diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
index c2a783b15731..5dd9ed080001 100644
--- a/nixos/modules/services/desktops/espanso.nix
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -25,10 +25,23 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    security.wrappers.espanso = lib.mkIf (cfg.package.waylandSupport or false) {
+      capabilities = "cap_dac_override+p";
+      owner = "root";
+      group = "root";
+      source = lib.getExe (
+        pkgs.espanso-wayland.override { securityWrapperPath = config.security.wrapperDir; }
+      );
+    };
     systemd.user.services.espanso = {
       description = "Espanso daemon";
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} daemon";
+        ExecStart = "${
+          if (cfg.package.waylandSupport or false) then
+            "${config.security.wrapperDir}/espanso"
+          else
+            lib.getExe cfg.package
+        } daemon";
         Restart = "on-failure";
       };
       wantedBy = [ "default.target" ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 40f6d0afbf65..943b72ec614f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -523,6 +523,10 @@ in
   ergo = runTest ./ergo.nix;
   ergochat = runTest ./ergochat.nix;
   ersatztv = handleTest ./ersatztv.nix { };
+  espanso = import ./espanso.nix {
+    inherit (pkgs) lib;
+    inherit runTest;
+  };
   esphome = runTest ./esphome.nix;
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
   etcd = import ./etcd/default.nix { inherit pkgs runTest; };
diff --git a/nixos/tests/espanso.nix b/nixos/tests/espanso.nix
new file mode 100644
index 000000000000..eb4bc6f2020b
--- /dev/null
+++ b/nixos/tests/espanso.nix
@@ -0,0 +1,86 @@
+{ lib, runTest }:
+let
+  makeTest =
+    conf:
+    runTest {
+      name = "espanso";
+      meta.maintainers = with lib.maintainers; [ n8henrie ];
+
+      nodes.machine =
+        let
+          base =
+            { pkgs, config, ... }:
+            {
+              imports = [ ./common/user-account.nix ];
+              services.espanso.enable = true;
+              system.activationScripts.espanso-config = {
+                deps = [ "users" ];
+                text =
+                  let
+                    confdir = "${config.users.users.alice.home}/.config/espanso";
+                    espanso_conf =
+                      let
+                        settingsFormat = pkgs.formats.yaml { };
+                      in
+                      settingsFormat.generate "base.yaml" {
+                        matches = [
+                          {
+                            trigger = ":nixostest";
+                            replace = "My NixOS Test Passed!";
+                          }
+                        ];
+                      };
+                  in
+                  ''
+                    mkdir -p ${confdir}/{config,match}
+                    touch ${confdir}/config/default.yml
+                    cp ${espanso_conf} ${confdir}/match/base.yml
+                    chown -R ${config.users.users.alice.name} ${confdir}
+                  '';
+              };
+            };
+        in
+        lib.mkMerge [
+          base
+          conf
+        ];
+
+      enableOCR = true;
+      testScript = ''
+        machine.wait_for_unit("graphical.target")
+        machine.wait_for_text("Espanso is running!")
+        machine.send_chars(":nixostest")
+        machine.wait_for_text("My NixOS Test Passed!")
+      '';
+    };
+in
+{
+  x11 = makeTest {
+    imports = [ ./common/x11.nix ];
+    test-support.displayManager.auto.user = "alice";
+    users.users.alice.extraGroups = [ "input" ];
+  };
+  wayland = makeTest (
+    { pkgs, config, ... }:
+    {
+      programs.sway.enable = true;
+      services = {
+        greetd =
+          let
+            initial_session = {
+              user = config.users.users.alice.name;
+              command = lib.getExe pkgs.sway;
+            };
+          in
+          {
+            enable = true;
+            settings = {
+              inherit initial_session;
+              default_session = initial_session;
+            };
+          };
+        espanso.package = pkgs.espanso-wayland;
+      };
+    }
+  );
+}
diff --git a/pkgs/by-name/es/espanso/package.nix b/pkgs/by-name/es/espanso/package.nix
index f159d228a3e4..8bc53454b0da 100644
--- a/pkgs/by-name/es/espanso/package.nix
+++ b/pkgs/by-name/es/espanso/package.nix
@@ -20,11 +20,14 @@
   wl-clipboard,
   wxGTK32,
   makeWrapper,
+  securityWrapperPath ? null,
   nix-update-script,
   stdenv,
   waylandSupport ? false,
   x11Support ? stdenv.hostPlatform.isLinux,
   testers,
+  nixosTests,
+  fetchpatch,
 }:
 # espanso does not support building with both X11 and Wayland support at the same time
 assert stdenv.hostPlatform.isLinux -> x11Support != waylandSupport;
@@ -87,13 +90,29 @@ rustPlatform.buildRustPackage (finalAttrs: {
     xdotool
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace scripts/create_bundle.sh \
-      --replace-fail target/mac/ $out/Applications/ \
-      --replace-fail /bin/echo ${coreutils}/bin/echo
-    substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
-      --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
-  '';
+  patches = [
+    # remove when version > 2.3.0
+    (fetchpatch {
+      name = "fix-welcome-screen-expansion.patch";
+      url = "https://github.com/espanso/espanso/commit/5d5fc84df695d628d1d9c3e7e3854c2991a64d64.patch";
+      hash = "sha256-dhoqq0V8b8mGvZvPInHiHKGmGDDFO/SH5HqMY7EA134=";
+    })
+  ];
+
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace scripts/create_bundle.sh \
+        --replace-fail target/mac/ $out/Applications/ \
+        --replace-fail /bin/echo ${coreutils}/bin/echo
+      substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
+        --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
+    ''
+    + lib.optionalString (securityWrapperPath != null) ''
+      substituteInPlace espanso/src/cli/daemon/mod.rs \
+        --replace-fail \
+          'std::env::current_exe().expect("unable to obtain espanso executable location");' \
+          'std::ffi::OsString::from("${securityWrapperPath}/espanso");'
+    '';
 
   # Some tests require networking
   doCheck = false;
@@ -123,9 +142,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       '';
 
   passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      inherit (finalAttrs) version;
+    inherit waylandSupport;
+    tests = nixosTests.espanso // {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        inherit (finalAttrs) version;
+      };
     };
     updateScript = nix-update-script { };
   };