diff --git a/nixos/modules/services/networking/knot-resolver.nix b/nixos/modules/services/networking/knot-resolver.nix
index acf3a74cd937..96b39745a02f 100644
--- a/nixos/modules/services/networking/knot-resolver.nix
+++ b/nixos/modules/services/networking/knot-resolver.nix
@@ -36,10 +36,9 @@ in
         If you want to use knot-resolver 5, please use services.kresd.
       '';
     };
-    package = lib.mkPackageOption pkgs "knot-resolver-manager_6.knot-resolver" {
-      example = "knot-resolver_6.override { extraFeatures = true; }";
+    managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" {
+      example = "pkgs.knot-resolver-manager_6.override { extraFeatures = true; }";
     };
-    managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { };
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = (pkgs.formats.yaml { }).type;
@@ -113,16 +112,6 @@ in
     users.groups.knot-resolver = { };
     networking.resolvconf.useLocalResolver = lib.mkDefault true;
 
-    assertions = [
-      {
-        assertion = lib.versionAtLeast cfg.package.version "6.0.0";
-        message = ''
-          services.knot-resolver only works with knot-resolver 6 or later.
-          Please use services.kresd for knot-resolver 5.
-        '';
-      }
-    ];
-
     environment = {
       etc."knot-resolver/config.yaml".source = configFile;
       systemPackages = [
@@ -134,10 +123,9 @@ in
       ];
     };
 
-    systemd.packages = [ cfg.package ]; # the unit gets patched a bit just below
+    systemd.packages = [ cfg.managerPackage.kresd ]; # the unit gets patched a bit just below
     systemd.services."knot-resolver" = {
       wantedBy = [ "multi-user.target" ];
-      path = [ (lib.getBin cfg.package) ];
       stopIfChanged = false;
       reloadTriggers = [
         configFile
diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
index c7c6f7d7f493..890e71fdb362 100644
--- a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
+++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
@@ -1,15 +1,16 @@
 {
+  lib,
   knot-resolver_6,
   python3Packages,
-  extraFeatures ? false,
+  extraFeatures ? false, # catch-all if defaults aren't enough
 }:
 let
-  knot-resolver = knot-resolver_6.override { inherit extraFeatures; };
+  kresd = knot-resolver_6.finalPackage; # TODO: does the finalPackage help us?
 in
+assert lib.versionAtLeast kresd.version "6.0.0";
 python3Packages.buildPythonPackage {
   pname = "knot-resolver-manager_6";
-  inherit (knot-resolver) version;
-  inherit (knot-resolver.unwrapped) src;
+  inherit (kresd) version src;
   pyproject = true;
 
   patches = [
@@ -20,11 +21,8 @@ python3Packages.buildPythonPackage {
   ];
 
   # Propagate meson config from the C part to the python part.
-  # But the install-time etc differs from a sensible run-time etc.
   postPatch = ''
-    substitute '${knot-resolver.unwrapped.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \
-      --replace-fail '${knot-resolver.unwrapped.out}/etc' '/etc' \
-      --replace-fail '${knot-resolver.unwrapped.out}/sbin' '${knot-resolver}/bin'
+    cp '${kresd.config_py}'/knot_resolver/constants.py ./python/knot_resolver/
   ''
   # On non-Linux let's simplify construction of the knot-resolver command line,
   # as it would break because of nixpkgs-specific wrapping of python packages.
@@ -48,6 +46,34 @@ python3Packages.buildPythonPackage {
     typing-extensions
   ];
 
+  # set up (additional) Lua dependencies
+  buildInputs =
+    with kresd.lua;
+    lib.optionals extraFeatures [
+      # For http module, prefill module, trust anchor bootstrap.
+      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
+      http
+      # used by policy.slice_randomize_psl()
+      psl
+    ];
+  makeWrapperArgs = [
+    "--set"
+    "LUA_PATH"
+    ''"$LUA_PATH"''
+    "--set"
+    "LUA_CPATH"
+    ''"$LUA_CPATH"''
+  ];
+  # basic test that the wrapping works
+  postCheck = lib.optionalString extraFeatures ''
+    makeWrapper '${kresd}/bin/kresd' ./kresd \
+      --set LUA_PATH  "$LUA_PATH" \
+      --set LUA_CPATH "$LUA_CPATH"
+    echo "Checking that 'http' module loads, i.e. lua search paths work:"
+    echo "modules.load('http')" > test-http.lua
+    echo -e 'quit()' | env -i ./kresd -a 127.0.0.1#53535 -c test-http.lua
+  '';
+
   doCheck = python3Packages.stdenv.isLinux; # maybe in future
   nativeCheckInputs = with python3Packages; [
     augeas
@@ -79,10 +105,11 @@ python3Packages.buildPythonPackage {
   ];
 
   passthru = {
-    inherit knot-resolver;
+    inherit kresd;
   };
 
