diff --git a/pkgs/by-name/th/thorium-reader/package.nix b/pkgs/by-name/th/thorium-reader/package.nix
index e345900043fa..b98d7cd74d79 100644
--- a/pkgs/by-name/th/thorium-reader/package.nix
+++ b/pkgs/by-name/th/thorium-reader/package.nix
@@ -14,18 +14,35 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thorium-reader";
-  version = "3.3.0";
+  version = "3.4.0";
   nodejs = nodejs_24;
-  npmDepsHash = "sha256-UR2MSqmdJ79Fz7qjQRkCAwx2jdMn8KLWPzNSnnsb5Ak=";
+  npmDepsHash = "sha256-IwdU77fRJJ7Ch5rWop3lFpf14XHklFDa8w6YJCFtJRU=";
   makeCacheWritable = true;
 
   src = fetchFromGitHub {
     owner = "edrlab";
     repo = "thorium-reader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2d5M9C/cLK2A8O3Ls0xEkT6H8tucVR7eivPi+82V7Zg=";
+    hash = "sha256-h285GM7DKKD34Wjw6E+zSSIGkUH/UOesLrYD2EdQ7+U=";
   };
 
+  # The upstream `build` script re-runs `npm i` inside `dist/` to populate
+  # `dist/node_modules` with the runtime subset declared in `src/package.json`.
+  # This is bad (not reproducible), so we strip that segment from the `build`
+  # script. This ends up not being an issue, since our build/install process
+  # copies relevant dependencies anyways.
+  patches = [ ./remove-dist-npm-install.patch ];
+
+  postBuild = ''
+    # copy node modules manually
+    cp -r node_modules dist/node_modules
+
+    # remove unnecessary npm deps
+    pushd dist
+    npm prune --production --ignore-scripts --offline --no-audit --no-fund
+    popd
+  '';
+
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   # makeBinaryWrapper is required on Darwin since MacOS is confuses itself
   # into thinking it needs Rosetta 2 if it encounters a non-MachO executable
diff --git a/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch b/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch
new file mode 100644
index 000000000000..4b5146605262
--- /dev/null
+++ b/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch
@@ -0,0 +1,13 @@
+diff --git a/package.json b/package.json
+index d838331..073dfff 100644
+--- a/package.json
++++ b/package.json
+@@ -25,7 +25,7 @@
+     "_NOT_NEEDED_electron-build_": "npm rebuild --runtime=electron --target=41.1.1 --disturl=https://electronjs.org/headers --build-from-source",
+     "_NOT_NEEDED_electron-build": "electron-rebuild --version=41.1.1 --disturl=https://electronjs.org/headers",
+     "_NOT_NEEDED_rmDupeReactReduxTypes": "rimraf \"./node_modules/@types/react-redux/node_modules/@types/react\"",
+-    "build": "cross-env NODE_ENV=production webpack --config webpack.config.js && ncp src/package.json dist/package.json && cd dist && rimraf node_modules && npm i --ignore-scripts --foreground-scripts && rimraf package-lock.json && cd ..",
++    "build": "cross-env NODE_ENV=production webpack --config webpack.config.js && ncp src/package.json dist/package.json",
+     "build:prod": "npm run lint && npm run build",
+     "build:dev:main": "webpack --config webpack.config.main.js",
+     "_NOT_NEEDED_build:dev:renderer:library": "webpack --config webpack.config.renderer-library.js",