diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 6c341bcbf240..51877970a8bc 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -74,7 +74,7 @@ in {
         default = false;
         description = ''
           Whether to enable test remote. This is used by
-          <link xlink:href="https://github.com/hughsie/fwupd/blob/master/data/installed-tests/README.md">installed tests</link>.
+          <link xlink:href="https://github.com/fwupd/fwupd/blob/master/data/installed-tests/README.md">installed tests</link>.
         '';
       };
 
@@ -115,10 +115,6 @@ in {
     services.udev.packages = [ cfg.package ];
 
     systemd.packages = [ cfg.package ];
-
-    systemd.tmpfiles.rules = [
-      "d /var/lib/fwupd 0755 root root -"
-    ];
   };
 
   meta = {
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index 4903eadef4b5..81e82d68dbc4 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,30 +1,21 @@
 diff --git a/data/meson.build b/data/meson.build
-index 61664cd6..f10abbba 100644
+index 25db9509..f394eb25 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -11,7 +11,7 @@ if get_option('daemon')
+@@ -13,7 +13,7 @@
+ if build_daemon
+   subdir('installed-tests')
+   install_data(['daemon.conf'],
+-    install_dir : join_paths(sysconfdir, 'fwupd')
++    install_dir : join_paths(sysconfdir_install, 'fwupd')
+   )
  endif
  
- install_data(['daemon.conf'],
--  install_dir : join_paths(sysconfdir, 'fwupd')
-+  install_dir : join_paths(sysconfdir_install, 'fwupd')
- )
- 
- install_data(['org.freedesktop.fwupd.metainfo.xml'],
-@@ -23,7 +23,7 @@ install_data(['org.freedesktop.fwupd.svg'],
- )
- 
- install_data(['org.freedesktop.fwupd.conf'],
--  install_dir : join_paths(sysconfdir, 'dbus-1', 'system.d')
-+  install_dir : join_paths(sysconfdir_install, 'dbus-1', 'system.d')
- )
- 
- if get_option('daemon')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
 index eefcc914..dc801fa1 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -4,14 +4,14 @@ if get_option('gpg')
+@@ -4,14 +4,14 @@
        'GPG-KEY-Linux-Foundation-Firmware',
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
@@ -41,7 +32,7 @@ index eefcc914..dc801fa1 100644
    )
  endif
  
-@@ -19,12 +19,12 @@ if get_option('pkcs7')
+@@ -19,12 +19,12 @@
    install_data([
        'LVFS-CA.pem',
      ],
@@ -57,10 +48,10 @@ index eefcc914..dc801fa1 100644
  endif
  
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index a27c31ef..374e09b6 100644
+index 826a3c1d..b78db663 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
-@@ -3,7 +3,7 @@ if get_option('daemon') and get_option('lvfs')
+@@ -3,7 +3,7 @@
        'lvfs.conf',
        'lvfs-testing.conf',
      ],
@@ -69,7 +60,7 @@ index a27c31ef..374e09b6 100644
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -37,12 +37,12 @@ configure_file(
+@@ -37,12 +37,12 @@
    output : 'vendor.conf',
    configuration : con2,
    install: true,
@@ -85,10 +76,10 @@ index a27c31ef..374e09b6 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index a89f9b3f..736896eb 100644
+index 8e1de887..a5bb1fe6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -145,6 +145,12 @@ localstatedir = join_paths(prefix, get_option('localstatedir'))
+@@ -158,6 +158,12 @@
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -99,13 +90,13 @@ index a89f9b3f..736896eb 100644
 +endif
 +
  gio = dependency('gio-2.0', version : '>= 2.45.8')
+ giounix = dependency('gio-unix-2.0', version : '>= 2.45.8')
  if gio.version().version_compare ('>= 2.55.0')
-   conf.set('HAVE_GIO_2_55_0', '1')
 diff --git a/meson_options.txt b/meson_options.txt
-index 5d4163e8..db81fd1f 100644
+index 71b50c6a..561c2031 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -21,6 +21,7 @@ option('plugin_modem_manager', type : 'boolean', value : false, description : 'e
+@@ -24,6 +24,7 @@
  option('systemd', type : 'boolean', value : true, description : 'enable systemd support')
  option('systemdunitdir', type: 'string', value: '', description: 'Directory for systemd units')
  option('elogind', type : 'boolean', value : false, description : 'enable elogind support')
@@ -117,7 +108,7 @@ diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
 index cb9f4555..b972d7fb 100644
 --- a/plugins/dell-esrt/meson.build
 +++ b/plugins/dell-esrt/meson.build
-@@ -36,5 +36,5 @@ configure_file(
+@@ -36,5 +36,5 @@
    output : 'dell-esrt.conf',
    configuration : con2,
    install: true,
@@ -128,7 +119,7 @@ diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
 index 5c88504e..7706da71 100644
 --- a/plugins/redfish/meson.build
 +++ b/plugins/redfish/meson.build
-@@ -26,7 +26,7 @@ shared_module('fu_plugin_redfish',
+@@ -26,7 +26,7 @@
  )
  
