diff --git a/debian/patches/0039-relax-nokogiri.patch b/debian/patches/0039-relax-nokogiri.patch
new file mode 100644
index 0000000000..f5308f1f81
--- /dev/null
+++ b/debian/patches/0039-relax-nokogiri.patch
@@ -0,0 +1,15 @@
+Bug: https://gitlab.com/gitlab-org/gitlab-ce/issues/13218
+
+Index: gitlab/Gemfile
+===================================================================
+--- gitlab.orig/Gemfile
++++ gitlab/Gemfile
+@@ -104,7 +104,7 @@ gem 'rouge',         '~> 1.10.1'
+ 
+ # See https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
+ # and https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
+-gem 'nokogiri', '1.6.7.2'
++gem 'nokogiri', '~> 1.6.7', '>= 1.6.7.2'
+ 
+ # Diffs
+ gem 'diffy', '~> 3.0.3'
diff --git a/debian/patches/series b/debian/patches/series
index fa3f064f87..ab8a6fd08f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,6 +8,7 @@
 0028-loosen-ace-rails-ap.patch
 0037-loosen-request-store.patch
 0038-relax-net-ssh.patch
+0039-relax-nokogiri.patch
 0100-remove-development-test.patch
 0102-loosen-octokit.patch
 0108-make-mysql-optional.patch