diff --git a/lang/python/tests/support.py b/lang/python/tests/support.py
index 37fdba9b..dc42a361 100644
--- a/lang/python/tests/support.py
+++ b/lang/python/tests/support.py
@@ -38,6 +38,12 @@ def assert_gpg_version(version=(2, 1, 0)):
                 c.engine_info.version, '.'.join(map(str, version))))
             sys.exit(77)
 
+def is_gpg_version(version):
+    with gpg.Context() as c:
+        clean_version = re.match(r'\d+\.\d+\.\d+',
+                                 c.engine_info.version).group(0)
+        return tuple(map(int, clean_version.split('.'))) == version
+
 
 def have_tofu_support(ctx, some_uid):
     keys = list(
diff --git a/lang/python/tests/t-encrypt-sym.py b/lang/python/tests/t-encrypt-sym.py
index 4389a7d4..d22e0103 100755
--- a/lang/python/tests/t-encrypt-sym.py
+++ b/lang/python/tests/t-encrypt-sym.py
@@ -44,8 +44,16 @@ for passphrase in ("abc", b"abc"):
     c.set_passphrase_cb(passphrase_cb, None)
 
     c.op_encrypt([], 0, source, cipher)
-    assert passphrase_cb_called == 1, \
-        "Callback called {} times".format(passphrase_cb_called)
+    # gpg 2.2.21 has a bug in that for a new passphrase the callback
+    # is called twice.  This is fixed in 2.2.22 but a patch was also
+    # distributed so that we allow both.
+    if support.is_gpg_version((2,2,21)):
+        print("Enabling GnuPG 2.2.21 bug 4991 test workaround.")
+        assert passphrase_cb_called == 1 or passphrase_cb_called == 2, \
+            "Callback called {} times".format(passphrase_cb_called)
+    else:
+        assert passphrase_cb_called == 1, \
+            "Callback called {} times".format(passphrase_cb_called)
     support.print_data(cipher)
 
     c = gpg.Context()