diff --git a/pkgs/by-name/ce/cerberus/package.nix b/pkgs/by-name/ce/cerberus/package.nix
index 4d7c257dd995..f2d45151385e 100644
--- a/pkgs/by-name/ce/cerberus/package.nix
+++ b/pkgs/by-name/ce/cerberus/package.nix
@@ -1,12 +1,16 @@
 {
   lib,
+  fetchpatch,
   fetchFromGitHub,
-  writableTmpDirAsHomeHook,
-  unstableGitUpdater,
   ocamlPackages,
   opam,
+  makeBinaryWrapper,
+  writableTmpDirAsHomeHook,
+  unstableGitUpdater,
+  testers,
+  cerberus,
 }:
-ocamlPackages.buildDunePackage {
+ocamlPackages.buildDunePackage rec {
   pname = "cerberus";
   version = "0-unstable-2025-08-18";
 
@@ -17,15 +21,33 @@ ocamlPackages.buildDunePackage {
     hash = "sha256-++fCZvk4ee166eciipTQ8GId6DWrG6aonAzHpK/10f0=";
   };
 
+  patches = [
+    # https://github.com/rems-project/cerberus/pull/980
+    (fetchpatch {
+      name = "fix-runtime-lookup";
+      url = "https://github.com/rems-project/cerberus/commit/262c13331d4809dd3742069dbcd1deedee8227f2.patch";
+      hash = "sha256-yPhzswMDkpjvjYyobnqoF3900l4THe0kaGme1eZXLQc=";
+    })
+  ];
+
+  # Cerberus has not had a true release yet, and it parses out a git rev
+  # for version info. We just patch the "didn't find git revs" to
+  # our version since git is impure
+  postPatch = ''
+    substituteInPlace tools/gen_version.ml \
+      --replace-fail '"unknown"' '"${version}"'
+  '';
+
   minimalOCamlVersion = "4.12";
 
-  strictDeps = true;
+  depsBuildBuild = [
+    ocamlPackages.menhir
+    ocamlPackages.lem
+  ];
 
   nativeBuildInputs = [
-    opam
     writableTmpDirAsHomeHook
-    ocamlPackages.lem
-    ocamlPackages.menhir
+    makeBinaryWrapper
   ];
 
   buildInputs = with ocamlPackages; [
@@ -42,15 +64,33 @@ ocamlPackages.buildDunePackage {
     janeStreet.ppx_sexp_conv
   ];
 
+  # Need to set this or it complains. I don't
+  # think the actual value matters much
   env.OPAM_SWITCH_PREFIX = placeholder "out";
+
+  # Use the make file as it does some codegen
   buildPhase = ''
     runHook preBuild
 
-    make Q= cerberus
+    make DUNEFLAGS="--profile=release" Q= -j$NIX_BUILD_CORES cerberus
 
     runHook postBuild
   '';
 
+  # Must install both the stdlib
+  # and the executable itself
+  installPhase = ''
+    runHook preInstall
+
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus-lib --docdir $out/share/doc --mandir $out/share/man
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus --docdir $out/share/doc --mandir $out/share/man
+
+    wrapProgram "$out/bin/cerberus" \
+      --set CERB_INSTALL_PREFIX "$out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/"
+
+    runHook postInstall
+  '';
+
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
@@ -64,7 +104,14 @@ ocamlPackages.buildDunePackage {
     runHook postInstallCheck
   '';
 
-  passthru.updateScript = unstableGitUpdater { branch = "master"; };
+  passthru = {
+    updateScript = unstableGitUpdater { branch = "master"; };
+
+    # Ensure it still runs after outside the container
+    tests.version = testers.testVersion {
+      package = cerberus;
+    };
+  };
 
   meta = {
     homepage = "https://www.cl.cam.ac.uk/~pes20/cerberus/";