diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index 5d4b761df334..3f436d650a3f 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -1,8 +1,22 @@
-{ lib, stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper
-, clang, llvm, gcc, which, libcgroup, python3, perl, gmp
-, file, wine ? null
-, cmocka
-, llvmPackages
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  fetchFromGitHub,
+  callPackage,
+  makeWrapper,
+  clang,
+  llvm,
+  gcc,
+  which,
+  libcgroup,
+  python3,
+  perl,
+  gmp,
+  file,
+  wine ? null,
+  cmocka,
+  llvmPackages,
 }:
 
 # wine fuzzing is only known to work for win32 binaries, and using a mixture of
@@ -12,28 +26,42 @@ assert (wine != null) -> (stdenv.targetPlatform.system == "i686-linux");
 
 let
   aflplusplus-qemu = callPackage ./qemu.nix { };
-  qemu-exe-name = if stdenv.targetPlatform.system == "x86_64-linux" then "qemu-x86_64"
-    else if stdenv.targetPlatform.system == "i686-linux" then "qemu-i386"
-    else throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!";
+  qemu-exe-name =
+    if stdenv.targetPlatform.system == "x86_64-linux" then
+      "qemu-x86_64"
+    else if stdenv.targetPlatform.system == "i686-linux" then
+      "qemu-i386"
+    else
+      throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!";
   libdislocator = callPackage ./libdislocator.nix { inherit aflplusplus; };
   libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };
   aflplusplus = stdenvNoCC.mkDerivation rec {
     pname = "aflplusplus";
-    version = "4.10c";
+    version = "4.20c";
 
     src = fetchFromGitHub {
       owner = "AFLplusplus";
       repo = "AFLplusplus";
-      rev = "v${version}";
-      sha256 = "sha256-elghcBw2tIttQo7bkMFRCx8iNqxwY0NCz0343wc8hWA=";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-bS4Zxd2CX8m6zxO/izJi7Cj34260mOaU6GWjEj+xEU8=";
     };
+
     enableParallelBuilding = true;
 
     # Note: libcgroup isn't needed for building, just for the afl-cgroup
     # script.
-    nativeBuildInputs = [ makeWrapper which clang gcc ];
-    buildInputs = [ llvm python3 gmp llvmPackages.bintools ]
-      ++ lib.optional (wine != null) python3.pkgs.wrapPython;
+    nativeBuildInputs = [
+      makeWrapper
+      which
+      clang
+      gcc
+    ];
+    buildInputs = [
+      llvm
+      python3
+      gmp
+      llvmPackages.bintools
+    ] ++ lib.optional (wine != null) python3.pkgs.wrapPython;
 
     # Flag is already set by package and causes some compiler warnings.
     # warning: "_FORTIFY_SOURCE" redefined
@@ -48,22 +76,22 @@ let
       # Prevents afl-gcc picking up any (possibly incorrect) gcc from the path.
       # Replace LLVM_BINDIR with a non-existing path to give a hard error when it's used.
       substituteInPlace src/afl-cc.c \
-        --replace "CLANGPP_BIN" '"${clang}/bin/clang++"' \
-        --replace "CLANG_BIN" '"${clang}/bin/clang"' \
-        --replace '"gcc"' '"${gcc}/bin/gcc"' \
-        --replace '"g++"' '"${gcc}/bin/g++"' \
-        --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")"
+        --replace-fail "CLANGPP_BIN" '"${clang}/bin/clang++"' \
+        --replace-fail "CLANG_BIN" '"${clang}/bin/clang"' \
+        --replace-fail '"gcc"' '"${gcc}/bin/gcc"' \
+        --replace-fail '"g++"' '"${gcc}/bin/g++"' \
+        --replace-fail 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")"
 
       substituteInPlace src/afl-ld-lto.c \
-        --replace 'LLVM_BINDIR' '"/nixpkgs-patched-does-not-exist"'
+        --replace-fail 'LLVM_BINDIR' '"/nixpkgs-patched-does-not-exist"'
 
