diff --git a/buildutils/4480.patch b/buildutils/4480.patch
new file mode 100644
index 000000000..75bfbd874
--- /dev/null
+++ b/buildutils/4480.patch
@@ -0,0 +1,58 @@
+From 438d5d88392baffa6c2c5e0737d9de19d6686f0d Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyich@gmail.com>
+Date: Tue, 20 Dec 2022 21:45:16 +0000
+Subject: [PATCH] src/secure_allocator.hpp: define missing 'rebind' type
+
+`gcc-13` added an assert to standard headers to make sure custom
+allocators have intended implementation of rebind type instead
+of inherited rebind. gcc change:
+    https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=64c986b49558a7
+
+Without the fix build fails on this week's `gcc-13` as:
+
+    [ 92%] Building CXX object tests/CMakeFiles/test_security_curve.dir/test_security_curve.cpp.o
+    In file included from /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/ext/alloc_traits.h:34,
+                     from /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/stl_uninitialized.h:64,
+                     from /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/memory:69,
+                     from tests/../src/secure_allocator.hpp:42,
+                     from tests/../src/curve_client_tools.hpp:49,
+                     from tests/test_security_curve.cpp:53:
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/alloc_traits.h: In instantiation of 'struct std::__allocator_traits_base::__rebind<zmq::secure_allocator_t<unsigned char>, unsigned char, void>':
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/alloc_traits.h:94:11:   required by substitution of 'template<class _Alloc, class _Up> using std::__alloc_rebind = typename std::__allocator_traits_base::__rebind<_Alloc, _Up>::type [with _Alloc = zmq::secure_allocator_t<unsigned char>; _Up = unsigned char]'
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/alloc_traits.h:228:8:   required by substitution of 'template<class _Alloc> template<class _Tp> using std::allocator_traits< <template-parameter-1-1> >::rebind_alloc = std::__alloc_rebind<_Alloc, _Tp> [with _Tp = unsigned char; _Alloc = zmq::secure_allocator_t<unsigned char>]'
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/ext/alloc_traits.h:126:65:   required from 'struct __gnu_cxx::__alloc_traits<zmq::secure_allocator_t<unsigned char>, unsigned char>::rebind<unsigned char>'
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/stl_vector.h:88:21:   required from 'struct std::_Vector_base<unsigned char, zmq::secure_allocator_t<unsigned char> >'
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/stl_vector.h:423:11:   required from 'class std::vector<unsigned char, zmq::secure_allocator_t<unsigned char> >'
+    tests/../src/curve_client_tools.hpp:64:76:   required from here
+    /<<NIX>>/gcc-13.0.0/include/c++/13.0.0/bits/alloc_traits.h:70:31: error: static assertion failed: allocator_traits<A>::rebind_alloc<A::value_type> must be A
+       70 |                         _Tp>::value,
+          |                               ^~~~~
+
+The change adds trivial `rebind` definition with expected return type
+and satisfies conversion requirements.
+---
+ src/secure_allocator.hpp | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/secure_allocator.hpp b/src/secure_allocator.hpp
+index e0871dcc99..5e97368911 100644
+--- a/src/secure_allocator.hpp
++++ b/src/secure_allocator.hpp
+@@ -99,6 +99,17 @@ bool operator!= (const secure_allocator_t<T> &, const secure_allocator_t<U> &)
+ #else
+ template <typename T> struct secure_allocator_t : std::allocator<T>
+ {
++    secure_allocator_t () ZMQ_DEFAULT;
++
++    template <class U>
++    secure_allocator_t (const secure_allocator_t<U> &) ZMQ_NOEXCEPT
++    {
++    }
++
++    template <class U> struct rebind
++    {
++        typedef secure_allocator_t<U> other;
++    };
+ };
+ #endif
+ }
diff --git a/buildutils/bundle.py b/buildutils/bundle.py
index 6ee4d9694..c01f10e47 100644
--- a/buildutils/bundle.py
+++ b/buildutils/bundle.py
@@ -15,7 +15,7 @@
 import shutil
 import sys
 import zipfile
-from subprocess import PIPE, Popen
+from subprocess import PIPE, Popen, run
 from tempfile import TemporaryDirectory
 from unittest import mock
 from urllib.request import urlopen
@@ -138,7 +138,14 @@ def fetch_archive(savedir, url, fname, checksum, force=False):
 # -----------------------------------------------------------------------------
 
 
-def fetch_and_extract(savedir, extract_to, url, fname, checksum):
+def apply_patch(path, patch_file):
+    """apply a single patch to a directory"""
+    info(f"patching {path} with {patch_file}")
+    with open(patch_file) as f:
+        run(["patch", "-p1"], stdin=f, check=True, cwd=path)
+
+
+def fetch_and_extract(savedir, extract_to, url, fname, checksum, patches=None):
     """Download and extract an archive"""
     dest = pjoin(savedir, extract_to)
     if os.path.exists(dest):
@@ -150,14 +157,23 @@ def fetch_and_extract(savedir, extract_to, url, fname, checksum):
         with_version = pjoin(savedir, zf.namelist()[0])
     # remove version suffix:
     shutil.move(with_version, dest)
+    # apply patches, if any
+    for patch_file in patches or []:
+        apply_patch(dest, patch_file)
     # remove archive when we are done
     os.remove(archive)
+    return dest
 
 
 def fetch_libzmq(savedir):
     """download and extract libzmq"""
     fetch_and_extract(
-        savedir, 'zeromq', url=libzmq_url, fname=libzmq, checksum=libzmq_checksum
+        savedir,
+        'zeromq',
+        url=libzmq_url,
+        fname=libzmq,
+        checksum=libzmq_checksum,
+        patches=[pjoin(HERE, "4480.patch")],
     )