diff --git a/pkgs/servers/tang/default.nix b/pkgs/servers/tang/default.nix
index 8c5a64f22955..fdcadc4bb28d 100644
--- a/pkgs/servers/tang/default.nix
+++ b/pkgs/servers/tang/default.nix
@@ -1,31 +1,50 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, asciidoc
-, jansson, jose, http-parser, systemd
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, asciidoc
+, jansson
+, jose
+, http-parser
+, systemd
+, meson
+, ninja
 }:
 
 stdenv.mkDerivation rec {
   pname = "tang";
-  version = "7";
+  version = "12";
 
   src = fetchFromGitHub {
     owner = "latchset";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0y5w1jrq5djh9gpy2r98ja7676nfxss17s1dk7jvgblsijx9qsd7";
+    repo = "tang";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wfZFOJrVzjtysh0VKdw5O+DJybYkV9bYJNnaku6YctE=";
   };
 
-  configureFlags = [
-    "--localstatedir=/var"
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+  nativeBuildInputs = [
+    asciidoc
+    meson
+    ninja
+    pkg-config
   ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config asciidoc ];
-  buildInputs = [ jansson jose http-parser systemd ];
+  buildInputs = [
+    jansson
+    jose
+    http-parser
+    systemd
+  ];
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   meta = {
     description = "Server for binding data to network presence";
     homepage = "https://github.com/latchset/tang";
+    changelog = "https://github.com/latchset/tang/releases/tag/v${version}";
     maintainers = with lib.maintainers; [ fpletz ];
     license = lib.licenses.gpl3Plus;
   };
diff --git a/pkgs/tools/security/clevis/default.nix b/pkgs/tools/security/clevis/default.nix
index 70767373258e..0498f0599052 100644
--- a/pkgs/tools/security/clevis/default.nix
+++ b/pkgs/tools/security/clevis/default.nix
@@ -1,43 +1,34 @@
 { lib
 , stdenv
+, asciidoc
+, coreutils
+, cryptsetup
+, curl
 , fetchFromGitHub
-, fetchurl
+, gnugrep
+, gnused
+, jansson
+, jose
+, libpwquality
+, luksmeta
+, makeWrapper
 , meson
 , ninja
 , pkg-config
-, asciidoc
-, makeWrapper
-, jansson
-, jose
-, cryptsetup
-, curl
-, libpwquality
-, luksmeta
-, coreutils
 , tpm2-tools
-, gnugrep
-, gnused
 }:
 
 stdenv.mkDerivation rec {
   pname = "clevis";
-  version = "18";
+  version = "19";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-m1UhyjD5ydSgCTBu6sECLlxFx0rnQxFnBA7frbdUqU8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3J3ti/jRiv+p3eVvJD7u0ko28rPd8Gte0mCJaVaqyOs=";
   };
 
-  patches = [
-    # sss: use BN_set_word(x, 0) instead of BN_zero(), fixes build issue with different versions of openssl
-    (fetchurl {
-      url = "https://github.com/latchset/clevis/commit/ee1dfedb9baca107e66a0fec76693c9d479dcfd9.patch";
-      sha256 = "sha256-GeklrWWlAMALDLdnn6+0Bi0l+bXrIbYkgIyI94WEybM=";
-    })
-  ];
-
   postPatch = ''
     for f in $(find src/ -type f); do
       grep -q "/bin/cat" "$f" && substituteInPlace "$f" \
@@ -51,15 +42,34 @@ stdenv.mkDerivation rec {
       --prefix PATH ':' "${lib.makeBinPath [tpm2-tools jose cryptsetup libpwquality luksmeta gnugrep gnused coreutils]}:${placeholder "out"}/bin"
   '';
 
-  nativeBuildInputs = [ meson ninja pkg-config asciidoc makeWrapper ];
-  buildInputs = [ jansson jose cryptsetup curl libpwquality luksmeta tpm2-tools ];
+  nativeBuildInputs = [
+    asciidoc
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
 
-  outputs = [ "out" "man" ];
+  buildInputs = [
+    cryptsetup
+    curl
+    jansson
+    jose
+    libpwquality
+    luksmeta
+    tpm2-tools
+  ];
 
-  meta = {
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  meta = with lib; {
     description = "Automated Encryption Framework";
     homepage = "https://github.com/latchset/clevis";
-    maintainers = with lib.maintainers; [ ];
-    license = lib.licenses.gpl3Plus;
+    changelog = "https://github.com/latchset/clevis/releases/tag/v${version}";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ];
   };
 }