       # Remove the rest of the line
       sed -i 's|LLVM_BINDIR = .*|LLVM_BINDIR = |' utils/aflpp_driver/GNUmakefile
       substituteInPlace utils/aflpp_driver/GNUmakefile \
-        --replace 'LLVM_BINDIR = ' 'LLVM_BINDIR = ${clang}/bin/'
+        --replace-fail 'LLVM_BINDIR = ' 'LLVM_BINDIR = ${clang}/bin/'
 
       substituteInPlace GNUmakefile.llvm \
-        --replace "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang"
+        --replace-fail "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang"
     '';
 
     env.NIX_CFLAGS_COMPILE = toString [
@@ -72,9 +100,10 @@ let
     ];
 
     makeFlags = [
-      "PREFIX=$(out)"
+      "PREFIX=${placeholder "out"}"
       "USE_BINDIR=0"
     ];
+
     buildPhase = ''
       runHook preBuild
 
@@ -86,67 +115,73 @@ let
       runHook postBuild
     '';
 
-    postInstall = ''
-      # remove afl-clang(++) which are just symlinks to afl-clang-fast
-      rm $out/bin/afl-clang $out/bin/afl-clang++
+    postInstall =
+      ''
+        # remove afl-clang(++) which are just symlinks to afl-clang-fast
+        rm $out/bin/afl-clang $out/bin/afl-clang++
 
-      # the makefile neglects to install unsigaction
-      cp qemu_mode/unsigaction/unsigaction*.so $out/lib/afl/
+        # the makefile neglects to install unsigaction
+        cp qemu_mode/unsigaction/unsigaction*.so $out/lib/afl/
 
-      # Install the custom QEMU emulator for binary blob fuzzing.
-      ln -s ${aflplusplus-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
+        # Install the custom QEMU emulator for binary blob fuzzing.
+        ln -s ${aflplusplus-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
 
-      # give user a convenient way of accessing libcompconv.so, libdislocator.so, libtokencap.so
-      cat > $out/bin/get-afl-qemu-libcompcov-so <<END
-      #!${stdenv.shell}
-      echo $out/lib/afl/libcompcov.so
-      END
-      chmod +x $out/bin/get-afl-qemu-libcompcov-so
-      ln -s ${libdislocator}/bin/get-libdislocator-so $out/bin/
-      ln -s ${libtokencap}/bin/get-libtokencap-so $out/bin/
+        # give user a convenient way of accessing libcompconv.so, libdislocator.so, libtokencap.so
+        cat > $out/bin/get-afl-qemu-libcompcov-so <<END
+        #!${stdenv.shell}
+        echo $out/lib/afl/libcompcov.so
+        END
+        chmod +x $out/bin/get-afl-qemu-libcompcov-so
+        ln -s ${libdislocator}/bin/get-libdislocator-so $out/bin/
+        ln -s ${libtokencap}/bin/get-libtokencap-so $out/bin/
 
-      # Install the cgroups wrapper for asan-based fuzzing.
-      cp utils/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
-      chmod +x $out/bin/afl-cgroup
-      substituteInPlace $out/bin/afl-cgroup \
-        --replace "cgcreate" "${libcgroup}/bin/cgcreate" \
-        --replace "cgexec"   "${libcgroup}/bin/cgexec" \
-        --replace "cgdelete" "${libcgroup}/bin/cgdelete"
+        # Install the cgroups wrapper for asan-based fuzzing.
+        cp utils/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
+        chmod +x $out/bin/afl-cgroup
+        substituteInPlace $out/bin/afl-cgroup \
+          --replace-fail "cgcreate" "${libcgroup}/bin/cgcreate" \
+          --replace-fail "cgexec"   "${libcgroup}/bin/cgexec" \
+          --replace-fail "cgdelete" "${libcgroup}/bin/cgdelete"
 
-      patchShebangs $out/bin
+        patchShebangs $out/bin
 
-    '' + lib.optionalString (wine != null) ''
-      substitute afl-wine-trace $out/bin/afl-wine-trace \
-        --replace "qemu_mode/unsigaction" "$out/lib/afl"
-      chmod +x $out/bin/afl-wine-trace
+      ''
+      + lib.optionalString (wine != null) ''
+        substitute afl-wine-trace $out/bin/afl-wine-trace \
+          --replace-fail "qemu_mode/unsigaction" "$out/lib/afl"
+        chmod +x $out/bin/afl-wine-trace
 
