diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index bde48bc16afd..37f89896c7e3 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -213,6 +213,14 @@
       have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official repo</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>shibboleth-sp</literal> package has been updated to version 3.
+     It is largely backward compatible, for further information refer to the
+     <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release notes</link>
+     and <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade guide</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/pkgs/development/libraries/shibboleth-sp/default.nix b/pkgs/development/libraries/shibboleth-sp/default.nix
index 74f861297d1a..dd9b01a0a01e 100644
--- a/pkgs/development/libraries/shibboleth-sp/default.nix
+++ b/pkgs/development/libraries/shibboleth-sp/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "shibboleth-sp-${version}";
-  version = "2.6.1";
+  version = "3.0.4.1";
 
   src = fetchgit {
     url = "https://git.shibboleth.net/git/cpp-sp.git";
     rev = version;
-    sha256 = "01q13p7gc0janjfml6zs46na8qnval8hc833fk2wrnmi4w9xw4fd";
+    sha256 = "1qb4dbz5gk10b9w1rf6f4vv7c2wb3a8bfzif6yiaq96ilqad7gdr";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];