diff --git a/pkgs/by-name/pl/plausible/package.nix b/pkgs/by-name/pl/plausible/package.nix
index 9bfa3cdf652d..3afdb2a5040c 100644
--- a/pkgs/by-name/pl/plausible/package.nix
+++ b/pkgs/by-name/pl/plausible/package.nix
@@ -9,23 +9,23 @@
   runCommand,
   nixosTests,
   npm-lockfile-fix,
+  cmake,
   nix-update-script,
   brotli,
-  tailwindcss_3,
   esbuild,
   buildPackages,
 }:
 
 let
   pname = "plausible";
-  version = "3.0.1";
+  version = "3.2.1";
   mixEnv = "ce";
 
   src = fetchFromGitHub {
     owner = "plausible";
     repo = "analytics";
     rev = "v${version}";
-    hash = "sha256-DQIRsqkH2zgIkb3yezuJEKJ99PS031GJ+bDAeHMLNUY=";
+    hash = "sha256-2roIj0s2cybYdGmmJSPJ5Rc1gNunxlYew9JR5xxMv+k=";
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/assets/package-lock.json
       sed -ie '
@@ -47,7 +47,7 @@ let
     pname = "${pname}-assets";
     inherit version;
     src = "${src}/assets";
-    npmDepsHash = "sha256-hPbKEC8DE/gb483COG/ZbTuEP8Y44Fs7ppHMpXphCjg=";
+    npmDepsHash = "sha256-grYxPRzpu3pcv3lyTQxx0RDhmgFhsOKZoYbzd701xjA=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -60,7 +60,7 @@ let
     pname = "${pname}-tracker";
     inherit version;
     src = "${src}/tracker";
-    npmDepsHash = "sha256-kfqJVUw3xnMT0sOkc5O42CwBxPQXiYnOQ5WpdZwzxfE";
+    npmDepsHash = "sha256-hrsvQXvbcfRDUc1qinyUJ7Oh4yMM1e+UEdYudjYyJxk=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -69,6 +69,18 @@ let
     '';
   };
 
+  # lazy_html (new dep since 3.1.0) builds a NIF against lexbor
+  # its Makefile clones lexbor at build time (which sandbox forbids)
+  # pre-seed commit in lazy_html's mix.exs so the clone target is skipped
+  # and force a build in preBuild below
+  lexborCommit = "244b84956a6dc7eec293781d051354f351274c46";
+  lexborSrc = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    rev = lexborCommit;
+    hash = "sha256-Oup/lGU8a9Dqfho4Llg39t9Y9n4xfUmGk0772OkpnLQ=";
+  };
+
   mixFodDeps = beamPackages.fetchMixDeps {
     inherit
       pname
@@ -76,7 +88,7 @@ let
       src
       mixEnv
       ;
-    hash = "sha256-caCbuMEDsLcxm8xehWEJiaTfgl435crBfnQFQpzGsLY";
+    hash = "sha256-fm/elkCNpu5sduBxly06i/z30Y9BMtt+qthXmLuvlUc=";
   };
 
   mjmlNif = rustPlatform.buildRustPackage {
@@ -84,7 +96,7 @@ let
     version = "";
     src = "${mixFodDeps}/mjml/native/mjml_nif";
 
-    cargoHash = "sha256-zDWOik65PWAMpIDDcG+DibprPVW/k+Q83+fjFI5vWaY=";
+    cargoHash = "sha256-a8xSRdFtMYF0n2rl7A5ZgHoaunUJLVJwHvrkc9uyZKo=";
     doCheck = false;
 
     env = {
@@ -109,7 +121,13 @@ let
           file=''${lib##*/}
           base=''${file%.*}
           ln -s "$lib" $out/mjml/priv/native/$base.so
+          # mjml >= 4.0 loads through RustlerPrecompiled (expects NIF name w/o lib prefix)
+          ln -s "$lib" $out/mjml/priv/native/''${base#lib}.so
         done
+
+        mkdir -p $out/lazy_html/_build/c/third_party/lexbor
+        cp -r --no-preserve=mode ${lexborSrc} \
+          $out/lazy_html/_build/c/third_party/lexbor/${lexborCommit}
       '';
 
   beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
@@ -126,10 +144,22 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [
     nodejs
     brotli
+    cmake
   ];
 
+  dontUseCmakeConfigure = true;
+
   mixFodDeps = patchedMixFodDeps;
 
+  # deps are compiled in mixRelease configurePhase
+  # so the force_build switch must be in place before then
+  # preBuild would be too late
+  preConfigure = ''
+    cat >> config/config.exs <<EOF
+    config :elixir_make, :force_build, lazy_html: true
+    EOF
+  '';
+
   passthru = {
     tests = {
       inherit (nixosTests) plausible;
@@ -160,12 +190,15 @@ beamPackages.mixRelease rec {
   preBuild = ''
     rm -r assets tracker
     cp --no-preserve=mode -r ${assets} assets
-    cp -r ${tracker} tracker
+    # tracker must be writable since 3.1.0
+    # compile.js emits npm_package/plausible.js
+    cp --no-preserve=mode -r ${tracker} tracker
 
     # Fix cross-compilation with buildPackages
-    # since tailwindcss_3 is not available for RiscV
+    # since tailwindcss is not available for RiscV
+    # plausible >= 3.1.0 needs tailwind v4
     cat >> config/config.exs <<EOF
-    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_3}"
+    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_4}"
     config :esbuild, path: "${lib.getExe esbuild}"
     EOF
   '';