diff --git a/nixos/modules/services/networking/g3proxy.nix b/nixos/modules/services/networking/g3proxy.nix
index 6df4f37b1123..bdcc8e2e36b7 100644
--- a/nixos/modules/services/networking/g3proxy.nix
+++ b/nixos/modules/services/networking/g3proxy.nix
@@ -54,7 +54,7 @@ in
           let
             g3proxy-yaml = settingsFormat.generate "g3proxy.yaml" cfg.settings;
           in
-          "${lib.getExe cfg.package} --config-file ${g3proxy-yaml}";
+          "${lib.getExe cfg.package} --config-file ${g3proxy-yaml} --systemd --control-dir %t/g3proxy";
 
         WorkingDirectory = "/var/lib/g3proxy";
         StateDirectory = "g3proxy";
diff --git a/pkgs/by-name/g3/g3proxy/package.nix b/pkgs/by-name/g3/g3proxy/package.nix
index b9dcdad4c4e5..33e1cf636030 100644
--- a/pkgs/by-name/g3/g3proxy/package.nix
+++ b/pkgs/by-name/g3/g3proxy/package.nix
@@ -7,51 +7,57 @@
   python3,
   lua5_4,
   capnproto,
-  cmake,
+  openssl,
+  rust-bindgen,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
-  pname = "g3";
-  version = "v1.10.4";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "g3proxy";
+  version = "1.11.9";
 
   src = fetchFromGitHub {
     owner = "bytedance";
     repo = "g3";
-    tag = "g3proxy-${version}";
-    hash = "sha256-uafKYyzjGdtC+oMJG1wWOvgkSht/wTOzyODcPoTfOnU=";
+    tag = "g3proxy-v${finalAttrs.version}";
+    hash = "sha256-N6Fvdc+Vj7S9CgBby9unKBVBoM9pPlmfyJPxY3KdSXg=";
   };
 
-  cargoHash = "sha256-NbrJGGnpZkF7ZX3MqrMsZ03tWkN/nqWahh00O3IJGOw=";
+  cargoHash = "sha256-bLzkA50XiIUrGyKZ3upo2psjFnjUNups0aIEou+J5IA=";
   useFetchCargoVendor = true;
 
-  # TODO: can we unvendor AWS LC somehow?
-  buildFeatures = [
-    "vendored-aws-lc"
-    "rustls-aws-lc"
+  cargoBuildFlags = [
+    "-p"
+    "g3proxy"
   ];
-
-  # aws-lc/crypto compilation will trigger `strictoverflow` errors.
-  hardeningDisable = [ "strictoverflow" ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
 
   nativeBuildInputs = [
     pkg-config
-    rustPlatform.bindgenHook
     python3
     capnproto
-    cmake
+    rust-bindgen
   ];
 
   buildInputs = [
     c-ares
     lua5_4
+    openssl
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^g3proxy-v([0-9.]+)$"
+    ];
+  };
+
   meta = {
     description = "Enterprise-oriented Generic Proxy Solutions";
     homepage = "https://github.com/bytedance/g3";
-    changelog = "https://github.com/bytedance/g3/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/bytedance/g3/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ raitobezarius ];
     mainProgram = "g3proxy";
   };
-}
+})