diff --git a/nixos/modules/services/hardware/pcscd.nix b/nixos/modules/services/hardware/pcscd.nix
index 10229c468740..f7e23df84f01 100644
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@@ -106,6 +106,8 @@ in
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
+    services.udev.packages = [ pkgs.ccid ];
+
     systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
 
     systemd.services.pcscd = {
@@ -134,5 +136,12 @@ in
         "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
       ];
     };
+
+    users.users.pcscd = {
+      isSystemUser = true;
+      group = "pcscd";
+    };
+
+    users.groups.pcscd = { };
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 282835431246..3f21e9b9e63c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1227,6 +1227,7 @@ in
   pass-secret-service = runTest ./pass-secret-service.nix;
   password-option-override-ordering = runTest ./password-option-override-ordering.nix;
   patroni = handleTestOn [ "x86_64-linux" ] ./patroni.nix { };
+  pcsclite = runTest ./pcsclite.nix;
   pdns-recursor = runTest ./pdns-recursor.nix;
   peerflix = runTest ./peerflix.nix;
   peering-manager = runTest ./web-apps/peering-manager.nix;
diff --git a/nixos/tests/pcsclite.nix b/nixos/tests/pcsclite.nix
new file mode 100644
index 000000000000..de70e7fb9313
--- /dev/null
+++ b/nixos/tests/pcsclite.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  ...
+}:
+
+{
+  name = "pcsclite";
+  meta.maintainers = [ lib.maintainers.bjornfor ];
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.pcsc-tools
+        ];
+        services.pcscd = {
+          enable = true;
+        };
+      };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("pcscd.socket")
+
+    with subtest("client can connect"):
+        machine.succeed("pcsc_scan -r")
+  '';
+}
diff --git a/pkgs/by-name/cc/ccid/package.nix b/pkgs/by-name/cc/ccid/package.nix
index c5bc1aa625d3..3157c01c0fd2 100644
--- a/pkgs/by-name/cc/ccid/package.nix
+++ b/pkgs/by-name/cc/ccid/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ccid";
-  version = "1.6.2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "LudovicRousseau";
     repo = "CCID";
     tag = finalAttrs.version;
-    hash = "sha256-n7rOjnLZH4RLmddtBycr3FK2Bi/OLR+9IjWBRbWjnUw=";
+    hash = "sha256-6eaznSIQZl1bpIe1F9EtwotF9BjOruJ9g/c2QrTgfUg=";
   };
 
   postPatch = ''
@@ -33,6 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags = [
     (lib.mesonBool "serial" true)
+    # Upstream tries to install udev outside of PREFIX. It's easier to disable
+    # this and install it ourself than to patch meson.build.
+    (lib.mesonBool "udev-rules" false)
   ];
 
   # error: call to undeclared function 'InterruptRead';
@@ -61,6 +64,10 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm 0444 -t $out/lib/udev/rules.d ../src/92_pcscd_ccid.rules
     substituteInPlace $out/lib/udev/rules.d/92_pcscd_ccid.rules \
       --replace-fail "/usr/sbin/pcscd" "${pcsclite}/bin/pcscd"
+    # Disable reference to binary that we don't build.
+    substituteInPlace $out/lib/udev/rules.d/92_pcscd_ccid.rules \
+      --replace-fail 'ATTRS{idVendor}=="0d46", ATTRS{idProduct}=="4081", RUN+="/usr/sbin/Kobil_mIDentity_switch"' \
+                     '# disabled: ATTRS{idVendor}=="0d46", ATTRS{idProduct}=="4081", RUN+="/usr/sbin/Kobil_mIDentity_switch"'
   '';
 
   # The resulting shared object ends up outside of the default paths which are
diff --git a/pkgs/by-name/pc/pcsclite/package.nix b/pkgs/by-name/pc/pcsclite/package.nix
index b222c64655a3..c4d14fe7a137 100644
--- a/pkgs/by-name/pc/pcsclite/package.nix
+++ b/pkgs/by-name/pc/pcsclite/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   meson,
   ninja,
   flex,
@@ -21,11 +20,12 @@
   nix-update-script,
   pname ? "pcsclite",
   polkitSupport ? false,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "2.3.0";
+  version = "2.4.1";
 
   outputs = [
     "out"
@@ -40,18 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rousseau";
     repo = "PCSC";
     tag = finalAttrs.version;
-    hash = "sha256-37qeWGEuutF0cOOidoLchKJLQCvJFdVRZXepWzD4pZs=";
+    hash = "sha256-I4kWToLixfkP0XaONiWqNLXXmz+3n+LafbITfZOxLZw=";
   };
 
-  # fix build with macOS 11 SDK
-  patches = [
-    (fetchpatch {
-      url = "https://salsa.debian.org/rousseau/PCSC/-/commit/f41fdaaf7c82bc270af6d7439c6da037bf149be8.patch";
-      revert = true;
-      hash = "sha256-8A76JfYqcILi52X9l/uIpJXeRJDf2dkrNEToOsxGZXk=";
-    })
-  ];
-
   mesonFlags = [
     (lib.mesonOption "sysconfdir" "/etc")
     # The OS should care on preparing the drivers into this location
@@ -67,17 +58,23 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "libudev" false)
   ];
 
-  # disable building pcsc-wirecheck{,-gen} when cross compiling
-  # see also: https://github.com/LudovicRousseau/PCSC/issues/25
   postPatch = ''
     substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
       --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
+    substituteInPlace meson.build \
+      --replace-fail \
+        "install_dir : get_option('sysconfdir') / 'default'" \
+        "install_dir : '${placeholder "out"}/etc/default'"
   ''
   + lib.optionalString systemdSupport ''
     substituteInPlace meson.build \
       --replace-fail \
-        "systemdsystemunitdir = systemd.get_variable(pkgconfig : 'systemd' + unit + 'unitdir')" \
+        "systemdsystemunitdir = systemd.get_variable(pkgconfig : 'systemd' + systemdunit + 'unitdir')" \
         "systemdsystemunitdir = '${placeholder "out"}/lib/systemd/system'"
+    substituteInPlace meson.build \
+      --replace-fail \
+        "sysusersdir = systemd.get_variable(pkgconfig : 'sysusersdir')" \
+        "sysusersdir = '${placeholder "out"}/lib/sysusers.d'"
   ''
   + lib.optionalString polkitSupport ''
     substituteInPlace meson.build \
@@ -110,6 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
+      nixos = nixosTests.pcsclite;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       version = testers.testVersion {
         package = finalAttrs.finalPackage;