diff --git a/nursery/encrypt-data-using-rc4-via-systemfunction032.yml b/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
index de987f86..ffa79dd0 100644
--- a/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
+++ b/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
@@ -21,6 +21,6 @@ rule:
       - and:
         - match: link function at runtime on Windows
         - string: "SystemFunction032"
-        - or:
+        - optional:
           - string: /advapi32/i
           - string: /cryptsp/i