diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index e7af069352ad..4784439df727 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   writeShellScript,
   dash,
+  gitMinimal,
   php,
   phpCfg ? null,
   withPostgreSQL ? true, # “strongly recommended” according to docs
@@ -44,13 +45,13 @@ let
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "movim";
-  version = "0.34";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E2n0YxNCaNEseGjLLhFDBdvrGg/XfzxU+T/rw/6Y/qY=";
+    hash = "sha256-2RWTx/mhMAi13v7BUfJmGvkPc4iqKdVR0B5rCbD5YaQ=";
   };
 
   php = php.buildEnv (
@@ -88,7 +89,26 @@ php.buildComposerProject2 (finalAttrs: {
     ++ lib.optional minify.style.enable lightningcss
     ++ lib.optional minify.svg.enable scour;
 
-  vendorHash = "sha256-Vs98gZAthDuYCdZiKSwmh+en4admfXSbDeoZXdbt8hQ=";
+  # Composer ≥2.8 defaults preferred-install to
+  # dist only (not auto), which prevents fallback
+  # to git clone when dist downloads fail (such as
+  # MS GitHub’s codeload.* in the build sandbox).
+  composerVendor = php.mkComposerVendor {
+    inherit (finalAttrs)
+      pname
+      src
+      version
+      vendorHash
+      php
+      ;
+
+    postPatch = ''
+      composer config preferred-install auto
+    '';
+    nativeBuildInputs = [ gitMinimal ];
+  };
+
+  vendorHash = "sha256-hSXi1jKilsfhe5P7ElGydxu6uxOpYNeRhHlZGzgkUXw=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;