diff --git a/nixos/modules/services/networking/hylafax/faxq-wait.sh b/nixos/modules/services/networking/hylafax/faxq-wait.sh
index 8c39e9d20c18..1826aa30e627 100755
--- a/nixos/modules/services/networking/hylafax/faxq-wait.sh
+++ b/nixos/modules/services/networking/hylafax/faxq-wait.sh
@@ -1,4 +1,4 @@
-#! @shell@ -e
+#! @runtimeShell@ -e
 
 # skip this if there are no modems at all
 if ! stat -t "@spoolAreaPath@"/etc/config.* >/dev/null 2>&1
diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index 7f18c0d39ab4..74960e69b9ac 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -3,7 +3,7 @@
 let
 
   inherit (lib.options) literalExample mkEnableOption mkOption;
-  inherit (lib.types) bool enum int lines attrsOf nullOr path str submodule;
+  inherit (lib.types) bool enum ints lines attrsOf nullOr path str submodule;
   inherit (lib.modules) mkDefault mkIf mkMerge;
 
   commonDescr = ''
@@ -18,7 +18,6 @@ let
   '';
 
   str1 = lib.types.addCheck str (s: s!="");  # non-empty string
-  int1 = lib.types.addCheck int (i: i>0);  # positive integer
 
   configAttrType =
     # Options in HylaFAX configuration files can be
@@ -27,7 +26,7 @@ let
     # This type definition resolves all
     # those types into a list of strings.
     let
-      inherit (lib.types) attrsOf coercedTo listOf;
+      inherit (lib.types) attrsOf coercedTo int listOf;
       innerType = coercedTo bool (x: if x then "Yes" else "No")
         (coercedTo int (toString) str);
     in
@@ -290,7 +289,7 @@ in
       '';
     };
     faxcron.infoDays = mkOption {
-      type = int1;
+      type = ints.positive;
       default = 30;
       description = ''
         Set the expiration time for data in the
@@ -298,7 +297,7 @@ in
       '';
     };
     faxcron.logDays = mkOption {
-      type = int1;
+      type = ints.positive;
       default = 30;
       description = ''
         Set the expiration time for
@@ -306,7 +305,7 @@ in
       '';
     };
     faxcron.rcvDays = mkOption {
-      type = int1;
+      type = ints.positive;
       default = 7;
       description = ''
         Set the expiration time for files in
@@ -343,7 +342,7 @@ in
       '';
     };
     faxqclean.doneqMinutes = mkOption {
-      type = int1;
+      type = ints.positive;
       default = 15;
       example = literalExample "24*60";
       description = ''
@@ -353,7 +352,7 @@ in
       '';
     };
     faxqclean.docqMinutes = mkOption {
-      type = int1;
+      type = ints.positive;
       default = 60;
       example = literalExample "24*60";
       description = ''
diff --git a/nixos/modules/services/networking/hylafax/spool.sh b/nixos/modules/services/networking/hylafax/spool.sh
index 31e930e8c597..8b723df77df9 100755
--- a/nixos/modules/services/networking/hylafax/spool.sh
+++ b/nixos/modules/services/networking/hylafax/spool.sh
@@ -1,4 +1,4 @@
-#! @shell@ -e
+#! @runtimeShell@ -e
 
 # The following lines create/update the HylaFAX spool directory:
 # Subdirectories/files with persistent data are kept,
@@ -80,7 +80,7 @@ touch clientlog faxcron.lastrun xferfaxlog
 chown @faxuser@:@faxgroup@ clientlog faxcron.lastrun xferfaxlog
 
 # create symlinks for frozen directories/files
-lnsym --target-directory=. "@hylafax@"/spool/{COPYRIGHT,bin,config}
+lnsym --target-directory=. "@hylafaxplus@"/spool/{COPYRIGHT,bin,config}
 
 # create empty temporary directories
 update --mode=0700 -d client dev status
@@ -93,7 +93,7 @@ install -d "@spoolAreaPath@/etc"
 cd "@spoolAreaPath@/etc"
 
 # create symlinks to all files in template's etc
-lnsym --target-directory=. "@hylafax@/spool/etc"/*
+lnsym --target-directory=. "@hylafaxplus@/spool/etc"/*
 
 # set LOCKDIR in setup.cache
 sed --regexp-extended 's|^(UUCP_LOCKDIR=).*$|\1'"'@lockPath@'|g" --in-place setup.cache
diff --git a/nixos/modules/services/networking/hylafax/systemd.nix b/nixos/modules/services/networking/hylafax/systemd.nix
index f63f7c97ad1c..4506bbbc5eb7 100644
--- a/nixos/modules/services/networking/hylafax/systemd.nix
+++ b/nixos/modules/services/networking/hylafax/systemd.nix
@@ -13,11 +13,10 @@ let
     # creates hylafax config file,
     # makes sure "Include" is listed *first*
     let
-      mkLines = conf:
-        (lib.concatLists
-        (lib.flip lib.mapAttrsToList conf
-        (k: map (v: "${k}: ${v}")
-      )));
+      mkLines = lib.flip lib.pipe [
+        (lib.mapAttrsToList (key: map (val: "${key}: ${val}")))
+        lib.concatLists
+      ];
       include = mkLines { Include = conf.Include or []; };
       other = mkLines ( conf // { Include = []; } );
     in
@@ -48,13 +47,12 @@ let
     name = "hylafax-setup-spool.sh";
     src = ./spool.sh;
     isExecutable = true;
-    inherit (pkgs.stdenv) shell;
-    hylafax = pkgs.hylafaxplus;
     faxuser = "uucp";
     faxgroup = "uucp";
     lockPath = "/var/lock";
     inherit globalConfigPath modemConfigPath;
     inherit (cfg) sendmailPath spoolAreaPath userAccessFile;
+    inherit (pkgs) hylafaxplus runtimeShell;
   };
 
