diff --git a/pkgs/development/libraries/libpam-wrapper/default.nix b/pkgs/development/libraries/libpam-wrapper/default.nix
index 0701ae0fc55f..6ea6229f4dda 100644
--- a/pkgs/development/libraries/libpam-wrapper/default.nix
+++ b/pkgs/development/libraries/libpam-wrapper/default.nix
@@ -1,23 +1,34 @@
-{ lib, stdenv
-, fetchgit
-, cmake
-, linux-pam
-, enablePython ? false
-, python ? null
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  linux-pam,
+  substituteAll,
+  enablePython ? false,
+  python ? null,
 }:
 
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
   pname = "libpam-wrapper";
-  version = "1.1.3";
+  version = "1.1.5";
 
   src = fetchgit {
     url = "git://git.samba.org/pam_wrapper.git";
     rev = "pam_wrapper-${version}";
-    sha256 = "00mqhsashx7njrvxz085d0b88nizhdy7m3x17ip5yhvwsl63km6p";
+    hash = "sha256-AtfkiCUvCxUfll6lOlbMyy5AhS5R2BGF1+ecC1VuwzM=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./python.patch;
+      siteDir = lib.optionalString enablePython python.sitePackages;
+      includeDir = lib.optionalString enablePython "include/${python.libPrefix}";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ] ++ lib.optionals enablePython [ python ];
 
   # We must use linux-pam, using openpam will result in broken fprintd.
diff --git a/pkgs/development/libraries/libpam-wrapper/python.patch b/pkgs/development/libraries/libpam-wrapper/python.patch
new file mode 100644
index 000000000000..0ddb05d26fa9
--- /dev/null
+++ b/pkgs/development/libraries/libpam-wrapper/python.patch
@@ -0,0 +1,38 @@
+diff --git a/cmake/Modules/FindPythonSiteLibs.cmake b/cmake/Modules/FindPythonSiteLibs.cmake
+index ab2931e..08e2c98 100644
+--- a/cmake/Modules/FindPythonSiteLibs.cmake
++++ b/cmake/Modules/FindPythonSiteLibs.cmake
+@@ -27,30 +27,9 @@
+ 
+ if (PYTHON_EXECUTABLE)
+     ### PYTHON_SITELIB
+-    execute_process(
+-        COMMAND
+-        ${PYTHON_EXECUTABLE} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(plat_specific=True, prefix=''))"
+-        OUTPUT_VARIABLE
+-            PYTHON_SITELIB_OUTPUT_VARIABLE
+-        RESULT_VARIABLE
+-            PYTHON_SITELIB_RESULT_VARIABLE
+-        OUTPUT_STRIP_TRAILING_WHITESPACE
+-    )
+-    if (NOT PYTHON_SITELIB_RESULT_VARIABLE)
+-        file(TO_CMAKE_PATH "${PYTHON_SITELIB_OUTPUT_VARIABLE}" PYTHON_SITELIB)
+-    endif ()
++    file(TO_CMAKE_PATH "@siteDir@" PYTHON_SITELIB)
++
+ 
+     ### PYTHON_SITEINC
+-    execute_process(
+-        COMMAND
+-            ${PYTHON_EXECUTABLE} -c "from distutils.sysconfig import get_python_inc; print(get_python_inc(plat_specific=True, prefix=''))"
+-        OUTPUT_VARIABLE
+-            PYTHON_SITEINC_OUTPUT_VARIABLE
+-        RESULT_VARIABLE
+-            PYTHON_SITEINC_RESULT_VARIABLE
+-        OUTPUT_STRIP_TRAILING_WHITESPACE
+-    )
+-    if (NOT PYTHON_SITEINC_RESULT_VARIABLE)
+-        file(TO_CMAKE_PATH "${PYTHON_SITEINC_OUTPUT_VARIABLE}" PYTHON_SITEINC)
+-    endif ()
++    file(TO_CMAKE_PATH "@includeDir@" PYTHON_SITEINC)
+ endif (PYTHON_EXECUTABLE)
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 3e651f593f45..0c6ce83a5796 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitLab
-, fetchpatch
 , pkg-config
 , gobject-introspection
 , meson
@@ -24,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fprintd";
-  version = "1.94.2";
+  version = "1.94.3";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -32,17 +31,9 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ePhcIZyXoGr8XlBuzKjpibU9D/44iCXYBlpVR9gcswQ=";
+    sha256 = "sha256-shH+ctQAx4fpTMWTmo3wB45ZS38Jf8RknryPabfZ6QE=";
   };
 
-  patches = [
-    # backport upstream patch fixing tests
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/commit/ae04fa989720279e5558c3b8ff9ebe1959b1cf36.patch";
-      sha256 = "sha256-jW5vlzrbZQ1gUDLBf7G50GnZfZxhlnL2Eu+9Bghdwdw=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     meson