diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index 3e57180a5b28..d92900b7220b 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -94,6 +94,7 @@ in
           ConditionFileNotEmpty = ""; # override upstream
         };
         serviceConfig = {
+          Type = "notify";
           User = "step-ca";
           Group = "step-ca";
           UMask = "0077";
diff --git a/pkgs/by-name/st/step-ca/package.nix b/pkgs/by-name/st/step-ca/package.nix
index 7407358db680..28ce11bce858 100644
--- a/pkgs/by-name/st/step-ca/package.nix
+++ b/pkgs/by-name/st/step-ca/package.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.28.4";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "smallstep";
@@ -24,20 +24,10 @@ buildGoModule rec {
     # Use forceFetchGit to fetch the source as git repo, as fetchGit isn't effected,
     # see https://github.com/NixOS/nixpkgs/issues/84312#issuecomment-2475948960.
     forceFetchGit = true;
-    hash = "sha256-ZIpsSNdQVkelo5b3H03N8qToHU7z+lalAE7Ur6m2YwY=";
+    hash = "sha256-TFpgVE394r6FkRWovlmDd3v/tGic2CekmO1Hp7S6KCE=";
   };
 
-  patches = [
-    # fix broken test TestHandler_RevokeCert
-    # https://github.com/smallstep/certificates/pull/2370
-    # TODO: remove at next release
-    (fetchpatch2 {
-      url = "https://github.com/smallstep/certificates/commit/b7e59c97f3b8a95a24153aeb85959118953f2bb4.patch?full_index=1";
-      hash = "sha256-GKGKUj4hpS4jo6sMvUhnD3BeE+f5vnxY5tK0a2pwpNM=";
-    })
-  ];
-
-  vendorHash = "sha256-gGPrrl5J8UrjUpof2DaSs1fAQsMSsyAMlC67h5V75+k=";
+  vendorHash = "sha256-9PlJaB3BCwoE+uFo5jUggANSH7ZWnintZYBgFL21LZ4=";
 
   ldflags = [
     "-w"