diff --git a/pkgs/applications/virtualization/xen/4.15.nix b/pkgs/applications/virtualization/xen/4.15.nix
index d600c06e3694..505bc313c43c 100644
--- a/pkgs/applications/virtualization/xen/4.15.nix
+++ b/pkgs/applications/virtualization/xen/4.15.nix
@@ -146,11 +146,13 @@ callPackage (import ./generic.nix (rec {
     "-Wno-error=zero-length-bounds"
   ];
 
-  patches = [
+  patches = with xsa; flatten [
     ./0000-fix-ipxe-src.4.15.patch
     ./0000-fix-install-python.4.15.patch
     ./0004-makefile-use-efi-ld.4.15.patch
     ./0005-makefile-fix-efi-mountdir-use.4.15.patch
+
+    XSA_386
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/xen/xsa-patches.nix b/pkgs/applications/virtualization/xen/xsa-patches.nix
index b1d1d7783c24..d789697a5599 100644
--- a/pkgs/applications/virtualization/xen/xsa-patches.nix
+++ b/pkgs/applications/virtualization/xen/xsa-patches.nix
@@ -485,4 +485,9 @@ in {
       sha256 = "0lc94cx271z09r0mhxaypyd9d4740051p28idf5calx5228dqjgm";
     })
   ];
+
+  XSA_386 = (xsaPatch {
+    name = "386";
+    sha256 = "sha256-pAuLgt3sDeL73NSDqZCWxRGZk1tWaYlDbh7cUcJ4s+w=";
+  });
 }