diff --git a/changes/bug21943 b/changes/bug21943
new file mode 100644
index 000000000..dbe2c726d
--- /dev/null
+++ b/changes/bug21943
@@ -0,0 +1,6 @@
+  o Minor bugfixes (Linux seccomp2 sandbox):
+    - The getpid() system call is now permitted under the Linux seccomp2
+      sandbox, to avoid crashing with versions of OpenSSL (and other
+      libraries) that attempt to learn the process's PID by using the
+      syscall rather than the VDSO code. Fixes bug 21943; bugfix on
+      0.2.5.1-alpha.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index ebc843e13..95c9f83b8 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -155,6 +155,7 @@ static int filter_nopar_gen[] = {
 #ifdef __NR_getgid32
     SCMP_SYS(getgid32),
 #endif
+    SCMP_SYS(getpid),
 #ifdef __NR_getrlimit
     SCMP_SYS(getrlimit),
 #endif