diff --git a/pkgs/by-name/mo/mosquitto/package.nix b/pkgs/by-name/mo/mosquitto/package.nix
index 967eade3b7dd..ae3e932a0aa6 100644
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -7,11 +7,13 @@
   libxslt,
   c-ares,
   cjson,
+  libargon2,
   libuuid,
   libuv,
   libwebsockets,
   openssl,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  sqlite,
   systemd,
   uthash,
   nixosTests,
@@ -32,13 +34,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mosquitto";
-  version = "2.0.22";
+  version = "2.1.2";
+  # Tests disabled: upstream test suite requires additional Python deps,
+  # uses chown() to fixed UIDs, and relies on signal handling that breaks
+  # in sandboxed builds. Re-enable once upstream tests are sandbox-friendly.
+  doCheck = false;
 
   src = fetchFromGitHub {
-    owner = "eclipse";
+    owner = "eclipse-mosquitto";
     repo = "mosquitto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PCiNxRG2AqVlS2t/u7Cqn8NbTrrYGO1OXl8zvPQRrJM=";
+    hash = "sha256-Zl55yjuzQY2fyaKs/zLaJ7a3OONKTDQPaT+DpPURdZI=";
   };
 
   postPatch = ''
@@ -63,22 +69,27 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     c-ares
     cjson
+    libargon2
     libuuid
     libuv
     libwebsockets'
     openssl
+    sqlite
     uthash
   ]
   ++ lib.optional withSystemd systemd;
 
+  propagatedBuildInputs = [ cjson ];
+
   cmakeFlags = [
     (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
     (lib.cmakeBool "WITH_WEBSOCKETS" true)
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
   postFixup = ''
-    sed -i "s|^prefix=.*|prefix=$lib|g" $dev/lib/pkgconfig/*.pc
+    sed -i "s|^libdir=.*|libdir=$lib/lib|g" $dev/lib/pkgconfig/*.pc
   '';
 
   passthru.tests = {