diff --git a/pkgs/development/python-modules/aws-encryption-sdk/default.nix b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
index 0b2927a57671..8259249666e6 100644
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@@ -12,16 +12,16 @@
   wrapt,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aws-encryption-sdk";
-  version = "4.0.3";
+  version = "4.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-encryption-sdk-python";
-    tag = "v${version}";
-    hash = "sha256-SlYXob61YLl96NKnmsGZTIU10bfwKYbhLsHjC/tXGI4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u0Fu6ikUJ70RQgptsAGbzmx3+FpXGTpN4Y2rKOSgO2o=";
   };
 
   build-system = [ setuptools ];
@@ -59,8 +59,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python implementation of the AWS Encryption SDK";
     homepage = "https://aws-encryption-sdk-python.readthedocs.io/";
-    changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ anthonyroussel ];
   };
-}
+})