diff --git a/pkgs/kde/gear/kdeconnect-kde/default.nix b/pkgs/kde/gear/kdeconnect-kde/default.nix
index fd8868cf41c2..2381dd58c868 100644
--- a/pkgs/kde/gear/kdeconnect-kde/default.nix
+++ b/pkgs/kde/gear/kdeconnect-kde/default.nix
@@ -1,5 +1,8 @@
 {
+  lib,
   mkKdeDerivation,
+  substituteAll,
+  sshfs,
   qtconnectivity,
   qtmultimedia,
   qtwayland,
@@ -11,6 +14,23 @@
 mkKdeDerivation {
   pname = "kdeconnect-kde";
 
+  patches = [
+    (substituteAll {
+      src = ./hardcode-sshfs-path.patch;
+      sshfs = lib.getExe sshfs;
+    })
+    # We build OpenSSH without ssh-dss support, so sshfs explodes at runtime.
+    # See: https://github.com/NixOS/nixpkgs/commit/6ee4b8c8bf815567f7d0fa131576d2b8c0a18167
+    # FIXME: upstream?
+    ./remove-ssh-dss.patch
+  ];
+
+  # Hardcoded as a QString, which is UTF-16 so Nix can't pick it up automatically
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo "${sshfs}" > $out/nix-support/depends
+  '';
+
   extraNativeBuildInputs = [pkg-config];
   extraBuildInputs = [qtconnectivity qtmultimedia qtwayland wayland wayland-protocols libfakekey];
 
diff --git a/pkgs/kde/gear/kdeconnect-kde/hardcode-sshfs-path.patch b/pkgs/kde/gear/kdeconnect-kde/hardcode-sshfs-path.patch
new file mode 100644
index 000000000000..df78f60fcf90
--- /dev/null
+++ b/pkgs/kde/gear/kdeconnect-kde/hardcode-sshfs-path.patch
@@ -0,0 +1,13 @@
+diff --git a/plugins/sftp/mounter.cpp b/plugins/sftp/mounter.cpp
+index 29e94f3b..c71e552f 100644
+--- a/plugins/sftp/mounter.cpp
++++ b/plugins/sftp/mounter.cpp
+@@ -94,7 +94,7 @@ void Mounter::onPacketReceived(const NetworkPacket &np)
+ 
+     QDir().mkpath(m_mountPoint);
+ 
+-    const QString program = QStringLiteral("sshfs");
++    const QString program = QStringLiteral("@sshfs@");
+ 
+     QString path;
+     if (np.has(QStringLiteral("multiPaths")))
diff --git a/pkgs/kde/gear/kdeconnect-kde/remove-ssh-dss.patch b/pkgs/kde/gear/kdeconnect-kde/remove-ssh-dss.patch
new file mode 100644
index 000000000000..b404132f4e97
--- /dev/null
+++ b/pkgs/kde/gear/kdeconnect-kde/remove-ssh-dss.patch
@@ -0,0 +1,13 @@
+diff --git a/plugins/sftp/mounter.cpp b/plugins/sftp/mounter.cpp
+index 29e94f3b..0f300c63 100644
+--- a/plugins/sftp/mounter.cpp
++++ b/plugins/sftp/mounter.cpp
+@@ -122,7 +122,7 @@ void Mounter::onPacketReceived(const NetworkPacket &np)
+                       << QStringLiteral("-o") << QStringLiteral("IdentityFile=") + KdeConnectConfig::instance().privateKeyPath()
+                       << QStringLiteral("-o") << QStringLiteral("StrictHostKeyChecking=no") // Do not ask for confirmation because it is not a known host
+                       << QStringLiteral("-o") << QStringLiteral("UserKnownHostsFile=/dev/null") // Prevent storing as a known host
+-                      << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-dss\\,ssh-rsa") // https://bugs.kde.org/show_bug.cgi?id=351725
++                      << QStringLiteral("-o") << QStringLiteral("HostKeyAlgorithms=+ssh-rsa") // https://bugs.kde.org/show_bug.cgi?id=351725
+                       << QStringLiteral("-o") << QStringLiteral("PubkeyAcceptedKeyTypes=+ssh-rsa") // https://bugs.kde.org/show_bug.cgi?id=443155
+                       << QStringLiteral("-o") << QStringLiteral("uid=") + QString::number(getuid())
+                       << QStringLiteral("-o") << QStringLiteral("gid=") + QString::number(getgid())