diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 98fee1747810..32de529c5544 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -56,7 +56,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.32.04";
+  version = "6.32.06";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -64,15 +64,15 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-Ey8Saq59MO+8zX3NmRt62hiQrleYDvMAwWQh+dTQfqg=";
+    hash = "sha256-P8Ay2T/oSN6lrbG0fY8KhieVIyk/7gqis81Sof+rckc=";
   };
 
   clad_src = fetchgit {
     url = "https://github.com/vgvassilev/clad";
     # Make sure that this is the same tag as in the ROOT build files!
     # https://github.com/root-project/root/blob/master/interpreter/cling/tools/plugins/clad/CMakeLists.txt#L76
-    rev = "refs/tags/v1.6";
-    hash = "sha256-Fv3i84lgoifxtyWKhQjj1c4bR9wSl5SPzUh0ZhZBxFI=";
+    rev = "refs/tags/v1.7";
+    hash = "sha256-iKrZsuUerrlrjXBrxcTsFu/t0Pb0sa4UlfSwd1yhg3g=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -124,22 +124,22 @@ stdenv.mkDerivation rec {
       fi
     done
     substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
-      --replace 'set(lcgpackages ' '#set(lcgpackages '
+      --replace-fail 'set(lcgpackages ' '#set(lcgpackages '
 
     # We have to bypass the connection check, because it would disable clad.
     # This should probably be fixed upstream with a flag to disable the
     # connectivity check!
     substituteInPlace CMakeLists.txt \
-      --replace 'if(clad AND NO_CONNECTION)' 'if(FALSE)'
+      --replace-fail 'if(clad AND NO_CONNECTION)' 'if(FALSE)'
     # Make sure that clad is not downloaded when building
     substituteInPlace interpreter/cling/tools/plugins/clad/CMakeLists.txt \
-      --replace 'UPDATE_COMMAND ""' 'SOURCE_DIR ${clad_src} DOWNLOAD_COMMAND "" UPDATE_COMMAND ""'
+      --replace-fail 'UPDATE_COMMAND ""' 'SOURCE_DIR ${clad_src} DOWNLOAD_COMMAND "" UPDATE_COMMAND ""'
     # Make sure that clad is finding the right llvm version
     substituteInPlace interpreter/cling/tools/plugins/clad/CMakeLists.txt \
-      --replace '-DLLVM_DIR=''${LLVM_BINARY_DIR}' '-DLLVM_DIR=${llvm_16.dev}/lib/cmake/llvm'
+      --replace-fail '-DLLVM_DIR=''${LLVM_BINARY_DIR}' '-DLLVM_DIR=${llvm_16.dev}/lib/cmake/llvm'
 
     substituteInPlace interpreter/llvm-project/clang/tools/driver/CMakeLists.txt \
-      --replace 'add_clang_symlink(''${link} clang)' ""
+      --replace-fail 'add_clang_symlink(''${link} clang)' ""
 
     # Don't require textutil on macOS
     : > cmake/modules/RootCPack.cmake
@@ -152,7 +152,7 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Eliminate impure reference to /System/Library/PrivateFrameworks
     substituteInPlace core/macosx/CMakeLists.txt \
-      --replace "-F/System/Library/PrivateFrameworks " ""
+      --replace-fail "-F/System/Library/PrivateFrameworks " ""
   '' + lib.optionalString (stdenv.hostPlatform.isDarwin && lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
   '';