diff --git a/depends/packages/zeromq.mk b/depends/packages/zeromq.mk
index d3bd3da6c7..d71351e62c 100644
--- a/depends/packages/zeromq.mk
+++ b/depends/packages/zeromq.mk
@@ -5,6 +5,7 @@ $(package)_file_name=$(package)-$($(package)_version).tar.gz
 $(package)_sha256_hash=6653ef5910f17954861fe72332e68b03ca6e4d9c7160eb3a8de5a5a913bfab43
 $(package)_patches = remove_libstd_link.patch
 $(package)_patches += macos_mktemp_check.patch
+$(package)_patches += builtin_sha1.patch
 
 define $(package)_set_vars
   $(package)_config_opts = --without-docs --disable-shared --disable-valgrind
@@ -16,7 +17,8 @@ endef
 
 define $(package)_preprocess_cmds
   patch -p1 < $($(package)_patch_dir)/remove_libstd_link.patch && \
-  patch -p1 < $($(package)_patch_dir)/macos_mktemp_check.patch
+  patch -p1 < $($(package)_patch_dir)/macos_mktemp_check.patch && \
+  patch -p1 < $($(package)_patch_dir)/builtin_sha1.patch
 endef
 
 define $(package)_config_cmds
diff --git a/depends/patches/zeromq/builtin_sha1.patch b/depends/patches/zeromq/builtin_sha1.patch
new file mode 100644
index 0000000000..5481c9dbdd
--- /dev/null
+++ b/depends/patches/zeromq/builtin_sha1.patch
@@ -0,0 +1,17 @@
+Don't use builtin sha1 if not using ws
+
+The builtin SHA1 (ZMQ_USE_BUILTIN_SHA1) is only used in the websocket
+engine (ws_engine.cpp).
+Upstreamed in https://github.com/zeromq/libzmq/pull/4670.
+
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -234,7 +234,7 @@ if(NOT ZMQ_USE_GNUTLS)
+       endif()
+     endif()
+   endif()
+-  if(NOT ZMQ_USE_NSS)
++  if(ENABLE_WS AND NOT ZMQ_USE_NSS)
+     list(APPEND sources ${CMAKE_CURRENT_SOURCE_DIR}/external/sha1/sha1.c
+          ${CMAKE_CURRENT_SOURCE_DIR}/external/sha1/sha1.h)
+     message(STATUS "Using builtin sha1")