diff --git a/srcpkgs/openssh/patches/openssh-6.8_p1-ssh-keygen-no-ssh1.patch b/srcpkgs/openssh/patches/openssh-6.8_p1-ssh-keygen-no-ssh1.patch
new file mode 100644
index 0000000000..f715f5c12e
--- /dev/null
+++ b/srcpkgs/openssh/patches/openssh-6.8_p1-ssh-keygen-no-ssh1.patch
@@ -0,0 +1,17 @@
+https://bugs.gentoo.org/544078
+https://bugzilla.mindrot.org/show_bug.cgi?id=2369
+
+do not try to generate rsa1 keys when ssh1 support is disabled
+
+--- ssh-keygen.c
++++ ssh-keygen.c
+@@ -948,7 +948,9 @@ do_gen_all_hostkeys(struct passwd *pw)
+ 		char *key_type_display;
+ 		char *path;
+ 	} key_types[] = {
++#ifdef WITH_SSH1
+ 		{ "rsa1", "RSA1", _PATH_HOST_KEY_FILE },
++#endif
+ 		{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
+ 		{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
+ #ifdef OPENSSL_HAS_ECC
diff --git a/srcpkgs/openssh/template b/srcpkgs/openssh/template
index f2223fc008..a686350f45 100644
--- a/srcpkgs/openssh/template
+++ b/srcpkgs/openssh/template
@@ -1,7 +1,7 @@
 # Template file for 'openssh'
 pkgname=openssh
 version=6.8p1
-revision=4
+revision=5
 build_style=gnu-configure
 configure_args="--sbindir=/usr/bin --datadir=/usr/share/openssh
  --sysconfdir=/etc/ssh --without-selinux --with-privsep-user=nobody