diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index 324bb21f4d51..641941e7f38d 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -1,69 +1,94 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
 , asn1crypto
+, buildPythonPackage
 , click
-, oscrypto
-, pyyaml
-, python-dateutil
-, tzlocal
-, pytest-aiohttp
-, pytz
+, cryptography
+, fetchFromGitHub
 , freezegun
 , jinja2
+, oscrypto
 , pyhanko-certvalidator
+, pytest-aiohttp
+, pytestCheckHook
+, python-dateutil
+, python-pkcs11
+, pythonOlder
+, pytz
+, pyyaml
 , requests
 , requests-mock
+, setuptools
+, tzlocal
 , werkzeug
-, pytestCheckHook
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.9.1";
-  format = "setuptools";
+  version = "0.11.0";
+  format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
-  # Tests are only available on GitHub
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certomancer";
-    rev = version;
-    sha256 = "4v2e46ZrzhKXpMULj0vmDRoLOypi030eaADAYjLMg5M=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UQV0Tk4C5b5iBZ34Je59gK2dLTaJusnpxdyNicIh2Q8=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ' "pytest-runner",' "" \
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [
     asn1crypto
     click
     oscrypto
-    pyyaml
     python-dateutil
+    pyyaml
     tzlocal
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py --replace ", 'pytest-runner'" ""
-  '';
+  passthru.optional-dependencies = {
+    requests-mocker = [
+      requests-mock
+    ];
+    web-api = [
+      jinja2
+      werkzeug
+    ];
+    pkcs12 = [
+      cryptography
+    ];
+    pkcs11 = [
+      python-pkcs11
+    ];
+  };
 
   nativeCheckInputs = [
     freezegun
-    jinja2
     pyhanko-certvalidator
     pytest-aiohttp
+    pytestCheckHook
     pytz
     requests
-    requests-mock
-    werkzeug
-    pytestCheckHook
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   disabledTests = [
     # pyhanko_certvalidator.errors.DisallowedAlgorithmError
     "test_validate"
   ];
 
-  pythonImportsCheck = [ "certomancer" ];
+  pythonImportsCheck = [
+    "certomancer"
+  ];
 
   meta = with lib; {
     description = "Quickly construct, mock & deploy PKI test configurations using simple declarative configuration";
diff --git a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
index 9509f82494ca..5018f8f924a5 100644
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@@ -1,34 +1,38 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
 , aiohttp
 , asn1crypto
+, buildPythonPackage
 , cryptography
+, fetchFromGitHub
 , freezegun
-, oscrypto
-, requests
-, uritools
 , openssl
+, oscrypto
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
+, requests
+, setuptools
+, uritools
 }:
 
 buildPythonPackage rec {
   pname = "pyhanko-certvalidator";
-  version = "0.20.1";
-  format = "setuptools";
+  version = "0.23.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  # Tests are only available on GitHub
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certvalidator";
-    rev = version;
-    hash = "sha256-0RSveoSZb7R6d4cMlF1mIrDfnTx2DYNwfTMMtmg+RpM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-q2YxncyMHmbRmcoLb68huK02CYiKqF2CFRl8vkUfxg4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     asn1crypto
     cryptography
@@ -71,6 +75,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for validating X.509 certificates and paths";
     homepage = "https://github.com/MatthiasValvekens/certvalidator";
+    changelog = "https://github.com/MatthiasValvekens/certvalidator/blob/v${version}/changelog.md";
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
   };
diff --git a/pkgs/development/python-modules/pyhanko/default.nix b/pkgs/development/python-modules/pyhanko/default.nix
index a7f6d4aaf7e9..8db7aef6d192 100644
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -1,49 +1,58 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
+, aiohttp
 , asn1crypto
+, buildPythonPackage
+, certomancer
 , click
 , cryptography
+, defusedxml
+, fetchFromGitHub
+, fonttools
+, freezegun
+, oscrypto
+, pillow
 , pyhanko-certvalidator
+, pytest-aiohttp
+, pytestCheckHook
+, python-barcode
+, python-pae
+, python-pkcs11
+, pythonOlder
 , pytz
 , pyyaml
 , qrcode
 , requests
-, tzlocal
-, certomancer
-, freezegun
-, python-pae
-, pytest-aiohttp
 , requests-mock
-, pytestCheckHook
-
-# optionals
-, defusedxml
-, oscrypto
-, fonttools
+, setuptools
+, tzlocal
 , uharfbuzz
-, pillow
-, python-barcode
-, python-pkcs11
-, aiohttp
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pyhanko";
-  version = "0.17.0";
-  format = "setuptools";
+  version = "0.20.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  # Tests are only available on GitHub
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "pyHanko";
-    rev = "refs/tags/${version}";
-    hash = "sha256-tvb2zdmIN6MkezmLNkyCcP8EfqxrbPg/FEqgW16Ka6Q=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mWhkTVhq3bDkOlhUZIBBqwXUuQCXcFHW1haGOGMywzg=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ' "pytest-runner",' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [
     asn1crypto
     click
@@ -57,7 +66,7 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    extra_pubkey_algs = [
+    extra-pubkey-algs = [
       oscrypto
     ];
     xmp = [
@@ -74,16 +83,11 @@ buildPythonPackage rec {
     pkcs11 = [
       python-pkcs11
     ];
-    async_http = [
+    async-http = [
       aiohttp
     ];
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-runner'" "" \
-  '';
-
   nativeCheckInputs = [
     aiohttp
     certomancer
@@ -132,6 +136,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Sign and stamp PDF files";
     homepage = "https://github.com/MatthiasValvekens/pyHanko";
+    changelog = "https://github.com/MatthiasValvekens/pyHanko/blob/v${version}/docs/changelog.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
   };