diff --git a/CHANGES b/CHANGES
index b32f694647771d023a14a0e50107d7b0f199a39c..7aac8833a5111c370e9962d9e394378d4f00b89c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -17,6 +17,7 @@ OpenLDAP 2.4.11 Engineering
 	Fixed slapo-ppolicy DNs with whitespaces (ITS#5552)
 	Fixed slapo-syncprov ACL evaluation (ITS#5548)
 	Fixed slapo-syncprov full reload (ITS#5564)
+	Fixed slapo-unique filter normalization (ITS#5581)
 	Fixed contrib smbk5pwd terminator (ITS#5575)
 	Build Environment
 		Fixed test048 to skip if threads is not available (ITS#5529)
diff --git a/servers/slapd/overlays/unique.c b/servers/slapd/overlays/unique.c
index e5c8238291bd27a8e1941d6a64019c3e36f82ebf..af39de3ab2dcf827efb75ebd61addc8f67d7e7df 100644
--- a/servers/slapd/overlays/unique.c
+++ b/servers/slapd/overlays/unique.c
@@ -238,15 +238,15 @@ unique_new_domain_uri ( unique_domain_uri **urip,
 	}
 
 	if (url_desc->lud_filter) {
-		Filter * f;
-		ber_str2bv( url_desc->lud_filter, 0, 1, &uri->filter );
-		f = str2filter( uri->filter.bv_val );
+		Filter *f = str2filter( url_desc->lud_filter );
 		if ( !f ) {
 			snprintf( c->cr_msg, sizeof( c->cr_msg ),
 				  "unique: bad filter");
 			rc = ARG_BAD_CONF;
 			goto exit;
 		}
+		/* make sure the strfilter is in normal form (ITS#5581) */
+		filter2bv( f, &uri->filter );
 		filter_free( f );
 	}
 exit: