diff --git a/config.toml b/config.toml
new file mode 100644
index 0000000000000000000000000000000000000000..02369289646870f6c7d21289a01ad26c8983a4ea
--- /dev/null
+++ b/config.toml
@@ -0,0 +1,5 @@
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
diff --git a/python-bcrypt.spec b/python-bcrypt.spec
index 8e69301e315ba5604acade17abe66730ba00fd06..111b0cc1f032c69df8559b46c9f23c10d86698a9 100644
--- a/python-bcrypt.spec
+++ b/python-bcrypt.spec
@@ -1,11 +1,13 @@
 %global _empty_manifest_terminate_build 0
 Name:           python-bcrypt
 Version:        4.2.0
-Release:        1
+Release:        2
 Summary:        Modern password hashing for your software and your servers
 License:        Apache-2.0
 URL:            https://github.com/pyca/bcrypt/
 Source0:        %{pypi_source bcrypt}
+Source1:	vendor.tar.gz
+Source2:	config.toml
 %description
 Good password hashing for your software and your servers.
 This library should be compatible with py-bcrypt and it will run on Python 2.7, 3.4+, and PyPy 2.6+.
@@ -37,6 +39,10 @@ This library should be compatible with py-bcrypt and it will run on Python 2.7,
 
 %prep
 %autosetup -n bcrypt-%{version} -p1
+tar zxvf %{SOURCE1}
+mkdir .cargo
+cp %{SOURCE2} .cargo/
+
 
 %build
 %pyproject_build
@@ -59,6 +65,9 @@ pytest
 %{_docdir}/*
 
 %changelog
+* Fri Jan 24 2025 Shinwell Hu <micromotives@qq.com> - 4.2.0-2
+- Use "cargo vendor" to avoid network access during build phase.
+
 * Thu Oct 17 2024 jiangxinyu <jiangxinyu@kylinos.cn> - 4.2.0-1
 - Update package to version 4.2.0
 - Switch to using the new pyo3 syntax for declarative modules
diff --git a/vendor.tar.gz b/vendor.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e1742694984bd6bfb2b03e77aca38242d7e91d47
Binary files /dev/null and b/vendor.tar.gz differ