diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index a0be8c3319eb..e301d1467f27 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.64.0";
+  version = "0.64.2";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Cq7Swgwbtfku+ZvoMeXmLpTbic6Fm/EdGi8C9R2J+X0=";
+    hash = "sha256-jCGeSAG97RojLidxJK8yCN1ldStpG9b57rUR5JkQGuE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-txC+2I50Zf0xP/FGFoCLNLVVaXg/MfQKMgDSFTNg0eU=";
+  vendorHash = "sha256-X3AqiW8wHGBkl/xlh1pPiDfQkZ9lDRyv0FTxWy2hT8E=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -38,16 +38,16 @@ buildGoModule rec {
     openssl
   ];
 
-  subPackages = [ "." ];
+  subPackages = [ "cmd/grype" ];
 
   excludedPackages = "test/integration";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/anchore/grype/internal/version.version=${version}"
-    "-X github.com/anchore/grype/internal/version.gitDescription=v${version}"
-    "-X github.com/anchore/grype/internal/version.gitTreeState=clean"
+    "-X=github.com/anchore/grype/internal/version.version=${version}"
+    "-X=github.com/anchore/grype/internal/version.gitDescription=v${version}"
+    "-X=github.com/anchore/grype/internal/version.gitTreeState=clean"
   ];
 
   preBuild = ''
@@ -80,8 +80,7 @@ buildGoModule rec {
       --replace "TestRegistryAuth" "SkipRegistryAuth"
     substituteInPlace test/cli/sbom_input_test.go \
       --replace "TestSBOMInput_FromStdin" "SkipSBOMInput_FromStdin" \
-      --replace "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument" \
-      --replace "TestAttestationInput_AsArgument" "SkipAttestationInput_AsArgument"
+      --replace "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument"
     substituteInPlace test/cli/subprocess_test.go \
       --replace "TestSubprocessStdin" "SkipSubprocessStdin"