diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 9a69084ffd7a..936f0caabe46 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -18,16 +18,7 @@ let
     packageOverrides = self: super: {
       esphome-dashboard = self.callPackage ./dashboard.nix { };
 
-      paho-mqtt = super.paho-mqtt.overridePythonAttrs (oldAttrs: rec {
-        version = "1.6.1";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src) owner repo;
-          tag = "v${version}";
-          hash = "sha256-9nH6xROVpmI+iTKXfwv2Ar1PAmWbEunI3HO0pZyK6Rg=";
-        };
-        build-system = with self; [ setuptools ];
-        doCheck = false;
-      });
+      paho-mqtt = self.paho-mqtt_1;
     };
   };
 in
diff --git a/pkgs/development/python-modules/paho-mqtt/1.nix b/pkgs/development/python-modules/paho-mqtt/1.nix
new file mode 100644
index 000000000000..6932b26dff79
--- /dev/null
+++ b/pkgs/development/python-modules/paho-mqtt/1.nix
@@ -0,0 +1,62 @@
+{
+  buildPythonPackage,
+  esphome,
+  fetchFromGitHub,
+  lib,
+  pytestCheckHook,
+  setuptools,
+}:
+
+let
+  testing = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.testing";
+    rev = "a4dc694010217b291ee78ee13a6d1db812f9babd";
+    hash = "sha256-SQoNdkWMjnasPjpXQF2yV97MUra8gb27pc3rNoA8Rjw=";
+  };
+in
+buildPythonPackage (finalAttrs: {
+  pname = "paho-mqtt";
+  version = "1.6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "paho.mqtt.python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9nH6xROVpmI+iTKXfwv2Ar1PAmWbEunI3HO0pZyK6Rg=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "paho.mqtt" ];
+
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    ln -s ${testing} paho.mqtt.testing
+
+    # paho.mqtt not in top-level dir to get caught by this
+    export PYTHONPATH=".:$PYTHONPATH"
+  '';
+
+  disabledTests = [
+    # Fails during teardown
+    # RuntimeError: Client 01-zero-length-clientid.py exited with code None, expected 0
+    "test_01_zero_length_clientid"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    changelog = "https://github.com/eclipse/paho.mqtt.python/blob/${finalAttrs.src.tag}/ChangeLog.txt";
+    description = "MQTT version 5.0/3.1.1 client class";
+    homepage = "https://eclipse.org/paho";
+    license = lib.licenses.epl20;
+    inherit (esphome.meta) maintainers;
+  };
+})
diff --git a/pkgs/development/python-modules/paho-mqtt/default.nix b/pkgs/development/python-modules/paho-mqtt/default.nix
index ac25b8275f16..b0ea0015bb42 100644
--- a/pkgs/development/python-modules/paho-mqtt/default.nix
+++ b/pkgs/development/python-modules/paho-mqtt/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
+  openssl,
   pytestCheckHook,
 }:
 
@@ -27,11 +28,17 @@ buildPythonPackage rec {
     hash = "sha256-VMq+WTW+njK34QUUTE6fR2j2OmHxVzR0wrC92zYb1rY=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/ssl/gen.sh \
+      --replace-fail "c_rehash certs" "#c_rehash certs"
+  '';
+
   build-system = [
     hatchling
   ];
 
   nativeCheckInputs = [
+    openssl
     pytestCheckHook
   ];
 
@@ -44,6 +51,10 @@ buildPythonPackage rec {
 
     # paho.mqtt not in top-level dir to get caught by this
     export PYTHONPATH=".:$PYTHONPATH"
+
+    pushd tests/ssl
+    HOME="$(mktemp -d)" ./gen.sh
+    popd
   '';
 
   disabledTests = [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3694b06b8468..a951003c2f95 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12713,6 +12713,8 @@ self: super: with self; {
 
   paho-mqtt = callPackage ../development/python-modules/paho-mqtt/default.nix { };
 
+  paho-mqtt_1 = callPackage ../development/python-modules/paho-mqtt/1.nix { };
+
   paintcompiler = callPackage ../development/python-modules/paintcompiler { };
 
   pajgps-api = callPackage ../development/python-modules/pajgps-api { };