diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index c2b928e851c8..08b0ecea74a6 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.7.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    sha256 = "sha256-REAN5TW0miWXI3HFxtW3znTKTrhsBbNqu1VfjC2w0no=";
+    sha256 = "sha256-Sn03nY80UmL5oeoK6ScPye1oSUmEKxgoz2VLHcvor3U=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index fc4efcfe56a1..02b8e01437d0 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,17 +1,17 @@
 { lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
 , ngtcp2-gnutls
-, autoreconfHook, nixosTests, knot-resolver
-, fetchpatch
+, autoreconfHook
+, nixosTests, knot-resolver, knot-dns, runCommandLocal
 }:
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "426d120994daf93af348aa6c48428e583dd286656415de4daf7a59106fd98631";
+    sha256 = "51efa36f92679b25d43dbf8ba543e9f26138559f0fa1ba5fae172f5400659c8f";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -23,11 +23,6 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (fetchpatch {
-      name = "test-32bit-xdp.patch";
-      url = "https://gitlab.nic.cz/knot/knot-dns/-/commit/325dfeefdfd8a3dd318cfe0ab52cd7efbf839ccd.diff";
-      sha256 = "E5J2Jf4/m5H59Xn6TyATu2gKs3CgShYlMF2Qj1SW1zw=";
-    })
     # Don't try to create directories like /var/lib/knot at build time.
     # They are later created from NixOS itself.
     ./dont-create-run-time-dirs.patch
@@ -65,6 +60,19 @@ stdenv.mkDerivation rec {
     inherit knot-resolver;
   } // lib.optionalAttrs stdenv.isLinux {
     inherit (nixosTests) knot;
+    # Some dependencies are very version-sensitive, so the might get dropped
+    # or embedded after some update, even if the nixPackagers didn't intend to.
+    # For non-linux I don't know a good replacement for `ldd`.
+    deps = runCommandLocal "knot-deps-test"
+      { nativeBuildInputs = [ (lib.getBin stdenv.cc.libc) ]; }
+      ''
+        for libname in libngtcp2 libbpf; do
+          echo "Checking for $libname:"
+          ldd '${knot-dns.bin}/bin/knotd' | grep -F "$libname"
+          echo "OK"
+        done
+        touch "$out"
+      '';
   };
 
   meta = with lib; {