diff --git a/pkgs/by-name/sp/spice-up/package.nix b/pkgs/by-name/sp/spice-up/package.nix
index 52ae9f68a666..2b92548348c7 100644
--- a/pkgs/by-name/sp/spice-up/package.nix
+++ b/pkgs/by-name/sp/spice-up/package.nix
@@ -15,19 +15,18 @@
   libevdev,
   libgee,
   libgudev,
-  libsoup_2_4,
   pantheon,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spice-up";
   version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "Philip-Scott";
     repo = "Spice-up";
-    rev = version;
-    sha256 = "sha256-FI6YMbqZfaU19k8pS2eoNCnX8O8F99SHHOxMwHC5fTc=";
+    tag = finalAttrs.version;
+    hash = "sha256-FI6YMbqZfaU19k8pS2eoNCnX8O8F99SHHOxMwHC5fTc=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +45,16 @@ stdenv.mkDerivation rec {
     libevdev
     libgee
     libgudev
-    libsoup_2_4
     pantheon.granite
   ];
 
+  # Drop dependency on libsoup 2.4, which is insecure. It's no longer actually
+  # used upstream, so this is harmless.
+  # https://github.com/Philip-Scott/Spice-up/issues/328
   postPatch = ''
+    substituteInPlace meson.build --replace-fail "soup_dep = dependency('libsoup-2.4')" ""
+    substituteInPlace src/meson.build --replace-fail "soup_dep," ""
+
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
   '';
@@ -72,4 +76,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     mainProgram = "com.github.philip_scott.spice-up";
   };
-}
+})