diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 9e2afe5fd201..be4ce3c27d8b 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -313,6 +313,8 @@
 
 - `rome` was removed because it is no longer maintained and is succeeded by `biome`.
 
+- The `prometheus-knot-exporter` was migrated to a version maintained by CZ.NIC. Various metric names have changed, so checking existing rules is recommended.
+
 - The `services.mtr-exporter.target` has been removed in favor of `services.mtr-exporter.jobs` which allows specifying multiple targets.
 
 - Setting `nixpkgs.config` options while providing an external `pkgs` instance will now raise an error instead of silently ignoring the options. NixOS modules no longer set `nixpkgs.config` to accomodate this. This specifically affects `services.locate`, `services.xserver.displayManager.lightdm.greeters.tiny` and `programs.firefox` NixOS modules. No manual intervention should be required in most cases, however, configurations relying on those modules affecting packages outside the system environment should switch to explicit overlays.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/knot.nix b/nixos/modules/services/monitoring/prometheus/exporters/knot.nix
index a73425b37da7..775848750803 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/knot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/knot.nix
@@ -8,9 +8,9 @@ in {
   port = 9433;
   extraOpts = {
     knotLibraryPath = mkOption {
-      type = types.str;
-      default = "${pkgs.knot-dns.out}/lib/libknot.so";
-      defaultText = literalExpression ''"''${pkgs.knot-dns.out}/lib/libknot.so"'';
+      type = types.nullOr types.str;
+      default = null;
+      example = literalExpression ''"''${pkgs.knot-dns.out}/lib/libknot.so"'';
       description = lib.mdDoc ''
         Path to the library of `knot-dns`.
       '';
@@ -25,7 +25,7 @@ in {
     };
 
     knotSocketTimeout = mkOption {
-      type = types.int;
+      type = types.ints.positive;
       default = 2000;
       description = lib.mdDoc ''
         Timeout in seconds.
@@ -33,17 +33,22 @@ in {
     };
   };
   serviceOpts = {
+    path = with pkgs; [
+      procps
+    ];
     serviceConfig = {
       ExecStart = ''
-        ${pkgs.prometheus-knot-exporter}/bin/knot_exporter \
+        ${pkgs.prometheus-knot-exporter}/bin/knot-exporter \
           --web-listen-addr ${cfg.listenAddress} \
           --web-listen-port ${toString cfg.port} \
-          --knot-library-path ${cfg.knotLibraryPath} \
           --knot-socket-path ${cfg.knotSocketPath} \
           --knot-socket-timeout ${toString cfg.knotSocketTimeout} \
+          ${lib.optionalString (cfg.knotLibraryPath != null) "--knot-library-path ${cfg.knotLibraryPath}"} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
-      SupplementaryGroups = [ "knot" ];
+      SupplementaryGroups = [
+        "knot"
+      ];
       RestrictAddressFamilies = [
         # Need AF_UNIX to collect data
         "AF_UNIX"
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 8369d6a497ac..d42a9e303996 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -512,7 +512,7 @@ let
         wait_for_unit("knot.service")
         wait_for_unit("prometheus-knot-exporter.service")
         wait_for_open_port(9433)
-        succeed("curl -sSf 'localhost:9433' | grep 'knot_server_zone_count 1.0'")
+        succeed("curl -sSf 'localhost:9433' | grep '2\.019031301'")
       '';
     };
 
diff --git a/pkgs/development/python-modules/libknot/default.nix b/pkgs/development/python-modules/libknot/default.nix
new file mode 100644
index 000000000000..1913d0765133
--- /dev/null
+++ b/pkgs/development/python-modules/libknot/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, hatchling
+
+# native dependencies
+, knot-dns
+}:
+
+buildPythonPackage rec {
+  pname = "libknot";
+  version = "3.3.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-uttdIl2ONoR9ba6gJXmJkU++UQldcezwTUG+X5mCcbE=";
+  };
+
+  postPatch = ''
+    substituteInPlace libknot/__init__.py \
+      --replace "libknot%s.dylib" "${lib.getLib knot-dns}/lib/libknot%s.dylib" \
+      --replace "libknot.so%s" "${lib.getLib knot-dns}/lib/libknot.so%s"
+  '';
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  pythonImportsCheck = [
+    "libknot"
+  ];
+
+  meta = with lib; {
+    description = "Python bindings for libknot";
+    homepage = "https://gitlab.nic.cz/knot/knot-dns/-/tree/master/python/libknot";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ hexa ];
+    mainProgram = "libknot";
+  };
+}
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index afba49779c0f..bc18c91ef7fe 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
     inherit knot-resolver;
   } // lib.optionalAttrs stdenv.isLinux {
     inherit (nixosTests) knot kea;
+    prometheus-exporter = nixosTests.prometheus-exporters.knot;
     # Some dependencies are very version-sensitive, so the might get dropped
     # or embedded after some update, even if the nixPackagers didn't intend to.
     # For non-linux I don't know a good replacement for `ldd`.
diff --git a/pkgs/servers/monitoring/prometheus/knot-exporter.nix b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
index f0b6055f2ba0..8b2573db4f77 100644
--- a/pkgs/servers/monitoring/prometheus/knot-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
@@ -1,39 +1,41 @@
-{ stdenv, fetchFromGitHub, lib, python3, nixosTests }:
+{ lib
+, python3
+, fetchPypi
+, nixosTests
+}:
 
-stdenv.mkDerivation rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "unstable-2021-08-21";
+  version = "3.3.2";
+  pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "ghedo";
-    repo = "knot_exporter";
-    rev = "b18eb7db735b50280f0815497475f4c7092a6550";
-    sha256 = "sha256-FGzkO/KHDhkM3PA2urNQcrMi3MHADkd0YwAvu1jvfrU=";
+  src = fetchPypi {
+    pname = "knot_exporter";
+    inherit version;
+    hash = "sha256-/TBzq9MhYb664TsSD46Ep7gOkLBmmPSK9d89xlgvbSw=";
   };
 
-  dontBuild = true;
+  nativeBuildInputs = [
+    python3.pkgs.hatchling
+  ];
 
-  nativeBuildInputs = [ python3.pkgs.wrapPython ];
-  buildInputs = [ python3 ];
+  propagatedBuildInputs = with python3.pkgs; [
+    libknot
+    prometheus-client
+    psutil
+  ];
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm0755 knot_exporter $out/bin/knot_exporter
-    patchShebangs $out/bin
-    buildPythonPath ${python3.pkgs.prometheus-client}
-    patchPythonScript $out/bin/knot_exporter
-
-    runHook postInstall
-  '';
+  pythonImportsCheck = [
+    "knot_exporter"
+  ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) knot; };
 
   meta = with lib; {
-    homepage = "https://github.com/ghedo/knot_exporter";
-    description = " Prometheus exporter for Knot DNS";
+    description = "Prometheus exporter for Knot DNS";
+    homepage = "https://gitlab.nic.cz/knot/knot-dns/-/tree/master/python/knot_exporter";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ma27 ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ ma27 hexa ];
+    mainProgram = "knot-exporter";
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bf18ff41cd24..3e75efc59d95 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6142,6 +6142,8 @@ self: super: with self; {
 
   libkeepass = callPackage ../development/python-modules/libkeepass { };
 
+  libknot = callPackage ../development/python-modules/libknot { };
+
   liblarch = callPackage ../development/python-modules/liblarch { };
 
   liblzfse = callPackage ../development/python-modules/liblzfse {