diff --git a/confluent_server/confluent/config/configmanager.py b/confluent_server/confluent/config/configmanager.py
index c165278a..d41e13cf 100644
--- a/confluent_server/confluent/config/configmanager.py
+++ b/confluent_server/confluent/config/configmanager.py
@@ -69,7 +69,15 @@ import confluent.netutil as netutil
 import confluent.exceptions as exc
 import confluent.log
 import copy
-import crypt
+try:
+    import crypt
+except ImportError:
+    # crypt left the stdlib in 3.13. Both of these reach the same libcrypt
+    # call and give the same hash; distros package one, the other, or neither.
+    try:
+        import legacycrypt as crypt
+    except ImportError:
+        import crypt_r as crypt
 try:
     import cPickle
 except ModuleNotFoundError:
diff --git a/confluent_server/confluent/selfservice.py b/confluent_server/confluent/selfservice.py
index 5a98291f..9960646c 100644
--- a/confluent_server/confluent/selfservice.py
+++ b/confluent_server/confluent/selfservice.py
@@ -15,7 +15,15 @@ import confluent.discovery.core as disco
 import base64
 import hmac
 import hashlib
-import crypt
+try:
+    import crypt
+except ImportError:
+    # crypt left the stdlib in 3.13. Both of these reach the same libcrypt
+    # call and give the same hash; distros package one, the other, or neither.
+    try:
+        import legacycrypt as crypt
+    except ImportError:
+        import crypt_r as crypt
 import json
 import os
 import tempfile
diff --git a/confluent_server/confluent_server.spec.tmpl b/confluent_server/confluent_server.spec.tmpl
index 36ec2f21..3699be77 100644
--- a/confluent_server/confluent_server.spec.tmpl
+++ b/confluent_server/confluent_server.spec.tmpl
@@ -17,6 +17,12 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot
 Prefix: %{_prefix}
 BuildArch: noarch
 Requires: confluent_vtbufferd
+%if 0%{?python3_version_nodots} >= 313
+# 3.13 removed crypt from the stdlib, and stored credentials are hashed with
+# it. Recommends rather than Requires: some 3.13 distros package no candidate
+# at all, where a hard dependency would make the rpm uninstallable.
+Recommends: python3-legacycrypt
+%endif
 %if "%{dist}" == ".el9"
 Requires: python3-asyncssh, python3-cryptography, confluent_client == %{version}, python3-pyparsing, python3-webauthn, python3-netifaces, python3-pyasn1 >= 0.2.3, python3-pysnmp >= 4.3.4, python3-lxml, python3-eficompressor, python3-setuptools, python3-dateutil, python3-cffi, python3-pyOpenSSL python3-msgpack python3-libarchive-c python3-yaml python3-yarl python3-aiohttp openssl iproute
 %else