diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index 20dca8980792..cd30abc0c1c0 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -145,6 +145,8 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
   dontConfigure = true;
+  strictDeps = true;
+  __structuredAttrs = true;
   sourceRoot = ".";
   preferLocalBuild = true;
   passthru.icaroot = "${placeholder "out"}/opt/citrix-icaclient";
@@ -243,19 +245,36 @@ stdenv.mkDerivation rec {
         program:
         if (builtins.match "selfservice(.*)" program) != null then
           "--icaroot"
-        else if (builtins.match "wfica(.*)" program != null) then
+        else if (builtins.match "wfica(.*)" program) != null then
           null
         else
           "-icaroot";
+
+      ldLibraryPath =
+        program:
+        lib.concatStringsSep ":" (
+          lib.optional (builtins.match "wfica(.*)" program != null) "$ICAInstDir"
+          ++ [
+            "$ICAInstDir/lib"
+            "$ICAInstDir/usr/lib/x86_64-linux-gnu"
+            "$ICAInstDir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
+          ]
+        );
+
+      # Only the ICA engine needs the top-level client directory on the library
+      # path. Leaving it enabled for UI helpers exposes Citrix's session-only
+      # libproxy.so to the embedded web stack, which then fails to resolve CGP
+      # symbols.
       wrap = program: ''
         wrapProgram $out/opt/citrix-icaclient/${program} \
           ${lib.optionalString (icaFlag program != null) ''--add-flags "${icaFlag program} $ICAInstDir"''} \
           --set ICAROOT "$ICAInstDir" \
           --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
-          --prefix LD_LIBRARY_PATH : "$ICAInstDir:$ICAInstDir/lib:$ICAInstDir/usr/lib/x86_64-linux-gnu:$ICAInstDir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle" \
+          --prefix LD_LIBRARY_PATH : "${ldLibraryPath program}" \
           --set LD_PRELOAD "${libredirect}/lib/libredirect.so ${lib.getLib pcsclite}/lib/libpcsclite.so" \
           --set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone:/usr/lib/x86_64-linux-gnu=$ICAInstDir/usr/lib/x86_64-linux-gnu"
       '';
+
       wrapLink = program: ''
         ${wrap program}
         ln -sf $out/opt/citrix-icaclient/${program} $out/bin/${baseNameOf program}
@@ -283,10 +302,23 @@ stdenv.mkDerivation rec {
       export HOME=$(mktemp -d)
 
       # Run upstream installer in the store-path.
-      sed -i -e 's,^ANSWER="",ANSWER="$INSTALLER_YES",g' -e 's,/bin/true,true,g' -e 's, -C / , -C . ,g' ./linuxx64/hinst
+      sed -i \
+        -e 's,^ANSWER="",ANSWER="$INSTALLER_YES",g' \
+        -e 's,/bin/true,true,g' \
+        -e 's, -C / , -C . ,g' \
+        -e 's,^[[:space:]]*install_deviceTrust "\$ICAInstDir",      :,' \
+        -e 's,^[[:space:]]*install_EPA_with_prompt "\$ICAInstDir",      :,' \
+        -e 's,^[[:space:]]*install_fido2Service "\$CDSourceDir" "\$ICAInstDir",  :,' \
+        ./linuxx64/hinst
       source_date=$(date --utc --date=@$SOURCE_DATE_EPOCH "+%F %T")
       faketime -f "$source_date" ${stdenv.shell} linuxx64/hinst CDROM "$(pwd)"
 
+      mkdir -p "$ICAInstDir/usr"
+      tar -xzf ./linuxx64/linuxx64.cor/Webkit2gtk4.0/webkit2gtk-4.0.tar.gz \
+        --strip-components=2 \
+        -C "$ICAInstDir/usr" \
+        webkit2gtk-4.0-package/usr/lib
+
       if [ -f "$ICAInstDir/util/setlog" ]; then
         chmod +x "$ICAInstDir/util/setlog"
         ln -sf "$ICAInstDir/util/setlog" "$out/bin/citrix-setlog"
@@ -362,6 +394,9 @@ stdenv.mkDerivation rec {
     ${lib.getExe perl} -0777 -pi -e 's{/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/}{"\0" x length($&)}e' \
       $out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4
 
+    addAutoPatchelfSearchPath --no-recurse "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu"
+    addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle"
+    addAutoPatchelfSearchPath "$out/opt/citrix-icaclient/lib"
     autoPatchelf -- "$out"
 
     $out/opt/citrix-icaclient/util/ctx_rehash
diff --git a/pkgs/applications/networking/remote/citrix-workspace/sources.nix b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
index 34f0c8e627ae..506b810333ad 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -21,6 +21,15 @@ let
   #
   # The latest versions can be found at https://www.citrix.com/downloads/workspace-app/linux/
   supportedVersions = lib.mapAttrs mkVersionInfo {
+    "26.01.0" = {
+      major = "26";
+      minor = "01";
+      patch = "0";
+      hash = "0avrf9jpqhijvp6w4jgs7xgp4gg1q2mdzak9h9klkqrbsgrvjr3p";
+      suffix = "150";
+      homepage = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+    };
+
     "25.08.10" = {
       major = "25";
       minor = "08";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 86c043c419e6..f3dc8e7701b2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1963,9 +1963,10 @@ with pkgs;
   };
 
   inherit (callPackage ../applications/networking/remote/citrix-workspace { })
+    citrix_workspace_26_01_0
     citrix_workspace_25_08_10
     ;
-  citrix_workspace = citrix_workspace_25_08_10;
+  citrix_workspace = citrix_workspace_26_01_0;
 
   colord-gtk4 = colord-gtk.override { withGtk4 = true; };