diff --git a/pkgs/by-name/ov/ovn/0001-tests-Expect-musl-error-string-for-EIO-errno.patch b/pkgs/by-name/ov/ovn/0001-tests-Expect-musl-error-string-for-EIO-errno.patch
new file mode 100644
index 000000000000..174421236802
--- /dev/null
+++ b/pkgs/by-name/ov/ovn/0001-tests-Expect-musl-error-string-for-EIO-errno.patch
@@ -0,0 +1,31 @@
+From d4ead86b2184d1fc2748ed2b6fae8c0dceaf76c8 Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Thu, 11 Sep 2025 23:37:28 -0400
+Subject: [PATCH ovn 1/2] tests: Expect musl error string for EIO errno.
+
+Musl uses a slightly different string representation for the error,
+which makes the test fail on cleanup because an unexpected warning is
+observed in the service log.
+
+This patch will ignore both glibc and musl error messages.
+
+Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+---
+ tests/ovn-controller.at | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at
+index 0b00906ae..bec06e527 100644
+--- a/tests/ovn-controller.at
++++ b/tests/ovn-controller.at
+@@ -846,6 +846,7 @@ OVN_CLEANUP([hv1
+ /Certificate must be configured to use SSL/d
+ /SSL_read: error/d
+ /receive error: Input/d
++/receive error: I\/O error/d
+ /connection dropped/d
+ ])
+ AT_CLEANUP
+-- 
+2.50.1
+
diff --git a/pkgs/by-name/ov/ovn/0002-tests-Use-localhost-when-setting-wrong-ovn-remote.patch b/pkgs/by-name/ov/ovn/0002-tests-Use-localhost-when-setting-wrong-ovn-remote.patch
new file mode 100644
index 000000000000..11efc948e361
--- /dev/null
+++ b/pkgs/by-name/ov/ovn/0002-tests-Use-localhost-when-setting-wrong-ovn-remote.patch
@@ -0,0 +1,37 @@
+From 44d9d58461e15314edf507d0379bff991d7e9964 Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Thu, 11 Sep 2025 23:40:51 -0400
+Subject: [PATCH ovn 2/2] tests: Use localhost when setting "wrong" ovn-remote.
+
+In some isolated environments (e.g. in nixpkgs build sandbox), the
+network namespace doesn't have any routes or interfaces but `lo`. In
+this case, an attempt to connect to 192.168.0.10 results in ENETUNREACH,
+producing an unexpected "Network unreachable" warning message in service
+log file - breaking the test cleanup checks.
+
+Since the test case doesn't seem to care if the address is available, as
+long as there is no SB database actually running at the configured
+ovn-remote port, use the localhost address instead (which is always
+present, even in the most isolated environments).
+
+Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+---
+ tests/ovn-controller.at | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at
+index bec06e527..a8a9a2da2 100644
+--- a/tests/ovn-controller.at
++++ b/tests/ovn-controller.at
+@@ -404,7 +404,7 @@ check_sbdb_connection () {
+ 
+ OVS_WAIT_UNTIL([check_sbdb_connection connected])
+ 
+-ovs-vsctl set open . external_ids:ovn-remote=tcp:192.168.0.10:6642
++ovs-vsctl set open . external_ids:ovn-remote=tcp:127.0.0.1:12345
+ OVS_WAIT_UNTIL([check_sbdb_connection 'not connected'])
+ 
+ # reset the remote for clean-up
+-- 
+2.50.1
+
diff --git a/pkgs/by-name/ov/ovn/package.nix b/pkgs/by-name/ov/ovn/package.nix
index ab38619a3ba9..286a3d54caf5 100644
--- a/pkgs/by-name/ov/ovn/package.nix
+++ b/pkgs/by-name/ov/ovn/package.nix
@@ -29,6 +29,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix test failure with musl libc.
+    # https://patchwork.ozlabs.org/project/ovn/patch/20250912035054.50593-1-ihar.hrachyshka@gmail.com/
+    ./0001-tests-Expect-musl-error-string-for-EIO-errno.patch
+    # Fix sandbox test failure.
+    # https://patchwork.ozlabs.org/project/ovn/patch/20250912035054.50593-2-ihar.hrachyshka@gmail.com/
+    ./0002-tests-Use-localhost-when-setting-wrong-ovn-remote.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -46,16 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     xdp-tools
   ];
 
-  postPatch = ''
-    # One test assumes that the test environment has a network route to
-    # 192.168.0.10 and fails in sandbox. Replace it with localhost.
-    #
-    # The test case checks behavior when the configured ovn-remote is down, so
-    # we can pick any "free" port here.
-    substituteInPlace tests/ovn-controller.at \
-      --replace-fail 192.168.0.10:6642 127.0.0.1:9999
-  '';
-
   # need to build the ovs submodule first
   preConfigure = ''
     pushd ovs