diff --git a/bind.spec b/bind.spec
index 4563938..9e1fb0a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -39,7 +39,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.3
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -138,7 +138,10 @@ BuildRequires:  libdb-devel
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  libatf-c-devel kyua-cli softhsm
+BuildRequires:  libatf-c-devel kyua-cli
+%endif
+%if %{with PKCS11}
+BuildRequires:  softhsm
 %endif
 %if %{with SYSTEMTEST}
 # bin/tests/system dependencies
@@ -166,6 +169,7 @@ Summary: Bind with native PKCS#11 functionality for crypto
 Requires: systemd
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Recommends: softhsm
 
 %description pkcs11
 This is a version of BIND server built with native PKCS#11 functionality.
@@ -1351,6 +1355,10 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Wed Mar 21 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-3.b1
+- Fix build with disabled unittest
+- Recommend softhsm from pkcs11 variant
+
 * Thu Feb 22 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-2.b1
 - Require openssl-devel and libcap-devel from bind-export-devel
 - Conflict with bind99-devel