diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 3840d3c25ab4..1edeea3f7662 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.11.2";
+  version = "18.11.3";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-UmoMZ55FqEVYTjfgdoZsbJcs/+4x80KKxq6Cfatv4K4=";
+      hash = "sha256-oFQevVXbxu9G4LF3BrC0EUUviypSwB4cKRjipdiO3jU=";
     };
 
     vendorHash = "sha256-123WUtoUaPIyDywcTKEhiZP2SYYHxAQoOPyCebsHYRI=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 13f6020fc420..37f07212cec5 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.11.2";
+  version = "18.11.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lxmwTC02WHwlrMgvTs2lkDj4AX8ovFuW73OHB6CIWTo=";
+    hash = "sha256-ozkrU3QF/LK0uqfF52dnm2MCga+vRD8dGsLNnze6E+Y=";
   };
 
   vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index d3d825e95794..3472cc5bcb94 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.11.2",
-  "repo_hash": "sha256-TAc3bNFwq/QKR+X/P9BqQHA2T5viD+SAOXXUZ7StDP4=",
+  "version": "18.11.3",
+  "repo_hash": "sha256-QxaLdWErE+b4SpwHtxnCa2tqheWUfEixRcQwYD/A9s8=",
   "yarn_hash": "sha256-k8JHi0f/XfSV4kICyPW01Erk3YnKw33yeUWYrOaPdTM=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.11.2-ee",
+  "rev": "v18.11.3-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.2",
-    "GITLAB_KAS_VERSION": "18.11.2",
-    "GITLAB_PAGES_VERSION": "18.11.2",
+    "GITALY_SERVER_VERSION": "18.11.3",
+    "GITLAB_KAS_VERSION": "18.11.3",
+    "GITLAB_PAGES_VERSION": "18.11.3",
     "GITLAB_SHELL_VERSION": "14.49.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.1",
-    "GITLAB_WORKHORSE_VERSION": "18.11.2"
+    "GITLAB_WORKHORSE_VERSION": "18.11.3"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 101519703304..7d705541e88a 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.11.2";
+  version = "18.11.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 10a92f3b6e81..705e6ba9ffe6 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -363,6 +363,11 @@ gem 'loofah', '~> 2.25.0', feature_category: :shared # rubocop:todo Gemfile/Miss
 # Used to provide license templates
 gem 'licensee', '~> 9.16', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
+# Pinned below 1.8 so rugged.so links libgit2's old http-parser instead of
+# the bundled llhttp, which collides with llhttp-ffi symbols at runtime.
+# See https://gitlab.com/gitlab-org/gitlab/-/issues/598564
+gem 'rugged', '~> 1.7.2', require: false, feature_category: :gitaly
+
 # Detect and convert string character encoding
 gem 'charlock_holmes', '~> 0.7.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 0139d4d72a34..28e0d494d85c 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -1871,7 +1871,7 @@ GEM
     rubyntlm (0.6.3)
     rubypants (0.2.0)
     rubyzip (2.4.1)
-    rugged (1.9.0)
+    rugged (1.7.2)
     safe_yaml (1.0.4)
     safety_net_attestation (0.5.0)
       jwt (>= 2.0, < 4.0)
@@ -2491,6 +2491,7 @@ DEPENDENCIES
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.18)
   rubyzip (~> 2.4.0)
+  rugged (~> 1.7.2)
   sanitize (~> 6.0.2)
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 3a74b9199fae..d800df27924b 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -8651,10 +8651,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b7gcf6pxg4x607bica68dbz22b4kch33yi0ils6x3c8ql9akakz";
+      sha256 = "1sccng15h8h3mcjxfgvxy85lfpswbj0nhmzwwsqdffbzqgsb2jch";
       type = "gem";
     };
-    version = "1.9.0";
+    version = "1.7.2";
   };
   safe_yaml = {
     groups = [