diff --git a/pkgs/by-name/pi/picotool/package.nix b/pkgs/by-name/pi/picotool/package.nix
index 2e60a2b57e80..c1051c67040c 100644
--- a/pkgs/by-name/pi/picotool/package.nix
+++ b/pkgs/by-name/pi/picotool/package.nix
@@ -6,30 +6,22 @@
   pkg-config,
   libusb1,
   pico-sdk,
-  mbedtls_2,
+  mbedtls,
   versionCheckHook,
   gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "picotool";
-  version = "2.1.1";
+  version = "2.2.0-a4";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "picotool";
     tag = finalAttrs.version;
-    hash = "sha256-WA17FXSUGylzUcbvzgAGCeds+XeuSvDlgFBJD10ERVY=";
+    hash = "sha256-kIB/ODAvwWWoAQDq2cMiFuNWjzzLgPuRQv0NluWYU+Y=";
   };
 
-  postPatch = ''
-    # necessary for signing/hashing support. our pico-sdk does not come with
-    # it by default, and it shouldn't due to submodule size. pico-sdk uses
-    # an upstream version of mbedtls 2.x so we patch ours in directly.
-    substituteInPlace lib/CMakeLists.txt \
-      --replace-fail "''$"'{PICO_SDK_PATH}/lib/mbedtls' '${mbedtls_2.src}'
-  '';
-
   buildInputs = [
     libusb1
     pico-sdk
@@ -38,11 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
   ];
-  cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk" ];
-
-  postInstall = ''
-    install -Dm444 ../udev/99-picotool.rules -t $out/etc/udev/rules.d
-  '';
+  cmakeFlags = [
+    "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk"
+  ];
 
   nativeInstallCheckInputs = [
     versionCheckHook