  install_data(['redfish.conf'],
@@ -137,11 +128,24 @@ index 5c88504e..7706da71 100644
  )
  
  if get_option('tests')
+diff --git a/plugins/thunderbolt/meson.build b/plugins/thunderbolt/meson.build
+index 42718abf..bc815491 100644
+--- a/plugins/thunderbolt/meson.build
++++ b/plugins/thunderbolt/meson.build
+@@ -46,7 +46,7 @@
+ )
+ 
+ install_data(['thunderbolt.conf'],
+-  install_dir:  join_paths(sysconfdir, 'fwupd')
++  install_dir:  join_paths(sysconfdir_install, 'fwupd')
+ )
+ # we use functions from 2.52 in the tests
+ if get_option('tests') and umockdev.found() and gio.version().version_compare('>= 2.52')
 diff --git a/plugins/uefi/meson.build b/plugins/uefi/meson.build
-index ac9f5dd8..1ab51b5e 100644
+index 45b18d7d..ef8e0b04 100644
 --- a/plugins/uefi/meson.build
 +++ b/plugins/uefi/meson.build
-@@ -79,7 +79,7 @@ executable(
+@@ -85,7 +85,7 @@
  )
  
  install_data(['uefi.conf'],
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 785693272191..1f6a7145b779 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -45,6 +45,7 @@
 , freetype
 , fontconfig
 , pango
+, tpm2-tss
 , bubblewrap
 , efibootmgr
 , flashrom
@@ -79,18 +80,18 @@ let
 
   # # Currently broken on Aarch64
   # haveFlashrom = isx86;
-  # Experimental in 1.2.10
+  # Experimental
   haveFlashrom = false;
 
 in
 
 stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.2.10";
+  version = "1.3.3";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0inngs7i48akm9c7fmdsf9zjif595rkaba69rl76jfwfv8r21vjb";
+    sha256 = "0nqzqvx8nzflhb4kzvkdcv7kixb50vh6h21kpkd7pjxp942ndzql";
   };
 
   outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
@@ -137,6 +138,7 @@ stdenv.mkDerivation rec {
     freetype
     fontconfig
     pango
+    tpm2-tss
     efivar
   ] ++ stdenv.lib.optionals haveDell [
     libsmbios
@@ -146,6 +148,10 @@ stdenv.mkDerivation rec {
     ./fix-paths.patch
     ./add-option-for-installation-sysconfdir.patch
 
+    # do not require which
+    # https://github.com/fwupd/fwupd/pull/1568
+    ./no-which.patch
+
     # installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle
     (substituteAll {
@@ -195,6 +201,7 @@ stdenv.mkDerivation rec {
   '';
 
   mesonFlags = [
+    "-Dgtkdoc=true"
     "-Dplugin_dummy=true"
     "-Dudevdir=lib/udev"
     "-Dsystemdunitdir=lib/systemd/system"
@@ -209,8 +216,8 @@ stdenv.mkDerivation rec {
     "-Dplugin_synaptics=false"
   ] ++ stdenv.lib.optionals (!haveRedfish) [
     "-Dplugin_redfish=false"
-  ] ++ stdenv.lib.optionals (!haveFlashrom) [
-    "-Dplugin_flashrom=false"
+  ] ++ stdenv.lib.optionals haveFlashrom [
+    "-Dplugin_flashrom=true"
   ];
 
   # TODO: We need to be able to override the directory flags from meson setup hook
@@ -231,6 +238,9 @@ stdenv.mkDerivation rec {
   # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
   PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
 
+  # cannot install to systemd prefix
+  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMPRESETDIR = "${placeholder "out"}/lib/systemd/system-preset";
+
   # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
   dontWrapGApps = true;
   # so we need to wrap the executables manually
@@ -247,11 +257,15 @@ stdenv.mkDerivation rec {
   # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
   passthru = {
     filesInstalledToEtc = [
+      # "fwupd/daemon.conf" # already created by the module
+      "fwupd/redfish.conf"
       "fwupd/remotes.d/dell-esrt.conf"
       "fwupd/remotes.d/lvfs-testing.conf"
       "fwupd/remotes.d/lvfs.conf"
       "fwupd/remotes.d/vendor.conf"
       "fwupd/remotes.d/vendor-directory.conf"
+      "fwupd/thunderbolt.conf"
+      # "fwupd/uefi.conf" # already created by the module
       "pki/fwupd/GPG-KEY-Hughski-Limited"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
@@ -267,7 +281,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = https://fwupd.org/;
+    homepage = "https://fwupd.org/";
     maintainers = with maintainers; [ jtojnar ];
     license = [ licenses.gpl2 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
index 9efd7b8d6abd..474b250097d0 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
@@ -6,14 +6,3 @@ index c7a430c0..e69de29b 100644
 -install_data('README.md',
 -  install_dir : join_paths(localstatedir, 'lib', 'fwupd', 'builder')
 -)
-diff --git a/meson_post_install.sh b/meson_post_install.sh
-index 0cbb6f41..d757a81a 100755
---- a/meson_post_install.sh
-+++ b/meson_post_install.sh
-@@ -11,6 +11,4 @@ LOCALSTATEDIR=$2
-     echo 'Updating systemd deps'
-     mkdir -p ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants
-     ln -sf ../fwupd-offline-update.service ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants/fwupd-offline-update.service
--    echo 'Creating stateful directory'
--    mkdir -p ${DESTDIR}${LOCALSTATEDIR}/lib/fwupd
- #fi
diff --git a/pkgs/os-specific/linux/firmware/fwupd/no-which.patch b/pkgs/os-specific/linux/firmware/fwupd/no-which.patch
new file mode 100644
index 000000000000..c0c65e42539d
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupd/no-which.patch
@@ -0,0 +1,31 @@
+--- a/plugins/uefi/efi/generate_binary.sh
++++ b/plugins/uefi/efi/generate_binary.sh
+@@ -1,9 +1,9 @@
+ #!/bin/sh
+ output=$2
+-objcopy_cmd=$(which objcopy)
+-genpeimg_cmd=$(which genpeimg)
++objcopy_cmd=$(command -v objcopy)
++genpeimg_cmd=$(command -v genpeimg)
+ 
+-$objcopy_cmd  -j .text \
++"$objcopy_cmd"  -j .text \
+               -j .sdata \
+               -j .data \
+               -j .dynamic \
+@@ -11,7 +11,7 @@
+               -j .rel \
+               -j .rela \
+               -j .reloc \
+-              $*
++              "$@"
+ 
+ if [ -n "${genpeimg_cmd}" ]; then
+         $genpeimg_cmd -d \
+@@ -20,5 +20,5 @@
+                       +n \
+                       -d \
+                       +s \
+-                      $output
++                      "$output"
+ fi