diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index 7a479b098ba5..254bffb5859d 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -1,10 +1,28 @@
 {
   lib,
   fetchFromGitHub,
+  fetchPypi,
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+
+      # Doesn't work with latest paramiko
+      paramiko = super.paramiko.overridePythonAttrs (oldAttrs: rec {
+        version = "3.4.0";
+        src = fetchPypi {
+          pname = "paramiko";
+          inherit version;
+          hash = "sha256-qsCPJqMdxN/9koIVJ9FoLZnVL572hRloEUqHKPPCdNM=";
+        };
+        doCheck = false;
+      });
+    };
+  };
+in
+py.pkgs.buildPythonApplication rec {
   pname = "tunnelgraf";
   version = "1.0.6";
   pyproject = true;
@@ -19,14 +37,14 @@ python3.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = [
     "click"
     "deepmerge"
-    "paramiko"
     "psutil"
     "pydantic"
+    "python-hosts"
   ];
 
-  build-system = with python3.pkgs; [ hatchling ];
+  build-system = with py.pkgs; [ hatchling ];
 
-  dependencies = with python3.pkgs; [
+  dependencies = with py.pkgs; [
     click
     deepmerge
     paramiko
@@ -46,7 +64,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Tool to manage SSH tunnel hops to many endpoints";
     homepage = "https://github.com/denniswalker/tunnelgraf";
-    changelog = "https://github.com/denniswalker/tunnelgraf/releases/tag/v${version}";
+    changelog = "https://github.com/denniswalker/tunnelgraf/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "tunnelgraf";
diff --git a/pkgs/development/python-modules/sshtunnel/default.nix b/pkgs/development/python-modules/sshtunnel/default.nix
index 59a2bbd6243c..1cec6aca987b 100644
--- a/pkgs/development/python-modules/sshtunnel/default.nix
+++ b/pkgs/development/python-modules/sshtunnel/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     "test_get_keys"
     "connect_via_proxy"
     "read_ssh_config"
+    # Test doesn't work with paramiko < 4.0.0 and the patch above
+    "test_read_private_key_file"
   ];
 
   meta = with lib; {