diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
deleted file mode 100644
index 8356cdc583a2..000000000000
--- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 640d11fae5bcf1fa8c1a54facbe168a256cacc1b Mon Sep 17 00:00:00 2001
-From: Morgan Helton <mhelton@gmail.com>
-Date: Sun, 26 May 2024 12:17:01 -0500
-Subject: [PATCH] envoy: allow specification of external binary
-
----
- pkg/envoy/envoy.go | 17 +++++++++++++----
- 1 file changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
-index 85c725629..4a726a44b 100644
---- a/pkg/envoy/envoy.go
-+++ b/pkg/envoy/envoy.go
-@@ -8,10 +8,10 @@ import (
- 	"errors"
- 	"fmt"
- 	"io"
-+	"io/fs"
- 	"net"
- 	"net/http"
- 	"net/url"
- 	"os"
- 	"os/exec"
--	"path"
- 	"path/filepath"
-@@ -44,6 +44,11 @@ const (
- 	configFileName = "envoy-config.yaml"
- )
-
-+var OverrideEnvoyPath = ""
-+
-+const workingDirectoryName = ".pomerium-envoy"
-+const embeddedEnvoyPermissions fs.FileMode = 0o700
-+
- // A Server is a pomerium proxy implemented via envoy.
- type Server struct {
- 	ServerOptions
-@@ -100,14 +105,17 @@ func NewServer(
- 		log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy")
- 	}
-
--	envoyPath, err := Extract()
-+	envoyPath := OverrideEnvoyPath
-+	wd := filepath.Join(os.TempDir(), workingDirectoryName)
-+
-+	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
- 	if err != nil {
--		return nil, fmt.Errorf("extracting envoy: %w", err)
-+		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
- 	}
-
- 	srv := &Server{
- 		ServerOptions:        options,
--		wd:                   path.Dir(envoyPath),
-+		wd:                   wd,
- 		builder:              builder,
- 		grpcPort:             src.GetConfig().GRPCPort,
- 		httpPort:             src.GetConfig().HTTPPort,
---
-2.49.0
-
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index dc67aa519332..a93e9924255a 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -1,9 +1,9 @@
 {
   buildGoModule,
   buildNpmPackage,
+  runCommand,
   fetchFromGitHub,
   lib,
-  envoy,
   nixosTests,
   pomerium-cli,
 }:
@@ -15,9 +15,7 @@ let
     id
     mapAttrsToList
     ;
-in
-buildGoModule rec {
-  pname = "pomerium";
+
   version = "0.32.6";
   src = fetchFromGitHub {
     owner = "pomerium";
@@ -25,13 +23,50 @@ buildGoModule rec {
     rev = "v${version}";
     hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU=";
   };
-
   vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM=";
 
+  getEnvoy = buildGoModule {
+    pname = "pomerium-get-envoy";
+    inherit src version vendorHash;
+
+    subPackages = [
+      "pkg/envoy/get-envoy"
+    ];
+
+    # get-envoy's envoy version is pinned via pkg/envoy/envoyversion, which
+    # relies on a specific version of github.com/pomerium/envoy-custom as a Go module,
+    # and then fetches that version's release binaries from GHCR.
+  };
+in
+buildGoModule (finalAttrs: {
+  pname = "pomerium";
+  inherit src version vendorHash;
+
+  envoyBinaries =
+    runCommand "pomerium-envoy-binaries"
+      {
+        nativeBuildInputs = [ getEnvoy ];
+
+        outputHashAlgo = "sha256";
+        outputHashMode = "recursive";
+        outputHash = "sha256-i2DuOx+fSCwTKavf6zvuRd1AKbk4igrzy2AXinDkyrI=";
+
+        meta = {
+          homepage = "https://github.com/pomerium/envoy-custom";
+          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+        };
+      }
+      ''
+        mkdir $out
+        cd $out
+        get-envoy
+        chmod +x envoy-darwin-amd64 envoy-darwin-arm64 envoy-linux-amd64 envoy-linux-arm64
+      '';
+
   ui = buildNpmPackage {
     pname = "pomerium-ui";
-    inherit version;
-    src = "${src}/ui";
+    inherit (finalAttrs) version;
+    src = "${finalAttrs.src}/ui";
 
     npmDepsHash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw=";
 
@@ -46,24 +81,16 @@ buildGoModule rec {
     "cmd/pomerium"
   ];
 
-  # patch pomerium to allow use of external envoy
-  patches = [
-    ./0001-envoy-allow-specification-of-external-binary.patch
-  ];
-
   ldflags =
     let
       # Set a variety of useful meta variables for stamping the build with.
       setVars = {
         "github.com/pomerium/pomerium/internal/version" = {
-          Version = "v${version}";
+          Version = "v${finalAttrs.version}";
           BuildMeta = "nixpkgs";
           ProjectName = "pomerium";
           ProjectURL = "github.com/pomerium/pomerium";
         };
-        "github.com/pomerium/pomerium/pkg/envoy" = {
-          OverrideEnvoyPath = "${envoy}/bin/envoy";
-        };
       };
       concatStringsSpace = list: concatStringsSep " " list;
       mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
@@ -79,28 +106,11 @@ buildGoModule rec {
     ];
 
   preBuild = ''
-    # Replace embedded envoy with nothing.
-    # We set OverrideEnvoyPath above, so rawBinary should never get looked at
-    # but we still need to set a checksum/version.
-    rm pkg/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >pkg/envoy/files/files_external.go
-    package files
-
-    import _ "embed" // embed
-
-    var rawBinary []byte
-
-    //go:embed envoy.sha256
-    var rawChecksum string
-
-    //go:embed envoy.version
-    var rawVersion string
-    EOF
-    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
-    echo '${envoy.version}' > pkg/envoy/files/envoy.version
+    # Insert embedded envoy.
+    cp -r ${finalAttrs.envoyBinaries}/* pkg/envoy/files
 
     # put the built UI files where they will be picked up as part of binary build
-    cp -r ${ui}/* ui/dist
+    cp -r ${finalAttrs.ui}/* ui/dist
   '';
 
   installPhase = ''
@@ -129,4 +139,4 @@ buildGoModule rec {
       "aarch64-linux"
     ];
   };
-}
+})