diff --git a/pkgs/development/python-modules/ctap-keyring-device/default.nix b/pkgs/development/python-modules/ctap-keyring-device/default.nix
index 07cf1b616027..ce81bfa36bca 100644
--- a/pkgs/development/python-modules/ctap-keyring-device/default.nix
+++ b/pkgs/development/python-modules/ctap-keyring-device/default.nix
@@ -4,28 +4,40 @@
   fetchPypi,
   setuptools-scm,
   # install requirements
+  six,
   fido2,
   keyring,
   cryptography,
   # test requirements
   pytestCheckHook,
+  unittestCheckHook,
+  mock,
 }:
 
 let
   fido2_0 = fido2.overridePythonAttrs (oldAttrs: rec {
     version = "0.9.3";
-    format = "setuptools";
     src = fetchPypi {
       inherit (oldAttrs) pname;
       inherit version;
       hash = "sha256-tF6JphCc/Lfxu1E3dqotZAjpXEgi+DolORi5RAg0Zuw=";
     };
+    postPatch = ''
+      substituteInPlace setup.py test/test_attestation.py \
+        --replace-fail "distutils.version" "setuptools._distutils.version"
+    '';
+    build-system = [ setuptools-scm ];
+    dependencies = oldAttrs.dependencies ++ [ six ];
+    nativeCheckInputs = [
+      unittestCheckHook
+      mock
+    ];
   });
 in
 buildPythonPackage rec {
   pname = "ctap-keyring-device";
   version = "1.0.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version pname;
@@ -38,16 +50,14 @@ buildPythonPackage rec {
       --replace "--flake8 --black --cov" ""
   '';
 
-  nativeBuildInputs = [
-    setuptools-scm
-  ];
-
   pythonRemoveDeps = [
     # This is a darwin requirement missing pyobjc
     "pyobjc-framework-LocalAuthentication"
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
     keyring
     fido2_0
     cryptography
@@ -55,7 +65,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "ctap_keyring_device" ];
 
-  checkInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
     # Disabled tests that needs pyobjc or windows
diff --git a/pkgs/tools/admin/gimme-aws-creds/default.nix b/pkgs/tools/admin/gimme-aws-creds/default.nix
index 49a7f60e3342..69db86d4591d 100644
--- a/pkgs/tools/admin/gimme-aws-creds/default.nix
+++ b/pkgs/tools/admin/gimme-aws-creds/default.nix
@@ -8,23 +8,7 @@
 , gimme-aws-creds
 }:
 
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      fido2 = super.fido2.overridePythonAttrs (oldAttrs: rec {
-        version = "0.9.3";
-        format = "setuptools";
-        src = fetchPypi {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-tF6JphCc/Lfxu1E3dqotZAjpXEgi+DolORi5RAg0Zuw=";
-        };
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "gimme-aws-creds";
   version = "2.8.2"; # N.B: if you change this, check if overrides are still up-to-date
   format = "setuptools";
@@ -36,7 +20,7 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-fsFYcfbLeYV6tpOGgNrFmYjcUAmdsx5zwUbvcctwFVs=";
   };
 
-  nativeBuildInputs = with python.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
     installShellFiles
   ];
 
@@ -44,9 +28,8 @@ python.pkgs.buildPythonApplication rec {
     "configparser"
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python3.pkgs; [
     boto3
-    fido2
     beautifulsoup4
     ctap-keyring-device
     requests
@@ -61,7 +44,7 @@ python.pkgs.buildPythonApplication rec {
     export PYTHON_KEYRING_BACKEND="keyring.backends.fail.Keyring"
   '';
 
-  checkInputs = with python.pkgs; [
+  nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
     responses
   ];
@@ -82,7 +65,6 @@ python.pkgs.buildPythonApplication rec {
   '';
 
   passthru = {
-    inherit python;
     updateScript = nix-update-script { };
     tests.version = testers.testVersion {
       package = gimme-aws-creds;