diff --git a/pkgs/by-name/_3/_389-ds-base/package.nix b/pkgs/by-name/_3/_389-ds-base/package.nix
index dd2da0d95d65..6c7b14d59505 100644
--- a/pkgs/by-name/_3/_389-ds-base/package.nix
+++ b/pkgs/by-name/_3/_389-ds-base/package.nix
@@ -58,6 +58,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-trzY/fDH3rs66DWbWI+PY46tIC9ShuVqspMHqEEKZYA=";
     })
     ./0001-remove-hard-coded-vendor-paths.patch
+    (fetchpatch {
+      # https://github.com/389ds/389-ds-base/security/advisories/GHSA-4qwg-c5j2-q4hp
+      name = "CVE-2025-14905.patch";
+      url = "https://github.com/389ds/389-ds-base/commit/2e424110def2e3998f6045e136fb0d43f47b7f5a.patch";
+      hash = "sha256-ItxG0bnuNPWLClL677rChTDvDWXxJ2L6ygx4VY2v80w=";
+    })
   ];
 
   cargoRoot = "src";