diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index e77a1a611279..a366940e7d5c 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -5,35 +5,35 @@
   fetchzip,
 
   nodejs,
-  pnpm_10,
+  pnpm_9,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openlist-frontend";
-  version = "4.1.0";
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList-Frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E1kdoTLL9SloSJBYB277BVYwgKp8rmFYmCj9yb6Otuw=";
+    hash = "sha256-crQm74JxVhEDbFQKWJzE6T6qKVMaQbJilI9hoGIxUYU=";
   };
 
   i18n = fetchzip {
     url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-/g6TXeCo+tkqE5xF2foghATErGEWUZuxtg70uDA5UFA=";
+    hash = "sha256-4v+hNQl7tSm331CPpqYGMIJXEeOSB0QyQNeQCL5zeFg=";
     stripRoot = false;
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10.configHook
+    pnpm_9.configHook
   ];
 
-  pnpmDeps = pnpm_10.fetchDeps {
+  pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    fetcherVersion = 1;
-    hash = "sha256-lWrh7jRx8DkwPZkk5Eh9YndfLsPIwCOUeLdieonZBgI=";
+    fetcherVersion = 2;
+    hash = "sha256-8wP57qIUGGccLX4oKkqQmibAoAHwnORhBFp80d+ltA4=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix
index 3132672e117f..f12ac9f7eaab 100644
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlist";
-  version = "4.1.0";
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-505rEnqIwn1EGhzqhcVWYgYqyPsV/obJzaHaK9W2tVA=";
+    hash = "sha256-CNnDPA/zByhR6GOmzxOZRc8F/QqGIxTGSIKXOCwlwwg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
   frontend = callPackage ./frontend.nix { };
 
   proxyVendor = true;
-  vendorHash = "sha256-J8ssJbILb3Gf6Br/PYkRAn4Haduf82iCYCfSAEi3nO4=";
+  vendorHash = "sha256-MHqQ/2FrqxufSa9OG3MWkm401qeIszK9rpgDR0jdCo4=";
 
   buildInputs = [ fuse ];