diff --git a/pkgs/by-name/tm/tmux/package.nix b/pkgs/by-name/tm/tmux/package.nix
index b5efd8d2c9b0..edc21ddf934f 100644
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   bison,
   libevent,
@@ -36,6 +37,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VwOyR9YYhA/uyVRJbspNrKkJWJGYFFktwPnnwnIJ97s=";
   };
 
+  patches = [
+    # Fix NULL pointer dereference in control_write() when a control-mode
+    # client is notified before control_state has been allocated.
+    # https://github.com/tmux/tmux/issues/4980
+    (fetchpatch {
+      name = "tmux-control-notify-uninitialized.patch";
+      url = "https://github.com/tmux/tmux/commit/e5a2a25fafb8ee107c230d8acad694f6b635f8bb.patch";
+      hash = "sha256-UPbhMNnH1WJwTH/LVwjVonTqvNhyuniUrYm7iLVkCfg=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook