diff --git a/nixos/tests/litestream.nix b/nixos/tests/litestream.nix
index f5a1668c30f2..b610c334ec01 100644
--- a/nixos/tests/litestream.nix
+++ b/nixos/tests/litestream.nix
@@ -59,6 +59,7 @@
           security = {
             admin_user = "admin";
             admin_password = "admin";
+            secret_key = "SW2YcwTIb9zpOOhoPsMm";
           };
 
           server = {
diff --git a/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch b/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch
deleted file mode 100644
index 8fd06b712a24..000000000000
--- a/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-diff --git a/cmd/litestream/main.go b/cmd/litestream/main.go
-index 1234567..abcdefg 100644
---- a/cmd/litestream/main.go
-+++ b/cmd/litestream/main.go
-@@ -362,6 +362,7 @@ type ReplicaConfig struct {
- 	Host     string `yaml:"host"`
- 	User     string `yaml:"user"`
- 	Password string `yaml:"password"`
- 	KeyPath  string `yaml:"key-path"`
-+	HostKeyPath string `yaml:"host-key-path"`
- 
- 	// Encryption identities and recipients
-@@ -664,6 +665,7 @@ func NewReplicaFromConfig(c *ReplicaConfig, dbc *DBConfig) (_ litestream.Replic
- 	client.Password = password
- 	client.Path = path
- 	client.KeyPath = c.KeyPath
-+	client.HostKeyPath = c.HostKeyPath
- 	return client, nil
- }
- 
-diff --git a/sftp/replica_client.go b/sftp/replica_client.go
-index 30d8fa87..8b651e97 100644
---- a/sftp/replica_client.go
-+++ b/sftp/replica_client.go
-@@ -41,6 +41,7 @@ type ReplicaClient struct {
- 	Password    string
- 	Path        string
- 	KeyPath     string
-+	HostKeyPath string
- 	DialTimeout time.Duration
- }
- 
-@@ -71,14 +72,28 @@ func (c *ReplicaClient) Init(ctx context.Context) (_ *sftp.Client, err error) {
- 
- 	// Build SSH configuration & auth methods
- 	config := &ssh.ClientConfig{
--		User:            c.User,
--		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
--		BannerCallback:  ssh.BannerDisplayStderr(),
-+		User:           c.User,
-+		BannerCallback: ssh.BannerDisplayStderr(),
- 	}
- 	if c.Password != "" {
- 		config.Auth = append(config.Auth, ssh.Password(c.Password))
- 	}
- 
-+	if c.HostKeyPath == "" {
-+		config.HostKeyCallback = ssh.InsecureIgnoreHostKey()
-+	} else {
-+		buf, err := os.ReadFile(c.HostKeyPath)
-+		if err != nil {
-+			return nil, fmt.Errorf("cannot read sftp host key path: %w", err)
-+		}
-+
-+		key, _, _, _, err := ssh.ParseAuthorizedKey(buf)
-+		if err != nil {
-+			return nil, fmt.Errorf("cannot parse sftp host key path: path=%s len=%d err=%w", c.HostKeyPath, len(buf), err)
-+		}
-+		config.HostKeyCallback = ssh.FixedHostKey(key)
-+	}
-+
- 	if c.KeyPath != "" {
- 		buf, err := os.ReadFile(c.KeyPath)
- 		if err != nil {
\ No newline at end of file
diff --git a/pkgs/by-name/li/litestream/package.nix b/pkgs/by-name/li/litestream/package.nix
index f5d68da741a8..c5c359a6f2d9 100644
--- a/pkgs/by-name/li/litestream/package.nix
+++ b/pkgs/by-name/li/litestream/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "litestream";
-  version = "0.3.14";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = "litestream";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rTPw1BnZPtcWzhwR9mCzoE4LXdlaFfRCIDMHlN/SRzk=";
+    hash = "sha256-GYYg1XyLhRBaUCY6RL8xLuaPL7k8KI2WjiGI8k86AW4=";
   };
 
   ldflags = [
@@ -21,9 +21,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-sYIY3Z3VrCqbjEbQtEY7q6Jljg8jMoa2qWEB/IkDjzM=";
-
-  patches = [ ./fix-cve-2024-41254.patch ];
+  vendorHash = "sha256-e2fsgK/fZNIos5W/Gc3u72uzoT2igs6BgzYtz1PyI10=";
 
   passthru.tests = { inherit (nixosTests) litestream; };