diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index f8b44d3efbef..c7932f23e6c8 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -14,7 +14,6 @@
   git,
   glib,
   glib-networking,
-  gnused,
   gnutls,
   json-glib,
   krb5,
@@ -31,20 +30,19 @@
   pkg-config,
   polkit,
   python3Packages,
-  runtimeShell,
   systemd,
   udev,
   xmlto,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
   version = "331";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
-    rev = "refs/tags/${version}";
+    tag = finalAttrs.version;
     hash = "sha256-G0L1ZcvjUCSNkDvYoyConymZ4bsEye03t5K15EyI008=";
     fetchSubmodules = true;
   };
@@ -87,17 +85,17 @@ stdenv.mkDerivation rec {
     echo "#!/bin/sh" > test/node_modules
 
     substituteInPlace src/tls/cockpit-certificate-helper.in \
-      --replace 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
+      --replace-fail 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
 
     substituteInPlace src/tls/cockpit-certificate-ensure.c \
-      --replace '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
+      --replace-fail '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
 
     substituteInPlace src/common/cockpitconf.c \
-      --replace 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
+      --replace-fail 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
 
     # instruct users with problems to create a nixpkgs issue instead of nagging upstream directly
     substituteInPlace configure.ac \
-      --replace 'devel@lists.cockpit-project.org' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
+      --replace-fail 'devel@lists.cockpit-project.org' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
 
     patchShebangs \
       build.js \
@@ -123,20 +121,20 @@ stdenv.mkDerivation rec {
     for f in pkg/**/*.js pkg/**/*.jsx test/**/* src/**/*; do
       # some files substituteInPlace report as missing and it's safe to ignore them
       substituteInPlace "$(realpath "$f")" \
-        --replace '"/usr/bin/' '"' \
-        --replace '"/bin/' '"' || true
+        --replace-quiet '"/usr/bin/' '"' \
+        --replace-quiet '"/bin/' '"' || true
     done
 
     substituteInPlace src/common/Makefile-common.am \
-      --replace 'TEST_PROGRAM += test-pipe' "" # skip test-pipe because it hangs the build
+      --replace-warn 'TEST_PROGRAM += test-pipe' "" # skip test-pipe because it hangs the build
 
     substituteInPlace src/ws/Makefile-ws.am \
-      --replace 'TEST_PROGRAM += test-compat' ""
+      --replace-warn 'TEST_PROGRAM += test-compat' ""
 
     substituteInPlace test/pytest/*.py \
-      --replace "'bash" "'${bashInteractive}/bin/bash"
+      --replace-quiet "'bash" "'${bashInteractive}/bin/bash"
 
-    echo "m4_define(VERSION_NUMBER, [${version}])" > version.m4
+    echo "m4_define(VERSION_NUMBER, [${finalAttrs.version}])" > version.m4
 
     # hardcode libexecdir, I am assuming that cockpit only use it to find it's binaries
     printf 'def get_libexecdir() -> str:\n\treturn "%s"' "$out/libexec" >> src/cockpit/packages.py
@@ -169,24 +167,25 @@ stdenv.mkDerivation rec {
       --prefix PYTHONPATH : $out/${python3Packages.python.sitePackages}
 
     substituteInPlace $out/${python3Packages.python.sitePackages}/cockpit/_vendor/systemd_ctypes/libsystemd.py \
-      --replace-fail libsystemd.so.0 ${systemd}/lib/libsystemd.so.0
+      --replace-warn libsystemd.so.0 ${systemd}/lib/libsystemd.so.0
 
     substituteInPlace $out/share/polkit-1/actions/org.cockpit-project.cockpit-bridge.policy \
       --replace-fail /usr $out
 
     substituteInPlace $out/lib/systemd/*/* \
-      --replace /bin /run/current-system/sw/bin
+      --replace-warn /bin /run/current-system/sw/bin
 
     runHook postFixup
   '';
 
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
   checkInputs = [
     bashInteractive
     cacert
     dbus
     glib-networking
     openssh
-    python3Packages.pytestCheckHook
   ];
 
   preCheck = ''
@@ -195,7 +194,6 @@ stdenv.mkDerivation rec {
     export G_MESSAGES_DEBUG=cockpit-ws,cockpit-wrapper,cockpit-bridge
     export PATH=$PATH:$(pwd)
 
-    # make pytest -j$NIX_BUILD_CORES || true
     make check  -j$NIX_BUILD_CORES || true
     npm run eslint
     npm run stylelint
@@ -206,11 +204,12 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Web-based graphical interface for servers";
     mainProgram = "cockpit-bridge";
     homepage = "https://cockpit-project.org/";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ lucasew ];
+    changelog = "https://cockpit-project.org/blog/cockpit-${finalAttrs.version}.html";
+    license = lib.licenses.lgpl21;
+    maintainers = [ lib.maintainers.lucasew ];
   };
-}
+})