diff --git a/Lmod-8.7.31-SEC-M-settarg.patch b/Lmod-8.7.31-SEC-M-settarg.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8d6e497717c2487347ad985a7a9d321a7e34dea3
--- /dev/null
+++ b/Lmod-8.7.31-SEC-M-settarg.patch
@@ -0,0 +1,31 @@
+From 6cd15a23fca2ee7cd251c9137ed6ac1d8001226c Mon Sep 17 00:00:00 2001
+From: Robert McLay <mclay@zaniahgroup.com>
+Date: Fri, 3 Jul 2026 18:06:16 -0500
+Subject: [PATCH] Protect settarg from broken LD_LIBRARY_PATH, LD_PRELOAD
+
+---
+ init/bash.in | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+Adapted-by: PkgAgent (modified to adapt to Lmod 8.7.31 which lacks __lmod_internal_module_cmd and --protected_vars infrastructure)
+diff --git a/init/bash.in b/init/bash.in
+index 29ccd0f..894faa9 100644
+--- a/init/bash.in
++++ b/init/bash.in
+@@ -81,7 +81,7 @@ if [ "@silence_shell_debugging@" = "no" ]; then
+    {
+      ############################################################
+      # Run Lmod and eval results
+-     eval "$($LMOD_CMD @my_shell@ "$@")" && eval $(${LMOD_SETTARG_CMD:-:} -s sh)
++     eval "$($LMOD_CMD @my_shell@ "$@")" && eval $(LD_LIBRARY_PATH=@sys_ld_lib_path@ LD_PRELOAD=@sys_ld_preload@ ${LMOD_SETTARG_CMD:-:} -s sh)
+    }
+ else
+    module()
+@@ -103,7 +103,7 @@ else
+ 
+      ############################################################
+      # Run Lmod and eval results
+-     eval "$($LMOD_CMD shell "$@")" && eval "$(${LMOD_SETTARG_CMD:-:} -s sh)"
++     eval "$($LMOD_CMD shell "$@")" && eval "$(LD_LIBRARY_PATH=@sys_ld_lib_path@ LD_PRELOAD=@sys_ld_preload@ ${LMOD_SETTARG_CMD:-:} -s sh)"
+      __lmod_my_status=$?
+ 
+      ############################################################
diff --git a/Lmod.spec b/Lmod.spec
index 41a8002d00ede371e39f443dba58cdc02a68959b..d66f2e203c2ca9113ce79cac4090e5485a99a770 100644
--- a/Lmod.spec
+++ b/Lmod.spec
@@ -3,13 +3,15 @@
 Summary:        Environmental Modules System in Lua
 Name:           Lmod
 Version:        8.7.31
-Release:        4%{?dist}
+Release:        5%{?dist}
 
 License:        MIT and LGPLv2
 URL:            https://www.tacc.utexas.edu/tacc-projects/lmod
 Source0:        https://github.com/TACC/Lmod/archive/%{version}/Lmod-%{version}.tar.gz
 Source1:        macros.%{name}
 
+Patch0001:      Lmod-8.7.31-SEC-M-settarg.patch
+
 BuildRequires: lua-term tcl-devel zsh make bc
 BuildRequires: gcc lua-devel lua-filesystem lua-json lua-posix
 
@@ -31,7 +33,7 @@ where the library and header files can be found.
 
 
 %prep
-%autosetup
+%autosetup -p1
 sed -i -e 's,/usr/bin/env ,/usr/bin/,' src/*.tcl
 rm -r pkgs/{luafilesystem,term} tools/json.lua
 sed -i -e '/^#!/d' init/*.in
@@ -95,6 +97,10 @@ fi
 
 
 %changelog
+* Tue Jul 07 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 8.7.31-5
+- [Type] security
+- [DESC] Protect settarg from broken LD_LIBRARY_PATH/LD_PRELOAD in bash module function (SEC-M)
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 8.7.31-4
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream