diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 2ec09d61394d..049726dcebf7 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -58,23 +58,21 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "9.7p1";
+    version = "9.8p1";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-SQQm92bYKidj/KzY2D6j1weYdQx70q/y5X3FZg93P/0=";
+      hash = "sha256-3YvQAqN5tdSZ37BQ3R+pr4Ap6ARh9LtsUjxJlz9aOfM=";
     };
 
     extraPatches = [
       ./ssh-keysign-8.5.patch
-      ./openssh-9.6_p1-CVE-2024-6387.patch
-      ./openssh-9.6_p1-chaff-logic.patch
 
       (fetchpatch {
         name = "openssh-gssapi.patch";
         url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-3/debian/patches/gssapi.patch";
-        hash = "sha256-/lEbH5sIS+o+DStEDAghFy43nZlvcIXSFJrnvp+fDdY=";
+        hash = "sha256-BnmEZ5pMIbbysesMSm54ykdweH4JudM9D4Pn5uWf3EY=";
       })
     ];
 
diff --git a/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch b/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch
deleted file mode 100644
index 7b7fb70380d9..000000000000
--- a/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-https://bugs.gentoo.org/935271
-Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2.
---- a/log.c
-+++ b/log.c
-@@ -451,12 +451,14 @@ void
- sshsigdie(const char *file, const char *func, int line, int showfunc,
-     LogLevel level, const char *suffix, const char *fmt, ...)
- {
-+#ifdef SYSLOG_R_SAFE_IN_SIGHAND
- 	va_list args;
- 
- 	va_start(args, fmt);
- 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
- 	    suffix, fmt, args);
- 	va_end(args);
-+#endif
- 	_exit(1);
- }
- 
diff --git a/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch b/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch
deleted file mode 100644
index 90544d1a457e..000000000000
--- a/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-"Minor logic error in ObscureKeystrokeTiming"
-https://marc.info/?l=oss-security&m=171982317624594&w=2
---- a/clientloop.c
-+++ b/clientloop.c
-@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
- 		if (timespeccmp(&now, &chaff_until, >=)) {
- 			/* Stop if there have been no keystrokes for a while */
- 			stop_reason = "chaff time expired";
--		} else if (timespeccmp(&now, &next_interval, >=)) {
--			/* Otherwise if we were due to send, then send chaff */
-+		} else if (timespeccmp(&now, &next_interval, >=) &&
-+		    !ssh_packet_have_data_to_write(ssh)) {
-+			/* If due to send but have no data, then send chaff */
- 			if (send_chaff(ssh))
- 				nchaff++;
- 		}