diff --git a/pkgs/by-name/ce/certbot/package.nix b/pkgs/by-name/ce/certbot/package.nix
new file mode 100644
index 000000000000..300ee0005c15
--- /dev/null
+++ b/pkgs/by-name/ce/certbot/package.nix
@@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  python3,
+}:
+
+let
+  python = python3.override {
+    self = python;
+    packageOverrides = self: super: {
+      josepy = super.josepy.overridePythonAttrs (old: rec {
+        version = "1.15.0";
+        src = fetchFromGitHub {
+          owner = "certbot";
+          repo = "josepy";
+          tag = "v${version}";
+          hash = "sha256-fK4JHDP9eKZf2WO+CqRdEjGwJg/WNLvoxiVrb5xQxRc=";
+        };
+        dependencies = with self; [
+          pyopenssl
+          cryptography
+        ];
+      });
+    };
+  };
+in
+with python.pkgs;
+toPythonApplication certbot
diff --git a/pkgs/by-name/si/simp_le/package.nix b/pkgs/by-name/si/simp_le/package.nix
index 662e5fa25b78..8f033edba1c0 100644
--- a/pkgs/by-name/si/simp_le/package.nix
+++ b/pkgs/by-name/si/simp_le/package.nix
@@ -1,11 +1,33 @@
 {
   lib,
-  python3Packages,
+  python3,
+  fetchFromGitHub,
   fetchPypi,
   bash,
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    self = python;
+    packageOverrides = self: super: {
+      # acme doesn't support josepy v2
+      josepy = super.josepy.overridePythonAttrs (old: rec {
+        version = "1.15.0";
+        src = fetchFromGitHub {
+          owner = "certbot";
+          repo = "josepy";
+          tag = "v${version}";
+          hash = "sha256-fK4JHDP9eKZf2WO+CqRdEjGwJg/WNLvoxiVrb5xQxRc=";
+        };
+        dependencies = with self; [
+          pyopenssl
+          cryptography
+        ];
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "simp_le-client";
   version = "0.20.0";
   pyproject = true;
@@ -27,7 +49,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   # both setuptools-scm and mock are runtime dependencies
-  dependencies = with python3Packages; [
+  dependencies = with python.pkgs; [
     acme
     cryptography
     setuptools-scm
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index fab4563b7ecd..fa352f35bd68 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     hash = "sha256-lYGJgUNDzX+bE64GJ+djdKR+DXmhpcNbFJrAEnP86yQ=";
   };
 
-  postPatch = "cd ${pname}"; # using sourceRoot would interfere with patches
+  postPatch = "cd certbot"; # using sourceRoot would interfere with patches
 
   build-system = [ setuptools ];
 
@@ -84,6 +84,8 @@ buildPythonPackage rec {
     '';
 
   meta = with lib; {
+    # AttributeError: module 'josepy' has no attribute 'ComparableX509'
+    broken = lib.versionAtLeast josepy.version "2";
     homepage = "https://github.com/certbot/certbot";
     changelog = "https://github.com/certbot/certbot/blob/${src.tag}/certbot/CHANGELOG.md";
     description = "ACME client that can obtain certs and extensibly update server configurations";
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index ce6ab9354822..7358a9375e00 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -4,26 +4,24 @@
   cryptography,
   fetchFromGitHub,
   poetry-core,
-  pyopenssl,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.15.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "josepy";
     tag = "v${version}";
-    hash = "sha256-fK4JHDP9eKZf2WO+CqRdEjGwJg/WNLvoxiVrb5xQxRc=";
+    hash = "sha256-9hY3A+XSoVrRLds4tNV+5HWkmMwcS9UtehrKoj0OIEw=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
-    pyopenssl
+  dependencies = [
     cryptography
   ];
 
@@ -31,12 +29,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "josepy" ];
 
-  meta = with lib; {
-    changelog = "https://github.com/certbot/josepy/blob/v${version}/CHANGELOG.rst";
+  meta = {
+    changelog = "https://github.com/certbot/josepy/blob/${src.tag}/CHANGELOG.rst";
     description = "JOSE protocol implementation in Python";
     mainProgram = "jws";
     homepage = "https://github.com/certbot/josepy";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index aa1079070124..a67e2beaa087 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -152,6 +152,22 @@ let
         ];
       });
 
+      # acme and thus hass-nabucasa doesn't support josepy v2
+      # https://github.com/certbot/certbot/issues/10185
+      josepy = super.josepy.overridePythonAttrs (old: rec {
+        version = "1.15.0";
+        src = fetchFromGitHub {
+          owner = "certbot";
+          repo = "josepy";
+          tag = "v${version}";
+          hash = "sha256-fK4JHDP9eKZf2WO+CqRdEjGwJg/WNLvoxiVrb5xQxRc=";
+        };
+        dependencies = with self; [
+          pyopenssl
+          cryptography
+        ];
+      });
+
       letpot = super.letpot.overridePythonAttrs (rec {
         version = "0.3.0";
         src = fetchFromGitHub {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0d62daa57645..bd1df376f72d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8551,10 +8551,8 @@ with pkgs;
   celt_0_7 = callPackage ../development/libraries/celt/0.7.nix { };
   celt_0_5_1 = callPackage ../development/libraries/celt/0.5.1.nix { };
 
-  certbot = python3.pkgs.toPythonApplication python3.pkgs.certbot;
-
   certbot-full = certbot.withPlugins (cp: with cp; [
-    certbot-dns-cloudflare
+    # FIXME unbreak certbot-dns-cloudflare
     certbot-dns-google
     certbot-dns-ovh
     certbot-dns-rfc2136