diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
index 9d433ceb6759..8356cdc583a2 100644
--- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
+++ b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
@@ -4,46 +4,41 @@ Date: Sun, 26 May 2024 12:17:01 -0500
 Subject: [PATCH] envoy: allow specification of external binary
 
 ---
- pkg/envoy/envoy.go | 20 ++++++++++++++++----
- 1 file changed, 16 insertions(+), 4 deletions(-)
+ pkg/envoy/envoy.go | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
 index 85c725629..4a726a44b 100644
 --- a/pkg/envoy/envoy.go
 +++ b/pkg/envoy/envoy.go
-@@ -8,9 +8,9 @@ import (
+@@ -8,10 +8,10 @@ import (
  	"errors"
  	"fmt"
  	"io"
 +	"io/fs"
+ 	"net"
+ 	"net/http"
+ 	"net/url"
  	"os"
  	"os/exec"
 -	"path"
  	"path/filepath"
- 	"regexp"
- 	"runtime"
-@@ -36,8 +36,17 @@ import (
- 
- const (
+@@ -44,6 +44,11 @@ const (
  	configFileName = "envoy-config.yaml"
-+	workingDirectoryName = ".pomerium-envoy"
-+	embeddedEnvoyPermissions     fs.FileMode = 0o700
  )
- 
+
 +var OverrideEnvoyPath = ""
 +
-+type serverOptions struct {
-+	services string
-+	logLevel config.LogLevel
-+}
++const workingDirectoryName = ".pomerium-envoy"
++const embeddedEnvoyPermissions fs.FileMode = 0o700
 +
  // A Server is a pomerium proxy implemented via envoy.
  type Server struct {
  	ServerOptions
-@@ -95,14 +104,17 @@ func NewServer(ctx context.Context, src config.Source, builder *envoyconfig.Buil
+@@ -100,14 +105,17 @@ func NewServer(
  		log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy")
  	}
- 
+
 -	envoyPath, err := Extract()
 +	envoyPath := OverrideEnvoyPath
 +	wd := filepath.Join(os.TempDir(), workingDirectoryName)
@@ -53,14 +48,14 @@ index 85c725629..4a726a44b 100644
 -		return nil, fmt.Errorf("extracting envoy: %w", err)
 +		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
  	}
- 
+
  	srv := &Server{
- 		ServerOptions: options,
--		wd:            path.Dir(envoyPath),
-+		wd:            wd,
- 		builder:       builder,
- 		grpcPort:      src.GetConfig().GRPCPort,
- 		httpPort:      src.GetConfig().HTTPPort,
--- 
+ 		ServerOptions:        options,
+-		wd:                   path.Dir(envoyPath),
++		wd:                   wd,
+ 		builder:              builder,
+ 		grpcPort:             src.GetConfig().GRPCPort,
+ 		httpPort:             src.GetConfig().HTTPPort,
+--
 2.49.0
 
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index 15c5c90ea85a..438bfee412cc 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -4,9 +4,8 @@
   fetchFromGitHub,
   lib,
   envoy,
-  yarnConfigHook,
-  yarnBuildHook,
-  fetchYarnDeps,
+  npmHooks,
+  fetchNpmDeps,
   nodejs,
   nixosTests,
   pomerium-cli,
@@ -22,32 +21,37 @@ let
 in
 buildGoModule rec {
   pname = "pomerium";
-  version = "0.30.5";
+  version = "0.32.4";
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    hash = "sha256-3SmcuLEWqsw/B10jTIG2TKGa7tyMLa/lpkD6Iq/Fm4g=";
+    hash = "sha256-XTj0ZLPRe8I3a5be0oRTxRUuT2wHnbsms7wIvLUg9ms=";
   };
 
-  vendorHash = "sha256-mOTjBH8VqsMdyW5jTIZ76bf55WnHw9XuUSh6zsBktt0=";
+  vendorHash = "sha256-EYXmeS4jtueI9FwVQdMlsYX3CSRGH9Dft0Syf88nf7o=";
 
   ui = stdenv.mkDerivation {
     pname = "pomerium-ui";
     inherit version;
     src = "${src}/ui";
 
-    offlineCache = fetchYarnDeps {
-      yarnLock = "${src}/ui/yarn.lock";
-      hash = "sha256-V2nSSMvTCK+SYmEhTbLMArIOmNs/AgB5xfhQGx3e/x8=";
+    npmDeps = fetchNpmDeps {
+      src = "${src}/ui";
+      hash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw=";
     };
 
     nativeBuildInputs = [
-      yarnConfigHook
-      yarnBuildHook
+      npmHooks.npmConfigHook
       nodejs
     ];
 
+    buildPhase = ''
+      runHook preBuild
+      npm run build
+      runHook postBuild
+    '';
+
     installPhase = ''
       runHook preInstall
       cp -R dist $out