diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index feafb29bcbd3..aef1412124fd 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -15,11 +15,10 @@
   watchdog,
 
   # tests
+  cffi,
   cryptography,
   ephemeral-port-reserve,
-  greenlet,
   pytest-timeout,
-  pytest-xprocess,
   pytestCheckHook,
 
   # reverse dependencies
@@ -29,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "3.0.6";
+  version = "3.1.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qN1Z1N4oynBHGjTLp5vtX37y4Danazqwg1R0JG60H40=";
+    hash = "sha256-YHI86UXBkyhnl5DjKCzHWKpKYEDkuzMPU9MPpUbUR0Y=";
   };
 
   build-system = [ flit-core ];
@@ -44,26 +43,26 @@ buildPythonPackage rec {
   dependencies = [ markupsafe ];
 
   optional-dependencies = {
-    watchdog = lib.optionals (!stdenv.hostPlatform.isDarwin) [
-      # watchdog requires macos-sdk 10.13
-      watchdog
-    ];
+    watchdog = [ watchdog ];
   };
 
-  nativeCheckInputs =
-    [
-      cryptography
-      ephemeral-port-reserve
-      pytest-timeout
-      pytest-xprocess
-      pytestCheckHook
-    ]
-    ++ lib.optionals (pythonOlder "3.11") [ greenlet ]
-    ++ lib.flatten (builtins.attrValues optional-dependencies);
+  nativeCheckInputs = [
+    cffi
+    cryptography
+    ephemeral-port-reserve
+    pytest-timeout
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "werkzeug" ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [ "test_get_machine_id" ];
+  disabledTests = [
+    # ConnectionRefusedError: [Errno 111] Connection refused
+    "test_http_proxy"
+    # ResourceWarning: subprocess 309 is still running
+    "test_basic"
+    "test_long_build"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "test_get_machine_id" ];
 
   disabledTestPaths = [
     # ConnectionRefusedError: [Errno 111] Connection refused