diff --git a/pkgs/by-name/fi/fish/disable_suid_test.patch b/pkgs/by-name/fi/fish/disable_suid_test.patch
index bfbfe5797985..ab22ee08b6e2 100644
--- a/pkgs/by-name/fi/fish/disable_suid_test.patch
+++ b/pkgs/by-name/fi/fish/disable_suid_test.patch
@@ -1,17 +1,37 @@
-diff --git a/tests/checks/path.fish b/tests/checks/path.fish
-index 62812571a..b0eebcd91 100644
---- a/tests/checks/path.fish
-+++ b/tests/checks/path.fish
-@@ -117,12 +117,6 @@ path filter --type file,dir --perm exec,write bin/fish .
+diff --git i/tests/checks/path.fish w/tests/checks/path.fish
+index 4bf14878e..4024c6d34 100644
+--- i/tests/checks/path.fish
++++ w/tests/checks/path.fish
+@@ -135,32 +135,6 @@ path filter --type file,dir --perm exec,write bin/fish .
  # So it passes.
  # CHECK: .
  
 -mkdir -p sbin
 -touch sbin/setuid-exe sbin/setgid-exe
--chmod u+s,a+x sbin/setuid-exe
--path filter --perm suid sbin/*
+-
+-# Without POSIX permission, there is no way to set the setuid bit, so fake
+-# the output.
+-if set -q noacl
+-    echo sbin/setuid-exe
+-else
+-    chmod u+s,a+x sbin/setuid-exe
+-    path filter --perm suid sbin/*
+-end
 -# CHECK: sbin/setuid-exe
 -
- # On at least FreeBSD on our CI this fails with "permission denied".
- # So we can't test it, and we fake the output instead.
- if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-# Without POSIX permission, there is no way to set the setgid bit, so fake
+-# the result.
+-# And on at least FreeBSD on our CI this fails with "permission denied".
+-# So we can't test it, and we fake the output there too.
+-if set -q noacl
+-    echo sbin/setgid-exe
+-else if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-    path filter --perm sgid sbin/*
+-else
+-    echo sbin/setgid-exe
+-end
+-# CHECK: sbin/setgid-exe
+-
+ mkdir stuff
+ touch stuff/{read,write,exec,readwrite,readexec,writeexec,all,none}
+ if set -q noacl
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 9ecccf3a9402..d6eead7cd42e 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -148,13 +148,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-lhixotjhD8+xb8Hw6Mu1uJPtCq0zlQsBAXpHRzT+moI=";
+    hash = "sha256-LzpWSxhUMcJytxUoD7SZyLc/+hiL6CAyL/0FNbvBk1M=";
   };
 
   env = {
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-zua2O3eGi7dXh4w0IoUGL2RxvGIW0O3WpVg/tT8942Q=";
+    hash = "sha256-WS7FWws1dIuVM9gE1PBnDZpUcRu96fWR80Az4Q+tZpI=";
   };
 
   patches = [
@@ -238,7 +238,8 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace share/functions/grep.fish \
       --replace-fail "command grep" "command ${lib.getExe gnugrep}"
 
-    substituteInPlace share/completions/{sudo.fish,doas.fish} \
+    substituteInPlace share/completions/doas.fish \
+      share/functions/__fish_complete_sudo.fish \
       --replace-fail "/usr/local/sbin /sbin /usr/sbin" ""
   ''
   + lib.optionalString usePython ''