9af2822..b734c448f 100644
--- a/deps-packaging/apache/cfbuild-apache.spec
+++ b/deps-packaging/apache/cfbuild-apache.spec
@@ -8,6 +8,7 @@ Release: 1
 Source0: httpd-%{apache_version}.tar.gz
 Source1: httpd.conf
 Patch0:  apachectl.patch
+Patch1: fixed-implicit-decl-gettid.patch
 License: MIT
 Group: Other
 Url: https://cfengine.com
@@ -21,7 +22,8 @@ AutoReqProv: no
 mkdir -p %{_builddir}
 %setup -q -n httpd-%{apache_version}
 
-%patch0 -p0
+%patch -P 0
+%patch -P 1 -p1
 
 CPPFLAGS=-I%{buildprefix}/include
 
diff --git a/deps-packaging/libyaml/cfbuild-libyaml.spec b/deps-packaging/libyaml/cfbuild-libyaml.spec
index b2de6669f..8ad3ebe70 100644
--- a/deps-packaging/libyaml/cfbuild-libyaml.spec
+++ b/deps-packaging/libyaml/cfbuild-libyaml.spec
@@ -33,6 +33,7 @@ $MAKE
 %install
 rm -rf ${RPM_BUILD_ROOT}
 $MAKE DESTDIR=${RPM_BUILD_ROOT} install
+rm -rf ${RPM_BUILD_ROOT}%{prefix}/lib/libyaml.la
 
 %clean
 rm -rf $RPM_BUILD_ROOT
@@ -65,7 +66,6 @@ CFEngine Build Automation -- lmdb -- development files
 %dir %{prefix}/lib
 %{prefix}/lib/pkgconfig
 %{prefix}/lib/*.a
-%{prefix}/lib/*.la
 
 %changelog
 
diff --git a/deps-packaging/pkg-build-rpm b/deps-packaging/pkg-build-rpm
index a26cdae63..84bc3edfa 100755
--- a/deps-packaging/pkg-build-rpm
+++ b/deps-packaging/pkg-build-rpm
@@ -76,11 +76,15 @@ if [ $TARGET != native ]; then
   exit 42
 fi
 
+# deps packages may result in binaries without debug symbols even when debugsym=yes aka BUILD_TYPE=DEBUG
+# to avoid rpmbuild errors when this occurs, allow empties
+RPMBUILD_OPTIONS="$RPMBUILD_OPTIONS --define '_empty_manifest_terminate_build 0'"
+
 case "$TESTS" in
   no)
-    RPMBUILD_OPTIONS="--define 'with_testsuite 0'";;
+    RPMBUILD_OPTIONS="$RPMBUILD_OPTIONS --define 'with_testsuite 0'";;
   yes)
-    RPMBUILD_OPTIONS="--define 'with_testsuite 1'";;
+    RPMBUILD_OPTIONS="$RPMBUILD_OPTIONS --define 'with_testsuite 1'";;
   *)
     fatal "Unknown tests option: $TESTS";;
 esac
@@ -112,6 +116,12 @@ fi
 # example cmd --define 'a b':
 #     - argv[1] = --define
 #     - argv[2] = a b
+
+# We have /var/cfengine/lib in RPATHS which should be OK
+# We asked in https://github.com/rpm-software-management/rpm/issues/3982, and it seems allowing this is OK
+# 0x0002 - contains an invalid RPATH - in our case /var/cfengine/lib is OK so allow it as an exception
+# Here we only want to specify this one flag: 0x0002. Sadly these scripts run on POSIX shell (especially e.g. aix71 runs as /bin/sh which is ksh) so no bitwise operators. Add them together manually to a decimal integer.
+export QA_RPATHS=2 # 0x0002 all by itself, no &(ands)
 eval $RPMBUILD_CMD -bb \
   --define "'_system_ssl $SYSTEM_SSL'" \
   --define "'_topdir $BASEDIR/$PKGNAME'" \