-      # qemu needs to be fed ELFs, not wrapper scripts, so we have to cheat a bit if we
-      # detect a wrapped wine
-      for winePath in ${wine}/bin/.wine ${wine}/bin/wine; do
-        if [ -x $winePath ]; then break; fi
-      done
-      makeWrapperArgs="--set-default 'AFL_WINE_PATH' '$winePath'" \
-        wrapPythonProgramsIn $out/bin ${python3.pkgs.pefile}
-    '';
+        # qemu needs to be fed ELFs, not wrapper scripts, so we have to cheat a bit if we
+        # detect a wrapped wine
+        for winePath in ${wine}/bin/.wine ${wine}/bin/wine; do
+          if [ -x $winePath ]; then break; fi
+        done
+        makeWrapperArgs="--set-default 'AFL_WINE_PATH' '$winePath'" \
+          wrapPythonProgramsIn $out/bin ${python3.pkgs.pefile}
+      '';
 
-    nativeInstallCheckInputs = [ perl file cmocka ];
+    nativeInstallCheckInputs = [
+      perl
+      file
+      cmocka
+    ];
     doInstallCheck = true;
     installCheckPhase = ''
       runHook preInstallCheck
 
       # replace references to tools in build directory with references to installed locations
       substituteInPlace test/test-qemu-mode.sh \
-        --replace '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \
-        --replace '../afl-qemu-trace' '$out/bin/afl-qemu-trace' \
-        --replace '../afl-fuzz' '$out/bin/afl-fuzz' \
-        --replace '../qemu_mode/unsigaction/unsigaction32.so' '$out/lib/afl/unsigaction32.so' \
-        --replace '../qemu_mode/unsigaction/unsigaction64.so' '$out/lib/afl/unsigaction64.so'
+        --replace-fail '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \
+        --replace-fail '../afl-qemu-trace' '$out/bin/afl-qemu-trace' \
+        --replace-fail '../afl-fuzz' '$out/bin/afl-fuzz' \
+        --replace-fail '../qemu_mode/unsigaction/unsigaction32.so' '$out/lib/afl/unsigaction32.so' \
+        --replace-fail '../qemu_mode/unsigaction/unsigaction64.so' '$out/lib/afl/unsigaction64.so'
 
       substituteInPlace test/test-libextensions.sh \
-        --replace '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \
-        --replace '../libtokencap.so' '`$out/bin/get-libtokencap-so`'
+        --replace-fail '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \
+        --replace-fail '../libtokencap.so' '`$out/bin/get-libtokencap-so`'
       substituteInPlace test/test-llvm.sh \
-        --replace '../afl-cmin.bash' '`$out/bin/afl-cmin.bash`'
+        --replace-fail '../afl-cmin.bash' '`$out/bin/afl-cmin.bash`'
       # perl -pi -e 's|(?<!\.)(?<!-I)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh
       patchShebangs .
       cd test && ./test-all.sh
@@ -161,13 +196,20 @@ let
 
     meta = {
       description = ''
-        A heavily enhanced version of AFL, incorporating many features
+        Heavily enhanced version of AFL, incorporating many features
         and improvements from the community
       '';
-      homepage    = "https://aflplus.plus";
-      license     = lib.licenses.asl20;
-      platforms   = ["x86_64-linux" "i686-linux"];
-      maintainers = with lib.maintainers; [ ris mindavi ];
+      homepage = "https://aflplus.plus";
+      license = lib.licenses.asl20;
+      platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      maintainers = with lib.maintainers; [
+        ris
+        mindavi
+      ];
     };
   };
-in aflplusplus
+in
+aflplusplus
diff --git a/pkgs/tools/security/aflplusplus/libdislocator.nix b/pkgs/tools/security/aflplusplus/libdislocator.nix
index 6a17ff9703b8..c99ba96a4339 100644
--- a/pkgs/tools/security/aflplusplus/libdislocator.nix
+++ b/pkgs/tools/security/aflplusplus/libdislocator.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, aflplusplus}:
+{
+  lib,
+  stdenv,
+  aflplusplus,
+}:
 
