diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix
index e306e530116a..e9a6388b970b 100644
--- a/nixos/modules/services/misc/gotenberg.nix
+++ b/nixos/modules/services/misc/gotenberg.nix
@@ -115,7 +115,7 @@ in
         autoStart = mkOption {
           type = types.bool;
           default = false;
-          description = "Automatically start chromium when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it.";
+          description = "Automatically start Chromium when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it.";
         };
 
         disableJavascript = mkOption {
@@ -172,7 +172,7 @@ in
         autoStart = mkOption {
           type = types.bool;
           default = false;
-          description = "Automatically start LibreOffice when Gotenberg starts. If false, Chromium will start on the first conversion request that uses it.";
+          description = "Automatically start LibreOffice when Gotenberg starts. If false, LibreOffice will start on the first conversion request that uses it.";
         };
 
         disableRoutes = mkOption {
@@ -303,6 +303,7 @@ in
       };
       serviceConfig = {
         Type = "simple";
+        # NOTE: disable to debug chromium crashes or otherwise no coredump is created and forbidden syscalls are not being logged
         DynamicUser = true;
         ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs args}";
 
@@ -340,6 +341,8 @@ in
           "@sandbox"
           "@system-service"
           "@chown"
+          "@pkey" # required by chromium or it crashes
+          "mincore"
         ];
         SystemCallArchitectures = "native";
 
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 4a54e637507a..78b427021408 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -598,7 +598,7 @@ in
 
         services.gotenberg = lib.mkIf cfg.configureTika {
           enable = true;
-          # https://github.com/paperless-ngx/paperless-ngx/blob/v2.15.3/docker/compose/docker-compose.sqlite-tika.yml#L64-L69
+          # https://github.com/paperless-ngx/paperless-ngx/blob/v2.18.2/docker/compose/docker-compose.sqlite-tika.yml#L60-L65
           chromium.disableJavascript = true;
           extraArgs = [ "--chromium-allow-list=file:///tmp/.*" ];
         };
diff --git a/nixos/tests/gotenberg.nix b/nixos/tests/gotenberg.nix
index c640657ea872..05b326996aa6 100644
--- a/nixos/tests/gotenberg.nix
+++ b/nixos/tests/gotenberg.nix
@@ -7,6 +7,9 @@
   nodes.machine = {
     services.gotenberg = {
       enable = true;
+      # fail the service if any of those does not come up
+      chromium.autoStart = true;
+      libreoffice.autoStart = true;
     };
   };
 
diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix
index ddce8144813a..225dc55e14ff 100644
--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo125Module,
   chromium,
   fetchFromGitHub,
   libreoffice,
@@ -22,18 +22,23 @@ let
   libreoffice' = "${libreoffice}/lib/libreoffice/program/soffice.bin";
   inherit (lib) getExe;
 in
-buildGoModule rec {
+buildGo125Module rec {
   pname = "gotenberg";
-  version = "8.21.1";
+  version = "8.22.0";
+
+  outputs = [
+    "out"
+    "hyphen"
+  ];
 
   src = fetchFromGitHub {
     owner = "gotenberg";
     repo = "gotenberg";
     tag = "v${version}";
-    hash = "sha256-2uILOK5u+HrdjqN+ZQjGv48QxSCrzSvnF+Ae6iCKCbU=";
+    hash = "sha256-LrkJlUkcvW8ky9e2Ltj13wxcL0rvaE4NfVJrcrgPHL4=";
   };
 
-  vendorHash = "sha256-sTcP/tyrCtvgYeOnsbqRFdBC1bbMAbA978t6LOTKFio=";
+  vendorHash = "sha256-JHsuCYx9Ec/w8LBT2R4LxlrfjYyYve0+4/Xq0U1sq5I=";
 
   postPatch = ''
     find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \;
@@ -82,14 +87,20 @@ buildGoModule rec {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
+  postInstall = ''
+    mkdir $hyphen
+    cp -r build/chromium-hyphen-data/*/* $hyphen/
+  '';
+
   preFixup = ''
     wrapProgram $out/bin/gotenberg \
+      --set CHROMIUM_HYPHEN_DATA_DIR_PATH "$hyphen" \
+      --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \
+      --set JAVA_HOME "${jre'}" \
+      --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \
       --set PDFTK_BIN_PATH "${getExe pdftk}" \
       --set QPDF_BIN_PATH "${getExe qpdf}" \
-      --set UNOCONVERTER_BIN_PATH "${getExe unoconv}" \
-      --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \
-      --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \
-      --set JAVA_HOME "${jre'}"
+      --set UNOCONVERTER_BIN_PATH "${getExe unoconv}"
   '';
 
   passthru.updateScript = nix-update-script { };