   waitFaxqScript = pkgs.substituteAll {
@@ -64,8 +62,8 @@ let
     src = ./faxq-wait.sh;
     isExecutable = true;
     timeoutSec = toString 10;
-    inherit (pkgs.stdenv) shell;
     inherit (cfg) spoolAreaPath;
+    inherit (pkgs) runtimeShell;
   };
 
   sockets.hylafax-hfaxd = {
@@ -108,8 +106,10 @@ let
         PrivateDevices = true;  # breaks /dev/tty...
         PrivateNetwork = true;
         PrivateTmp = true;
+        #ProtectClock = true;  # breaks /dev/tty... (why?)
         ProtectControlGroups = true;
         #ProtectHome = true;  # breaks custom spool dirs
+        ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         #ProtectSystem = "strict";  # breaks custom spool dirs
diff --git a/pkgs/servers/hylafaxplus/default.nix b/pkgs/servers/hylafaxplus/default.nix
index e8bf832a15cf..4ce0d63f6bed 100644
--- a/pkgs/servers/hylafaxplus/default.nix
+++ b/pkgs/servers/hylafaxplus/default.nix
@@ -2,6 +2,7 @@
 , lib
 , fakeroot
 , fetchurl
+, fetchpatch
 , libfaketime
 , substituteAll
 ## runtime dependencies
@@ -29,12 +30,12 @@
 
 let
 
-  name = "hylafaxplus-${version}";
+  pname = "hylafaxplus";
   version = "7.0.3";
   sha256 = "139iwcwrn9i5lragxi33ilzah72w59wg4midfjjgx5cly3ah0iy4";
 
   configSite = substituteAll {
-    name = "hylafaxplus-config.site";
+    name = "${pname}-config.site";
     src = ./config.site;
     config_maxgid = lib.optionalString (maxgid!=null) ''CONFIG_MAXGID=${builtins.toString maxgid}'';
     ghostscript_version = ghostscript.version;
@@ -43,7 +44,7 @@ let
   };
 
   postPatch = substituteAll {
-    name = "hylafaxplus-post-patch.sh";
+    name = "${pname}-post-patch.sh";
     src = ./post-patch.sh;
     inherit configSite;
     maxuid = lib.optionalString (maxuid!=null) (builtins.toString maxuid);
@@ -54,7 +55,7 @@ let
   };
 
   postInstall = substituteAll {
-    name = "hylafaxplus-post-install.sh";
+    name = "${pname}-post-install.sh";
     src = ./post-install.sh;
     inherit fakeroot libfaketime;
   };
@@ -62,13 +63,18 @@ let
 in
 
 stdenv.mkDerivation {
-  inherit name version;
+  inherit pname version;
   src = fetchurl {
     url = "mirror://sourceforge/hylafax/hylafax-${version}.tar.gz";
     inherit sha256;
   };
   patches = [
-    ./libtiff-4.2.patch  # adjust configure check to work with libtiff > 4.1
+    # adjust configure check to work with libtiff > 4.1
+    (fetchpatch {
+      name = "libtiff-4.2.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/net-misc/hylafaxplus/files/hylafaxplus-7.0.2-tiff-4.2.patch?id=82e3eefd5447f36e5bb00068a54b91d8c891ccf6";
+      sha256 = "0hhf4wpgj842gz4nxq8s55vnzmciqkyjjaaxdpqawns2746vx0sw";
+    })
   ];
   # Note that `configure` (and maybe `faxsetup`) are looking
   # for a couple of standard binaries in the `PATH` and
diff --git a/pkgs/servers/hylafaxplus/libtiff-4.2.patch b/pkgs/servers/hylafaxplus/libtiff-4.2.patch
deleted file mode 100644
index 5da106565f06..000000000000
--- a/pkgs/servers/hylafaxplus/libtiff-4.2.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index 7456dcb..90f0e8d 100755
---- a/configure
-+++ b/configure
-@@ -2583,7 +2583,7 @@ EOF
- 				echo '#define TIFFSTRIPBYTECOUNTS uint32'
- 				echo '#define TIFFVERSION TIFF_VERSION'
- 				echo '#define TIFFHEADER TIFFHeader';;
--		4.[01])		tiff_runlen_t="uint32"
-+		4.[012])	tiff_runlen_t="uint32"
- 				tiff_offset_t="uint64"
- 				echo '#define TIFFSTRIPBYTECOUNTS uint64'
- 				echo '#define TIFFVERSION TIFF_VERSION_CLASSIC'
diff --git a/pkgs/servers/hylafaxplus/post-patch.sh b/pkgs/servers/hylafaxplus/post-patch.sh
index 6ec5937147e2..43ee91d2f62c 100644
--- a/pkgs/servers/hylafaxplus/post-patch.sh
+++ b/pkgs/servers/hylafaxplus/post-patch.sh
@@ -1,10 +1,3 @@
-# `configure` (maybe others) set `POSIXLY_CORRECT`, which
-# breaks the gcc wrapper script of nixpkgs (maybe others).
-# We simply un-export `POSIXLY_CORRECT` after each export so
-# its effects don't apply within nixpkgs wrapper scripts.
-grep -rlF POSIXLY_CORRECT | xargs \
-  sed '/export *POSIXLY_CORRECT/a export -n POSIXLY_CORRECT' -i
-
 # Replace strange default value for the nobody account.
 if test -n "@maxuid@"
 then