diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 5809fc684420..beb94dd7eb25 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -24,11 +24,12 @@
   rich,
   tomlkit,
   gradio,
+  safehttpx,
 }:
 
 buildPythonPackage rec {
   pname = "gradio-client";
-  version = "1.4.0";
+  version = "1.5.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,9 +39,9 @@ buildPythonPackage rec {
     owner = "gradio-app";
     repo = "gradio";
     # not to be confused with @gradio/client@${version}
-    rev = "refs/tags/gradio_client@${version}";
+    tag = "gradio_client@${version}";
     sparseCheckout = [ "client/python" ];
-    hash = "sha256-pS7yrqBuq/Pe7sEfReAM6OL2qFQVA+vWra36UuhyDkk=";
+    hash = "sha256-u4GQYtCeAMDqRRbZGtjfqIHwuHyxUpw6kRE75SJMALg=";
   };
   prePatch = ''
     cd client/python
@@ -75,6 +76,7 @@ buildPythonPackage rec {
     pydub
     rich
     tomlkit
+    safehttpx
     gradio.sans-reverse-dependencies
   ];
   # ensuring we don't propagate this intermediate build
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 05b8098aa639..cdc4ccbece6f 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -3,6 +3,8 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
+  fetchFromGitHub,
+  fetchpatch,
   pythonOlder,
   writeShellScriptBin,
   gradio,
@@ -12,6 +14,11 @@
   hatch-requirements-txt,
   hatch-fancy-pypi-readme,
 
+  # web assets
+  zip,
+  nodejs,
+  pnpm_9,
+
   # runtime
   setuptools,
   aiofiles,
@@ -35,6 +42,7 @@
   python-multipart,
   pydub,
   pyyaml,
+  safehttpx,
   semantic-version,
   typing-extensions,
   uvicorn,
@@ -64,23 +72,27 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "5.1.0";
+  version = "5.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  # We use the Pypi release, since it provides prebuilt webui assets
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0hU2aObeLfegG7M/AaB0/HcW7IY8QPRy2OQ5Q57x4VM=";
+  # unfortunately no fetchPypi due to https://github.com/gradio-app/gradio/pull/9778
+  src = fetchFromGitHub {
+    owner = "gradio-app";
+    repo = "gradio";
+    tag = "gradio@${version}";
+    hash = "sha256-HW0J7oSkCo4DIHpU4LUoBZ2jmmrv5Xd64floA4uyo5A=";
   };
 
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit pname version src;
+    hash = "sha256-9fAkP2zV3OfyROdtvmS94ujpkGmlB0wGOaWS13LgJTM=";
+   };
+
   # fix packaging.ParserSyntaxError, which can't handle comments
   postPatch = ''
     sed -i -e "s/ #.*$//g" requirements*.txt
-
-    # they bundle deps?
-    rm -rf venv/
   '';
 
   pythonRelaxDeps = [
@@ -96,6 +108,12 @@ buildPythonPackage rec {
     "ruff"
   ];
 
+  nativeBuildInputs = [
+    zip
+    nodejs
+    pnpm_9.configHook
+  ];
+
   build-system = [
     hatchling
     hatch-requirements-txt
@@ -125,6 +143,7 @@ buildPythonPackage rec {
     python-multipart
     pydub
     pyyaml
+    safehttpx
     semantic-version
     typing-extensions
     uvicorn
@@ -158,6 +177,16 @@ buildPythonPackage rec {
     (writeShellScriptBin "npm" "false")
   ] ++ optional-dependencies.oauth ++ pydantic.optional-dependencies.email;
 
+  preBuild = ''
+    pnpm build
+    pnpm package
+  '';
+
+  postBuild = ''
+    # SyntaxError: 'await' outside function
+    zip -d dist/gradio-*.whl gradio/_frontend_code/lite/examples/transformers_basic/run.py
+  '';
+
   # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
   # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
   preCheck =
@@ -193,12 +222,29 @@ buildPythonPackage rec {
 
       # fails without network
       "test_download_if_url_correct_parse"
+      "test_encode_url_to_base64_doesnt_encode_errors"
 
       # flaky: OSError: Cannot find empty port in range: 7860-7959
       "test_docs_url"
       "test_orjson_serialization"
       "test_dataset_is_updated"
       "test_multimodal_api"
+      "test_examples_keep_all_suffixes"
+      "test_progress_bar"
+      "test_progress_bar_track_tqdm"
+      "test_info_and_warning_alerts"
+      "test_info_isolation[True]"
+      "test_info_isolation[False]"
+      "test_examples_no_cache_optional_inputs"
+      "test_start_server[127.0.0.1]"
+      "test_start_server[[::1]]"
+      "test_single_request"
+      "test_all_status_messages"
+      "test_default_concurrency_limits[not_set-statuses0]"
+      "test_default_concurrency_limits[None-statuses1]"
+      "test_default_concurrency_limits[1-statuses2]"
+      "test_default_concurrency_limits[2-statuses3]"
+      "test_concurrency_limits"
 
       # tests if pip and other tools are installed
       "test_get_executable_path"
@@ -256,6 +302,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # 100% touches network
     "test/test_networking.py"
+    "client/python/test/test_client.py"
     # makes pytest freeze 50% of the time
     "test/test_interfaces.py"
 
@@ -289,6 +336,13 @@ buildPythonPackage rec {
         doInstallCheck = false;
         doCheck = false;
         preCheck = "";
+        postInstall = ''
+          shopt -s globstar
+          for f in $out/**/*.py; do
+            cp $f "$f"i
+          done
+          shopt -u globstar
+        '';
         pythonImportsCheck = null;
         dontCheckRuntimeDeps = true;
       });
diff --git a/pkgs/development/python-modules/safehttpx/default.nix b/pkgs/development/python-modules/safehttpx/default.nix
new file mode 100644
index 000000000000..d7a9fd27b514
--- /dev/null
+++ b/pkgs/development/python-modules/safehttpx/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  httpx,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "safehttpx";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-s1a/yCzuOiTDlblKLb6rvtYK/xql+jtf6XxPJFbrzkI=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    httpx
+  ];
+
+  pythonImportsCheck = [ "safehttpx" ];
+
+  doCheck = false; # require network access
+
+  meta = {
+    description = "SSRF-safe wrapper around httpx";
+    homepage = "https://github.com/gradio-app/safehttpx";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fliegendewurst ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8c0f661da3c7..3e2d35671a11 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14418,6 +14418,8 @@ self: super: with self; {
 
   safe-pysha3 = callPackage ../development/python-modules/safe-pysha3 { };
 
+  safehttpx = callPackage ../development/python-modules/safehttpx { };
+
   safeio = callPackage ../development/python-modules/safeio { };
 
   safetensors = callPackage ../development/python-modules/safetensors { };