diff --git a/pkgs/servers/keycloak/config_vars.patch b/pkgs/servers/keycloak/config_vars.patch
new file mode 100644
index 000000000000..be2d54790c2b
--- /dev/null
+++ b/pkgs/servers/keycloak/config_vars.patch
@@ -0,0 +1,15 @@
+diff --git a/quarkus/dist/src/main/content/bin/kc.sh b/quarkus/dist/src/main/content/bin/kc.sh
+index d7be862cde..16f9aa78e0 100644
+--- a/bin/kc.sh
++++ b/bin/kc.sh
+@@ -32,8 +32,8 @@ abs_path () {
+   fi
+ }
+ 
+-SERVER_OPTS="-Dkc.home.dir='$(abs_path '..')'"
+-SERVER_OPTS="$SERVER_OPTS -Djboss.server.config.dir='$(abs_path '../conf')'"
++SERVER_OPTS="-Dkc.home.dir=$KC_HOME_DIR"
++SERVER_OPTS="$SERVER_OPTS -Djboss.server.config.dir=$KC_CONF_DIR"
+ SERVER_OPTS="$SERVER_OPTS -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
+ SERVER_OPTS="$SERVER_OPTS -Dquarkus-log-max-startup-records=10000"
+ CLASSPATH_OPTS="'$(abs_path "../lib/quarkus-run.jar"):$(abs_path "../lib/bootstrap/*")'"
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 373a6d03d9de..d4ec9d6e9ed7 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -13,15 +13,21 @@
 
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "19.0.2";
+  version = "20.0.0";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-Ze9VE2gtLxoZpyqbeisvHdOu8yFPwAKnDMpfA3FXWy8=";
+    sha256 = "sha256-dJueuXKv3GoDnaQnvYMzIJJSr+NNSYgS7KY3MTGE37Y=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
 
+  patches = [
+    # Make home.dir and config.dir configurable through the
+    # KC_HOME_DIR and KC_CONF_DIR environment variables.
+    ./config_vars.patch
+  ];
+
   buildPhase = ''
     runHook preBuild
   '' + lib.optionalString (confFile != null) ''
@@ -37,6 +43,8 @@ stdenv.mkDerivation rec {
     ${lib.concatMapStringsSep "\n" (pl: "install_plugin ${lib.escapeShellArg pl}") plugins}
   '' + ''
     patchShebangs bin/kc.sh
+    export KC_HOME_DIR=$(pwd)
+    export KC_CONF_DIR=$(pwd)/conf
     bin/kc.sh build
 
     runHook postBuild
@@ -54,9 +62,6 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Dkc.home.dir='$DIRNAME'/../"} '-Dkc.home.dir=$KC_HOME_DIR'
-    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Djboss.server.config.dir='$DIRNAME'/../conf"} '-Djboss.server.config.dir=$KC_CONF_DIR'
-
     for script in $(find $out/bin -type f -executable); do
       wrapProgram "$script" --set JAVA_HOME ${jre} --prefix PATH : ${jre}/bin
     done