diff --git a/pkgs/by-name/si/signal-desktop-source/package.nix b/pkgs/by-name/si/signal-desktop-source/package.nix
index ecb384b1d0fe..7c0993a8fc9f 100644
--- a/pkgs/by-name/si/signal-desktop-source/package.nix
+++ b/pkgs/by-name/si/signal-desktop-source/package.nix
@@ -19,7 +19,7 @@
 }:
 let
   nodejs = nodejs_22;
-  pnpm = pnpm_10;
+  pnpm = pnpm_10.override { inherit nodejs; };
   electron = electron_35;
 
   nodeOS =
@@ -45,6 +45,7 @@ let
   '';
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
+  signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
 
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
@@ -91,7 +92,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      (pnpm.override { inherit nodejs; }).configHook
+      pnpm.configHook
     ];
 
     buildPhase = ''
@@ -113,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    (pnpm.override { inherit nodejs; }).configHook
+    pnpm.configHook
     makeWrapper
     copyDesktopItems
     python3
@@ -163,6 +164,11 @@ stdenv.mkDerivation (finalAttrs: {
       die "libsignal-client version mismatch"
     fi
 
+    if [ "`jq -r '.dependencies."@signalapp/sqlcipher"' < package.json`" != "${signal-sqlcipher.version}" ]
+    then
+      die "signal-sqlcipher version mismatch"
+    fi
+
     if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc.version}" ]
     then
       die "ringrtc version mismatch"
@@ -174,6 +180,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     rm -fr node_modules/@signalapp/libsignal-client/prebuilds
     cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
+
+    rm -fr node_modules/@signalapp/sqlcipher
+    cp -r ${signal-sqlcipher} node_modules/@signalapp/sqlcipher
   '';
 
   buildPhase = ''
@@ -241,6 +250,7 @@ stdenv.mkDerivation (finalAttrs: {
       ringrtc
       webrtc
       sticker-creator
+      signal-sqlcipher
       ;
     tests.application-launch = nixosTests.signal-desktop;
     updateScript.command = [ ./update.sh ];
@@ -271,12 +281,5 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
     ];
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-
-      # @signalapp/sqlcipher
-      # ringrtc
-      binaryNativeCode
-    ];
   };
 })
diff --git a/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix
new file mode 100644
index 000000000000..37ebead94a60
--- /dev/null
+++ b/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  rustPlatform,
+  cargo,
+  dump_syms,
+  python3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "node-sqlcipher";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "node-sqlcipher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fuChNio2iWYuxIj40jW1lJCZItnQKrzX7m1gJeeajvs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+  };
+
+  cargoRoot = "deps/extension";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "sqlcipher-signal-exentsion";
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    rustPlatform.cargoSetupHook
+    cargo
+    dump_syms
+    python3
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export npm_config_nodedir=${nodejs}
+    pnpm run prebuildify
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    cp -r prebuilds $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast N-API-based Node.js addon wrapping sqlcipher and FTS5 segmenting APIs";
+    homepage = "https://github.com/signalapp/node-sqlcipher/tree/main";
+    license = with lib.licenses; [
+      agpl3Only
+
+      # deps/sqlcipher
+      bsd3
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp b/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp
deleted file mode 100644
index 2c73ab250b61..000000000000
--- a/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  'includes': ['common.gypi'],
-  'targets': [
-    {
-      'target_name': 'locate_sqlite3',
-      'type': 'none',
-      'copies': [{
-        'files': [
-          '@extension@/src/sqlite3.c',
-        ],
-        'destination': '<(SHARED_INTERMEDIATE_DIR)/sqlite3',
-      }],
-    },
-    {
-      'target_name': 'sqlite3',
-      'type': 'static_library',
-      'dependencies': ['locate_sqlite3'],
-      'sources': ['<(SHARED_INTERMEDIATE_DIR)/sqlite3/sqlite3.c'],
-      'include_dirs': [
-        '<(SHARED_INTERMEDIATE_DIR)/sqlite3/',
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '@extension@/include',
-        ],
-      },
-      'cflags': ['-std=c99', '-w'],
-      'xcode_settings': {
-        'OTHER_CFLAGS': ['-std=c99'],
-        'WARNING_CFLAGS': ['-w'],
-      },
-      'includes': ['defines.gypi'],
-      'link_settings': {
-        'libraries': [
-          '@extension@/lib/libsignal_sqlcipher_extension@static_lib_ext@',
-        ]
-      }
-    },
-  ],
-}
diff --git a/pkgs/by-name/si/signal-desktop-source/update.sh b/pkgs/by-name/si/signal-desktop-source/update.sh
index 4271874b2470..4614a7222861 100755
--- a/pkgs/by-name/si/signal-desktop-source/update.sh
+++ b/pkgs/by-name/si/signal-desktop-source/update.sh
@@ -22,6 +22,7 @@ latestVersion="`jq -r '.version' <<< $packageJson`"
 nodeVersion="`jq -r '.engines.node' <<< $packageJson | cut -d. -f1`"
 electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | cut -d. -f1`"
 libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
+signalSqlcipherVersion=`jq -r '.dependencies."@signalapp/sqlcipher"' <<< $packageJson`
 ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
 ringrtcVersionProperties="`curl_github "https://raw.githubusercontent.com/signalapp/ringrtc/refs/tags/v$ringrtcVersion/config/version.properties"`"
 webrtcVersion="`grep --only-matching "^webrtc.version=.*$" <<< $ringrtcVersionProperties | sed "s/webrtc.version=//g"`"
@@ -46,6 +47,15 @@ update-source-version signal-desktop-source.libsignal-node \
   --ignore-same-version \
   --source-key=npmDeps
 
+update-source-version signal-desktop-source.signal-sqlcipher \
+  "$signalSqlcipherVersion"
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=pnpmDeps
+
 update-source-version signal-desktop-source.ringrtc "$ringrtcVersion"
 update-source-version signal-desktop-source.ringrtc \
   --ignore-same-version \