-  meta = knot-resolver.meta // {
+  meta = kresd.meta // {
     mainProgram = "knot-resolver";
+    inherit (kresd.meta) description; # explicit to make e.g. `nix edit` point here
   };
 }
diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix
index f961f28e4209..6c571faaee84 100644
--- a/pkgs/by-name/kn/knot-resolver_6/package.nix
+++ b/pkgs/by-name/kn/knot-resolver_6/package.nix
@@ -26,14 +26,12 @@
   cmocka,
   which,
   cacert,
-  extraFeatures ? false, # catch-all if defaults aren't enough
 }:
 let
-  result = if extraFeatures then wrapped-full else unwrapped;
-
   inherit (lib) optional optionals optionalString;
   lua = luajitPackages;
 
+  # TODO: we could cut the `let` short here, but it would de-indent everything.
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     pname = "knot-resolver_6";
     version = "6.0.17";
@@ -56,20 +54,12 @@ let
         excludes = [ "NEWS" ];
         hash = "sha256-3w33v8UfhGdA50BlkfHpQLFxg+5ELk0lp7RzgvkSzK8=";
       })
+      # Install-time paths sometimes differ from run-time paths in nixpkgs.
+      ./paths.patch
     ];
 
-    # Path fixups for the NixOS service.
     # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them.
     postPatch = ''
-      patch meson.build <<EOF
-      @@ -50,2 +50,3 @@
-      -systemd_work_dir = prefix / get_option('localstatedir') / 'lib' / 'knot-resolver'
-      -systemd_cache_dir = prefix / get_option('localstatedir') / 'cache' / 'knot-resolver'
-      +systemd_work_dir  = '/var/lib/knot-resolver'
-      +systemd_cache_dir = '/var/cache/knot-resolver'
-      +run_dir = '/run/knot-resolver'
-      EOF
-
       sed -e '/^ExecStart=/d' -e '/^ExecReload=/d' \
         -i systemd/knot-resolver.service.in
     ''
@@ -147,7 +137,8 @@ let
     '';
 
     passthru = {
-      unwrapped = finalAttrs.finalPackage;
+      inherit lua;
+      inherit (finalAttrs) finalPackage;
     };
 
     meta = {
@@ -163,42 +154,5 @@ let
     };
   });
 
-  wrapped-full =
-    runCommand unwrapped.name
-      {
-        nativeBuildInputs = [ makeWrapper ];
-        buildInputs = with luajitPackages; [
-          # For http module, prefill module, trust anchor bootstrap.
-          # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
-          http
-          # used by policy.slice_randomize_psl()
-          psl
-        ];
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-        inherit (unwrapped) version meta;
-        passthru = {
-          inherit unwrapped;
-        };
-      }
-      (
-        ''
-          mkdir -p "$out"/bin
-          makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
-            --set LUA_PATH  "$LUA_PATH" \
-            --set LUA_CPATH "$LUA_CPATH"
-
-          ln -sr '${unwrapped}/bin/kres-cache-gc' "$out"/bin/
-          ln -sr '${unwrapped}/share' "$out"/
-          ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
-          ln -sr "$out"/{bin,sbin}
-        ''
-        + lib.optionalString unwrapped.doInstallCheck ''
-          echo "Checking that 'http' module loads, i.e. lua search paths work:"
-          echo "modules.load('http')" > test-http.lua
-          echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-        ''
-      );
-
 in
-result
+unwrapped
diff --git a/pkgs/by-name/kn/knot-resolver_6/paths.patch b/pkgs/by-name/kn/knot-resolver_6/paths.patch
new file mode 100644
index 000000000000..75d2fcea9c57
--- /dev/null
+++ b/pkgs/by-name/kn/knot-resolver_6/paths.patch
@@ -0,0 +1,14 @@
+--- a/meson.build
++++ b/meson.build
+@@ -50,2 +50,3 @@
+-systemd_work_dir = prefix / get_option('localstatedir') / 'lib' / 'knot-resolver'
+-systemd_cache_dir = prefix / get_option('localstatedir') / 'cache' / 'knot-resolver'
++systemd_work_dir  = '/var/lib/knot-resolver'
++systemd_cache_dir = '/var/cache/knot-resolver'
++run_dir = '/run/knot-resolver'
+
+--- a/python/knot_resolver/constants.py.in
++++ b/python/knot_resolver/constants.py.in
+@@ -12 +12 @@
+-ETC_DIR = Path("@etc_dir@")
++ETC_DIR = Path("/etc/knot-resolver")