diff --git a/pkgs/development/python-modules/ldap/0001-Check-whether-libldap-is-threadsafe-on-startup.patch b/pkgs/development/python-modules/ldap/0001-Check-whether-libldap-is-threadsafe-on-startup.patch
new file mode 100644
index 00000000000..f2b7812cf70
--- /dev/null
+++ b/pkgs/development/python-modules/ldap/0001-Check-whether-libldap-is-threadsafe-on-startup.patch
@@ -0,0 +1,94 @@
+From 3593e2c299c0ac0402f23d44cdbe8e6ff3687b68 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
+Date: Thu, 27 Jan 2022 10:35:56 +0000
+Subject: [PATCH] Check whether libldap is threadsafe on startup.
+
+Closes #432
+---
+ Lib/ldap/constants.py |  2 --
+ Modules/constants.c   | 10 ++++++++++
+ setup.cfg             |  6 ++++--
+ setup.py              |  1 -
+ 4 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
+index 1c1d76a..f76609b 100644
+--- a/Lib/ldap/constants.py
++++ b/Lib/ldap/constants.py
+@@ -341,9 +341,7 @@ CONSTANTS = (
+     # XXX - these should be errors
+     Int('URL_ERR_BADSCOPE'),
+     Int('URL_ERR_MEM'),
+-    # Int('LIBLDAP_R'),
+ 
+-    Feature('LIBLDAP_R', 'HAVE_LIBLDAP_R'),
+     Feature('SASL_AVAIL', 'HAVE_SASL'),
+     Feature('TLS_AVAIL', 'HAVE_TLS'),
+     Feature('INIT_FD_AVAIL', 'HAVE_LDAP_INIT_FD'),
+diff --git a/Modules/constants.c b/Modules/constants.c
+index 07d6065..8d6f63b 100644
+--- a/Modules/constants.c
++++ b/Modules/constants.c
+@@ -197,6 +197,8 @@ int
+ LDAPinit_constants(PyObject *m)
+ {
+     PyObject *exc, *nobj;
++    struct ldap_apifeature_info info = { 1, "X_OPENLDAP_THREAD_SAFE", 0 };
++    int thread_safe = 0;
+ 
+     /* simple constants */
+ 
+@@ -221,6 +223,14 @@ LDAPinit_constants(PyObject *m)
+         return -1;
+     Py_INCREF(LDAPexception_class);
+ 
++#ifdef LDAP_API_FEATURE_X_OPENLDAP_THREAD_SAFE
++    if (ldap_get_option(NULL, LDAP_OPT_API_FEATURE_INFO, &info) == LDAP_SUCCESS) {
++        thread_safe = (info.ldapaif_version == 1);
++    }
++#endif
++    if (PyModule_AddIntConstant(m, "LIBLDAP_R", thread_safe) != 0)
++        return -1;
++
+     /* Generated constants -- see Lib/ldap/constants.py */
+ 
+ #define add_err(n) do {  \
+diff --git a/setup.cfg b/setup.cfg
+index 2e372ba..a75f186 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -5,7 +5,9 @@ license_file = LICENCE
+ defines = HAVE_SASL HAVE_TLS HAVE_LIBLDAP_R
+ extra_compile_args = 
+ extra_objects = 
+-libs = ldap_r lber
++# Uncomment this if your libldap is not thread-safe and you need libldap_r
++# instead
++#libs = ldap_r lber
+ 
+ [install]
+ compile = 1
+@@ -13,7 +15,7 @@ optimize = 1
+ 
+ [bdist_rpm]
+ provides = python-ldap
+-requires = python libldap-2_4
++requires = python libldap-2
+ vendor = python-ldap project
+ packager = python-ldap team
+ distribution_name = openSUSE 11.x
+diff --git a/setup.py b/setup.py
+index 119b571..b193957 100644
+--- a/setup.py
++++ b/setup.py
+@@ -132,7 +132,6 @@ setup(
+       extra_objects = LDAP_CLASS.extra_objects,
+       runtime_library_dirs = (not sys.platform.startswith("win"))*LDAP_CLASS.library_dirs,
+       define_macros = LDAP_CLASS.defines + \
+-        ('ldap_r' in LDAP_CLASS.libs or 'oldap_r' in LDAP_CLASS.libs)*[('HAVE_LIBLDAP_R',None)] + \
+         ('sasl' in LDAP_CLASS.libs or 'sasl2' in LDAP_CLASS.libs or 'libsasl' in LDAP_CLASS.libs)*[('HAVE_SASL',None)] + \
+         ('ssl' in LDAP_CLASS.libs and 'crypto' in LDAP_CLASS.libs)*[('HAVE_TLS',None)] + \
+         [
+-- 
+2.36.0
+
diff --git a/pkgs/development/python-modules/ldap/default.nix b/pkgs/development/python-modules/ldap/default.nix
index f9acc0a7674..b58f6bafed5 100644
--- a/pkgs/development/python-modules/ldap/default.nix
+++ b/pkgs/development/python-modules/ldap/default.nix
@@ -12,6 +12,10 @@ buildPythonPackage rec {
     sha256 = "60464c8fc25e71e0fd40449a24eae482dcd0fb7fcf823e7de627a6525b3e0d12";
   };
 
+  patches = [
+    ./0001-Check-whether-libldap-is-threadsafe-on-startup.patch
+  ];
+
   propagatedBuildInputs = [ pyasn1 pyasn1-modules ];
 
   checkInputs = [ pytestCheckHook ];