diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 5057e725010e..f60813a7eea6 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,8 +1,6 @@
 { lib, stdenv, fetchurl, python3Packages, makeWrapper, gettext, installShellFiles
 , re2Support ? true
-# depends on rust-cpython which won't support python312
-# https://github.com/dgrunwald/rust-cpython/commit/e815555629e557be084813045ca1ddebc2f76ef9
-, rustSupport ? (stdenv.hostPlatform.isLinux && python3Packages.pythonOlder "3.12"), cargo, rustPlatform, rustc
+, rustSupport ? stdenv.hostPlatform.isLinux, cargo, rustPlatform, rustc
 , fullBuild ? false
 , gitSupport ? fullBuild
 , guiSupport ? fullBuild, tk
@@ -19,15 +17,15 @@
 }:
 
 let
-  inherit (python3Packages) docutils python fb-re2 pygit2 pygments;
+  inherit (python3Packages) docutils python fb-re2 pygit2 pygments setuptools;
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.7.4";
+    version = "6.8";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-dHCPhzQFwSJy/sEWxt1Shi6O0RwQARx+V19eqBJj6l4=";
+      hash = "sha256-COTQ5dqK8RMrUea8M1AYCtV63Nk18Je20LwRmiwsChA=";
     };
 
     format = "other";
@@ -37,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      hash = "sha256-FRa7frX2z9jQGFBXS2TpOUANs0+xwegNETUAQIU0S4o=";
+      hash = "sha256-mP82UtASD0Fh8ilDDCB6ubY7/MGPoRP6hg6/xRwzwAw=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
@@ -45,7 +43,7 @@ let
     propagatedBuildInputs = lib.optional re2Support fb-re2
       ++ lib.optional gitSupport pygit2
       ++ lib.optional highlightSupport pygments;
-    nativeBuildInputs = [ makeWrapper gettext installShellFiles python3Packages.setuptools ]
+    nativeBuildInputs = [ makeWrapper gettext installShellFiles setuptools ]
       ++ lib.optionals rustSupport [
            rustPlatform.cargoSetupHook
            cargo
@@ -114,6 +112,9 @@ let
       gnupg
     ];
 
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6887
+    propagatedBuildInputs = [ setuptools ];
+
     postPatch = ''
       patchShebangs .
 
@@ -127,6 +128,12 @@ let
           --replace '*/hg:' '*/*hg*:' \${/* paths emitted by our wrapped hg look like ..hg-wrapped-wrapped */""}
           --replace '"$PYTHON" "$BINDIR"/hg' '"$BINDIR"/hg' ${/* 'hg' is a wrapper; don't run using python directly */""}
       done
+
+      # https://bz.mercurial-scm.org/show_bug.cgi?id=6887
+      # Adding setuptools to the python path is not enough for the distutils
+      # module to be found, so we patch usage directly:
+      substituteInPlace tests/hghave.py \
+        --replace-fail "distutils" "setuptools._distutils"
     '';
 
     # This runs Mercurial _a lot_ of times.
@@ -156,6 +163,21 @@ let
     # Python 3.10-3.12 deprecation warning: asyncore
     # https://bz.mercurial-scm.org/show_bug.cgi?id=6727
     test-patchbomb-tls.t
+
+    # Python 3.12 _lsprof module change, breaking profile test
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6846
+    test-profile.t
+
+    # Python 3.12 deprecation warning: multi-threaded fork in worker.py
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6892
+    test-clone-stream.t
+    test-clonebundles.t
+    test-fix-topology.t
+    test-fix.t
+    test-persistent-nodemap.t
+    test-profile.t
+    test-simple-update.t
+
     EOF
 
     export HGTEST_REAL_HG="${mercurial}/bin/hg"