diff --git a/debian/patches/series b/debian/patches/series
index 71b1df29f..441dc1257 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -32,7 +32,7 @@ sipwise/sca-debug.patch
 sipwise/sca-fix-notify-after-bye.patch
 sipwise/sca-add-pai_avp-parameter.patch
 ## upstream 5.7
-#
+upstream/Makefile.groups-tlsa-in-packaging-group-ktls-if-KTLS.patch
 ## upstream master
 upstream/pv_headers-compare-result-of-pvh_set_xavi-with-NULL-.patch
 sipwise/presence-active_watcher-cleanup-timer.patch
diff --git a/debian/patches/upstream/Makefile.groups-tlsa-in-packaging-group-ktls-if-KTLS.patch b/debian/patches/upstream/Makefile.groups-tlsa-in-packaging-group-ktls-if-KTLS.patch
new file mode 100644
index 000000000..f58b02c38
--- /dev/null
+++ b/debian/patches/upstream/Makefile.groups-tlsa-in-packaging-group-ktls-if-KTLS.patch
@@ -0,0 +1,48 @@
+From: Daniel-Constantin Mierla <miconda@gmail.com>
+Date: Fri, 24 Nov 2023 10:38:49 +0100
+Subject: Makefile.groups: tlsa in packaging group ktls if
+ KTLS_INCLUDE_TLSA=yes
+
+- if not, then it is in separate group module_group_ktlsa
+
+(cherry picked from commit a49c8d8d968e31a539e47db6c06a0756e4be55e3)
+---
+ src/Makefile.groups | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/src/Makefile.groups b/src/Makefile.groups
+index df52698..0c74b3e 100644
+--- a/src/Makefile.groups
++++ b/src/Makefile.groups
+@@ -88,12 +88,12 @@ mod_list_memcached=memcached
+ # - modules depending on openssl library
+ mod_list_tlsdeps=crypto tls
+ 
+-# - modules depending on openssl (+curl) library
+-mod_list_tlsdeps_curl=auth_identity
+-
+ # - modules depending on static openssl library
+ mod_list_tlsa=tlsa
+ 
++# - modules depending on openssl (+curl) library
++mod_list_tlsdeps_curl=auth_identity
++
+ # - modules depending on static wolfssl library
+ mod_list_tls_wolfssl=tls_wolfssl
+ 
+@@ -414,11 +414,13 @@ module_group_kmemcached=$(mod_list_memcached)
+ # pkg tls module
+ module_group_ktls_basic=$(mod_list_tlsdeps)
+ 
++ifeq ($(KTLS_INCLUDE_TLSA),yes)
+ # pkg tls module with curl
+-module_group_ktls=$(mod_list_tlsdeps) $(mod_list_tlsdeps_curl)
+-
++module_group_ktls=$(mod_list_tlsdeps) $(mod_list_tlsdeps_curl) $(mod_list_tlsa)
++else
+ # pkg tlsa module
+ module_group_ktlsa=$(mod_list_tlsa)
++endif
+ 
+ # pkg tls_wolfssl module
+ module_group_ktls_wolfssl=$(mod_list_tls_wolfssl)
diff --git a/debian/rules b/debian/rules
index 0c0d375ef..9625839d0 100755
--- a/debian/rules
+++ b/debian/rules
@@ -98,6 +98,10 @@ export RADCLI = 1
 else
 export FREERADIUS = 1
 endif
+# tlsa
+export KTLS_INCLUDE_TLSA=yes
+export LIBSSL_STATIC_SRCLIB=yes
+export LIBSSL_STATIC_SRCPATH=/usr/$(LIBDIR)
 
 # FTBFS on powerpcspe because of AltiVec assumption #729635.
 ifeq ($(DEB_HOST_ARCH),powerpcspe)