diff --git a/pkgs/by-name/sh/shadow/fix-install-with-tcb.patch b/pkgs/by-name/sh/shadow/fix-install-with-tcb.patch
index ff6166b92f1d..33d90fe1e48e 100644
--- a/pkgs/by-name/sh/shadow/fix-install-with-tcb.patch
+++ b/pkgs/by-name/sh/shadow/fix-install-with-tcb.patch
@@ -1,28 +1,12 @@
 diff --git a/src/Makefile.am b/src/Makefile.am
-index a1a2e4e..fa17f9d 100644
+index 6981815..bcc4568 100644
 --- a/src/Makefile.am
 +++ b/src/Makefile.am
-@@ -74,10 +74,6 @@ suidubins += newgidmap newuidmap
- endif
- endif
- 
--if WITH_TCB
--shadowsgidubins = passwd
--endif
--
- LDADD          = $(INTLLIBS) \
- 		 $(top_builddir)/libmisc/libmisc.la \
- 		 $(top_builddir)/lib/libshadow.la \
-@@ -146,12 +142,6 @@ install-am: all-am
- 	set -e; for i in $(suidusbins); do \
- 		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
+@@ -152,7 +152,6 @@ install-am: all-am
  	done
--if WITH_TCB
--	set -e; for i in $(shadowsgidubins); do \
+ if WITH_TCB
+ 	set -e; for i in $(shadowsgidubins); do \
 -		chown root:shadow $(DESTDIR)$(ubindir)/$$i; \
--		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
--	done
--endif
- if ENABLE_SUBIDS
- if FCAPS
- 	setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap
+ 		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
+ 	done
+ endif
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index 72681d81eae0..dc31417b6a3e 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -68,9 +68,13 @@ stdenv.mkDerivation rec {
   ++ lib.optional withTcb tcb;
 
   patches = [
+    # Don't set $PATH to /bin:/usr/bin but inherit the $PATH of the caller.
     ./keep-path.patch
     # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
     ./respect-xml-catalog-files-var.patch
+    # Avoid a chown during install to fix installation with tcb enabled
+    # Would have to be done as part of the NixOS modules,
+    # see https://github.com/NixOS/nixpkgs/issues/109457
     ./fix-install-with-tcb.patch
   ];