diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index 743e429c0051..c4618ba9403e 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -39,13 +39,13 @@ let
       rec {
 
         pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
-        version = "2.12.1";
+        version = "2.13.0";
 
         src = fetchFromGitHub {
           owner = "ARM-software";
           repo = "arm-trusted-firmware";
-          tag = "lts-v${version}";
-          hash = "sha256-yPWygW1swSwL3DrHPNIlTeTeV7XG4C9ALFA/+OTiz+4=";
+          tag = "v${version}";
+          hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
         };
 
         patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -96,6 +96,9 @@ let
         hardeningDisable = [ "all" ];
         dontStrip = true;
 
+        # breaks secondary CPU bringup on at least RK3588, maybe others
+        env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
+
         meta =
           with lib;
           {