diff --git a/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
new file mode 100644
index 000000000000..b894586077ee
--- /dev/null
+++ b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
@@ -0,0 +1,44 @@
+From 7dcb837f5f953206eead3d28144c3d0e2af85c2c Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Mon, 20 Jul 2026 22:48:38 -0400
+Subject: [PATCH] Select PKCS#1 padding for XML signatures
+
+The rsa-sha* XML Signature algorithms require RSASSA-PKCS1-v1_5.
+Select that padding explicitly instead of relying on the RSA module's
+signing default, which is PSS in recent releases.
+
+Require Crypt::OpenSSL::RSA 0.38, the first release whose signing path
+honors the explicit padding choice.
+
+Assisted-by: Codex
+---
+ cpanfile           | 2 +-
+ lib/Mojo/XMLSig.pm | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/cpanfile b/cpanfile
+index 6c56caf..149f4a6 100644
+--- a/cpanfile
++++ b/cpanfile
+@@ -1,5 +1,5 @@
+ requires 'Mojolicious', '7.78'; # tag_to_html
+-requires 'Crypt::OpenSSL::RSA';
++requires 'Crypt::OpenSSL::RSA', '0.38';
+ requires 'Crypt::OpenSSL::X509';
+ requires 'Data::GUID';
+ requires 'Digest::SHA';
+diff --git a/lib/Mojo/XMLSig.pm b/lib/Mojo/XMLSig.pm
+index 3ee9db3..2498bbe 100644
+--- a/lib/Mojo/XMLSig.pm
++++ b/lib/Mojo/XMLSig.pm
+@@ -91,6 +91,7 @@ my $set_algo = sub {
+     unless $key->$isa('Crypt::OpenSSL::RSA');
+   Carp::croak 'Unsupported RSA algorithm'
+     unless my $method = $key->can("use_${algo}_hash");
++  $key->use_pkcs1_padding;
+   $key->$method;
+   return $key;
+ };
+-- 
+2.54.0
+
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f0a2e666ff9d..7b8da85adab3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7702,17 +7702,21 @@ with self;
 
   CryptOpenSSLRSA = buildPerlPackage {
     pname = "Crypt-OpenSSL-RSA";
-    version = "0.35";
+    version = "0.41";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-0.35.tar.gz";
-      hash = "sha256-XuvVWsBxY0yGSo549c+vuq9Dz4TAQyOgm3Hddr8CXMI=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-OpenSSL-RSA-0.41.tar.gz";
+      hash = "sha256-gvqDmJe4jpwkW2Jl874m07yHnK5MeoFR+tSjB8M2aCI=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLBignum
+      CryptOpenSSLRandom
+    ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
+      homepage = "https://github.com/cpan-authors/Crypt-OpenSSL-RSA";
       description = "RSA encoding and decoding, using the openSSL libraries";
       license = with lib.licenses; [
         artistic1
@@ -22941,6 +22945,9 @@ with self;
       url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-SAML-0.07.tar.gz";
       hash = "sha256-csJMrNtvHXp14uqgBDfHFKv1eafSENSqTT8g8e/0cQ0=";
     };
+    patches = [
+      ../development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
+    ];
     buildInputs = [ ModuleBuildTiny ];
     propagatedBuildInputs = [
       CryptOpenSSLRSA