 stdenv.mkDerivation {
   version = lib.getVersion aflplusplus;
@@ -8,7 +12,7 @@ stdenv.mkDerivation {
   postUnpack = "chmod -R +w ${aflplusplus.src.name}";
   sourceRoot = "${aflplusplus.src.name}/utils/libdislocator";
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   preInstall = ''
     mkdir -p $out/lib/afl
@@ -23,14 +27,14 @@ stdenv.mkDerivation {
     chmod +x $out/bin/get-libdislocator-so
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/vanhauser-thc/AFLplusplus";
     description = ''
       Drop-in replacement for the libc allocator which improves
       the odds of bumping into heap-related security bugs in
-      several ways.
+      several ways
     '';
     license = lib.licenses.asl20;
-    maintainers = with maintainers; [ ris ];
+    maintainers = with lib.maintainers; [ ris ];
   };
 }
diff --git a/pkgs/tools/security/aflplusplus/libtokencap.nix b/pkgs/tools/security/aflplusplus/libtokencap.nix
index 8bad6c607c2d..428dff5bdb9c 100644
--- a/pkgs/tools/security/aflplusplus/libtokencap.nix
+++ b/pkgs/tools/security/aflplusplus/libtokencap.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, aflplusplus}:
+{
+  lib,
+  stdenv,
+  aflplusplus,
+}:
 
 stdenv.mkDerivation {
   version = lib.getVersion aflplusplus;
@@ -8,7 +12,7 @@ stdenv.mkDerivation {
   postUnpack = "chmod -R +w ${aflplusplus.src.name}";
   sourceRoot = "${aflplusplus.src.name}/utils/libtokencap";
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   preInstall = ''
     mkdir -p $out/lib/afl
@@ -23,10 +27,10 @@ stdenv.mkDerivation {
     chmod +x $out/bin/get-libtokencap-so
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/AFLplusplus/AFLplusplus";
     description = "strcmp & memcmp token capture library";
     license = lib.licenses.asl20;
-    maintainers = with maintainers; [ ris ];
+    maintainers = with lib.maintainers; [ ris ];
   };
 }
diff --git a/pkgs/tools/security/aflplusplus/qemu.nix b/pkgs/tools/security/aflplusplus/qemu.nix
index f412b8e40499..81fed0ad0046 100644
--- a/pkgs/tools/security/aflplusplus/qemu.nix
+++ b/pkgs/tools/security/aflplusplus/qemu.nix
@@ -1,18 +1,19 @@
-{ lib
-, stdenv
-, python3
-, zlib
-, pkg-config
-, glib
-, perl
-, texinfo
-, libuuid
-, flex
-, bison
-, pixman
-, meson
-, fetchFromGitHub
-, ninja
+{
+  lib,
+  stdenv,
+  python3,
+  zlib,
+  pkg-config,
+  glib,
+  perl,
+  texinfo,
+  libuuid,
+  flex,
+  bison,
+  pixman,
+  meson,
+  fetchFromGitHub,
+  ninja,
 }:
 
 let
@@ -24,8 +25,9 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "AFLplusplus";
     repo = "qemuafl";
-    rev = "a1321713c7502c152dd7527555e0f8a800d55225";
-    sha256 = "sha256-HLlOHqT2vrHjHyu4n83IzVzKv9ErinephLLev1E10nM=";
+    # rev origin: https://github.com/AFLplusplus/AFLplusplus/commits/stable/qemu_mode/QEMUAFL_VERSION
+    rev = "40033af00c4c5de172ed4fe60c21b9edbd2c189d";
+    sha256 = "sha256-oK0DLJjXDiQuRlbaNOurvw5vlr9HEeOobNywiFTq7xg=";
     fetchSubmodules = true;
   };
 
@@ -57,88 +59,87 @@ stdenv.mkDerivation {
     patchShebangs .
   '';
 
