diff --git a/tools/workspace/spral_internal/patches/upstream/pointer_math_undefined_behavior.patch b/tools/workspace/spral_internal/patches/upstream/pointer_math_undefined_behavior.patch
deleted file mode 100644
index 1c0f7e997e30..000000000000
--- a/tools/workspace/spral_internal/patches/upstream/pointer_math_undefined_behavior.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-[spral] Fix undefined behavior in LDLT
-
-When m==n the failed_rect.data() is nullptr, but then we subtract some
-integer (e.g., 80 bytes) from it. Doing arithmetic on a null pointer
-is undefined behavior. Clang's undefined Behavior sanitizer says
-ldlt_app.cxx:2420:38: runtime error: applying non-zero offset 18446744073709551536 to null pointer
-
-The copy_failed_rect ends up being a no-op because m==rfrom, but it's
-still UB to do arithmetic on nullptr, even if never de-referenced.
-
---- src/ssids/cpu/kernels/ldlt_app.cxx
-+++ src/ssids/cpu/kernels/ldlt_app.cxx
-@@ -2414,12 +2414,14 @@
-             }
-             // Rectangular part
-             // (be careful with blocks that contain both diag and rect parts)
--            copy_failed_rect(
--                  get_nrow(nblk-1, m, block_size), get_ncol(jblk, n, block_size),
--                  get_ncol(nblk-1, n, block_size), cdata[jblk],
--                  failed_rect.data() + (jfail*(m-n)+(nblk-1)*block_size-n), m-n,
--                  &a[jblk*block_size*lda+(nblk-1)*block_size], lda
--                  );
-+            if (m > n) {
-+               copy_failed_rect(
-+                     get_nrow(nblk-1, m, block_size), get_ncol(jblk, n, block_size),
-+                     get_ncol(nblk-1, n, block_size), cdata[jblk],
-+                     failed_rect.data() + (jfail*(m-n)+(nblk-1)*block_size-n), m-n,
-+                     &a[jblk*block_size*lda+(nblk-1)*block_size], lda
-+                     );
-+            }
-             for(int iblk=nblk; iblk<mblk; ++iblk) {
-                copy_failed_rect(
-                      get_nrow(iblk, m, block_size),
diff --git a/tools/workspace/spral_internal/patches/upstream/pr222.patch b/tools/workspace/spral_internal/patches/upstream/pr222.patch
new file mode 100644
index 000000000000..a849f8479b2b
--- /dev/null
+++ b/tools/workspace/spral_internal/patches/upstream/pr222.patch
@@ -0,0 +1,34 @@
+[spral] Cherry-pick of https://github.com/ralna/spral/pull/222
+
+We can drop this patch once we upgrade to a release that contains it.
+
+From: Jeremy Nimmer <jeremy.nimmer@tri.global>
+Date: Tue, 7 Jan 2025 10:09:01 -0800
+Subject: [PATCH] Fix undefined behavior in LDLT
+
+When m==n the failed_rect.data() is nullptr, but then we still
+subtract some small integer from it. Doing arithmetic on a null
+pointer is undefined behavior. Clang's undefined Behavior sanitizer
+says ldlt_app.cxx:2420:38: runtime error: applying non-zero offset
+18446744073709551536 to null pointer
+
+The copy_failed_rect ends up being a no-op because m==rfrom, but it's
+still UB to do arithmetic on nullptr, even if never de-referenced.
+
+--- src/ssids/cpu/kernels/ldlt_app.cxx
++++ src/ssids/cpu/kernels/ldlt_app.cxx
+@@ -2415,10 +2415,10 @@ class LDLT {
+             // Rectangular part
+             // (be careful with blocks that contain both diag and rect parts)
+             copy_failed_rect(
+-                  get_nrow(nblk-1, m, block_size), get_ncol(jblk, n, block_size),
+-                  get_ncol(nblk-1, n, block_size), cdata[jblk],
+-                  failed_rect.data() + (jfail*(m-n)+(nblk-1)*block_size-n), m-n,
+-                  &a[jblk*block_size*lda+(nblk-1)*block_size], lda
++                  get_nrow(nblk-1, m, block_size) - get_nrow(nblk-1, n, block_size),
++                  get_ncol(jblk, n, block_size), 0, cdata[jblk],
++                  failed_rect.data() + jfail*(m-n), m-n,
++                  &a[jblk*block_size*lda+n], lda
+                   );
+             for(int iblk=nblk; iblk<mblk; ++iblk) {
+                copy_failed_rect(
diff --git a/tools/workspace/spral_internal/repository.bzl b/tools/workspace/spral_internal/repository.bzl
index 6740bcac7701..77ca3796a593 100644
--- a/tools/workspace/spral_internal/repository.bzl
+++ b/tools/workspace/spral_internal/repository.bzl
@@ -10,7 +10,7 @@ def spral_internal_repository(
         sha256 = "0795c10c1c4dab1cf8c2de4024296d75d9d83b7525e82c77584c16060e29e4f5",  # noqa
         build_file = ":package.BUILD.bazel",
         patches = [
-            ":patches/upstream/pointer_math_undefined_behavior.patch",
+            ":patches/upstream/pr222.patch",
             ":patches/drake_vendor.patch",
             ":patches/no_fortran_profiling.patch",
         ],