-  configureFlags =
-    [
-      "--target-list=${stdenv.hostPlatform.uname.processor}-linux-user"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-      "--meson=meson"
-      "--disable-system"
-      "--enable-linux-user"
-      "--enable-pie"
-      "--audio-drv-list="
-      "--disable-blobs"
-      "--disable-bochs"
-      "--disable-brlapi"
-      "--disable-bsd-user"
-      "--disable-bzip2"
-      "--disable-cap-ng"
-      "--disable-cloop"
-      "--disable-curl"
-      "--disable-curses"
-      "--disable-dmg"
-      "--disable-fdt"
-      "--disable-gcrypt"
-      "--disable-glusterfs"
-      "--disable-gnutls"
-      "--disable-gtk"
-      "--disable-guest-agent"
-      "--disable-iconv"
-      "--disable-libiscsi"
-      "--disable-libnfs"
-      "--disable-libssh"
-      "--disable-libusb"
-      "--disable-linux-aio"
-      "--disable-live-block-migration"
-      "--disable-lzo"
-      "--disable-nettle"
-      "--disable-numa"
-      "--disable-opengl"
-      "--disable-parallels"
-      "--disable-plugins"
-      "--disable-qcow1"
-      "--disable-qed"
-      "--disable-rbd"
-      "--disable-rdma"
-      "--disable-replication"
-      "--disable-sdl"
-      "--disable-seccomp"
-      "--disable-sheepdog"
-      "--disable-smartcard"
-      "--disable-snappy"
-      "--disable-spice"
-      "--disable-system"
-      "--disable-tools"
-      "--disable-tpm"
-      "--disable-usb-redir"
-      "--disable-vde"
-      "--disable-vdi"
-      "--disable-vhost-crypto"
-      "--disable-vhost-kernel"
-      "--disable-vhost-net"
-      "--disable-vhost-scsi"
-      "--disable-vhost-user"
-      "--disable-vhost-vdpa"
-      "--disable-vhost-vsock"
-      "--disable-virglrenderer"
-      "--disable-virtfs"
-      "--disable-vnc"
-      "--disable-vnc-jpeg"
-      "--disable-vnc-png"
-      "--disable-vnc-sasl"
-      "--disable-vte"
-      "--disable-vvfat"
-      "--disable-xen"
-      "--disable-xen-pci-passthrough"
-      "--disable-xfsctl"
-      "--without-default-devices"
-    ];
+  configureFlags = [
+    "--target-list=${stdenv.hostPlatform.uname.processor}-linux-user"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--meson=meson"
+    "--disable-system"
+    "--enable-linux-user"
+    "--enable-pie"
+    "--audio-drv-list="
+    "--disable-blobs"
+    "--disable-bochs"
+    "--disable-brlapi"
+    "--disable-bsd-user"
+    "--disable-bzip2"
+    "--disable-cap-ng"
+    "--disable-cloop"
+    "--disable-curl"
+    "--disable-curses"
+    "--disable-dmg"
+    "--disable-fdt"
+    "--disable-gcrypt"
+    "--disable-glusterfs"
+    "--disable-gnutls"
+    "--disable-gtk"
+    "--disable-guest-agent"
+    "--disable-iconv"
+    "--disable-libiscsi"
+    "--disable-libnfs"
+    "--disable-libssh"
+    "--disable-libusb"
+    "--disable-linux-aio"
+    "--disable-live-block-migration"
+    "--disable-lzo"
+    "--disable-nettle"
+    "--disable-numa"
+    "--disable-opengl"
+    "--disable-parallels"
+    "--disable-plugins"
+    "--disable-qcow1"
+    "--disable-qed"
+    "--disable-rbd"
+    "--disable-rdma"
+    "--disable-replication"
+    "--disable-sdl"
+    "--disable-seccomp"
+    "--disable-sheepdog"
+    "--disable-smartcard"
+    "--disable-snappy"
+    "--disable-spice"
+    "--disable-system"
+    "--disable-tools"
+    "--disable-tpm"
+    "--disable-usb-redir"
+    "--disable-vde"
+    "--disable-vdi"
+    "--disable-vhost-crypto"
+    "--disable-vhost-kernel"
+    "--disable-vhost-net"
+    "--disable-vhost-scsi"
+    "--disable-vhost-user"
+    "--disable-vhost-vdpa"
+    "--disable-vhost-vsock"
+    "--disable-virglrenderer"
+    "--disable-virtfs"
+    "--disable-vnc"
+    "--disable-vnc-jpeg"
+    "--disable-vnc-png"
+    "--disable-vnc-sasl"
+    "--disable-vte"
+    "--disable-vvfat"
+    "--disable-xen"
+    "--disable-xen-pci-passthrough"
+    "--disable-xfsctl"
+    "--without-default-devices"
+  ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/AFLplusplus/qemuafl";
     description = "Fork of QEMU with AFL++ instrumentation support";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ris ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ ris ];
+    platforms = lib.platforms.linux;
   };
 }