diff --git a/nixos/modules/services/networking/cjdns.nix b/nixos/modules/services/networking/cjdns.nix
index 1b9f53c9b28a..43ea76d5d710 100644
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@@ -49,7 +49,7 @@ let
         k: v:
         lib.optionalString (
           v.hostname != ""
-        ) "echo $(${pkgs.cjdns}/bin/publictoip6 ${v.publicKey}) ${v.hostname}"
+        ) "echo $(${pkgs.cjdns}/bin/cjdnstool util key2ip6 ${v.publicKey}) ${v.hostname}"
       ) (cfg.ETHInterface.connectTo // cfg.UDPInterface.connectTo)
     )}
   '';
@@ -268,7 +268,7 @@ in
 
         if [ -z "$CJDNS_PRIVATE_KEY" ]; then
             shopt -s lastpipe
-            ${pkg}/bin/makekeys | { read private ipv6 public; }
+            ${pkg}/bin/cjdnstool util keygen | { read private ipv6 public; }
 
             install -m 600 <(echo "CJDNS_PRIVATE_KEY=$private") /etc/cjdns.keys
             install -m 444 <(echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public") /etc/cjdns.public
diff --git a/nixos/tests/cjdns.nix b/nixos/tests/cjdns.nix
index 52762f853e20..4bff3b15035f 100644
--- a/nixos/tests/cjdns.nix
+++ b/nixos/tests/cjdns.nix
@@ -105,7 +105,7 @@ in
 
     def cjdns_ip(machine):
         res = machine.succeed("ip -o -6 addr show dev tun0")
-        ip = re.split("\s+|/", res)[3]
+        ip = re.split("\\s+|/", res)[3]
         machine.log("has ip {}".format(ip))
         return ip
 
@@ -116,14 +116,14 @@ in
 
     # ping a few times each to let the routing table establish itself
 
-    alice.succeed("ping -c 4 {}".format(carol_ip6))
-    bob.succeed("ping -c 4 {}".format(carol_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
 
-    carol.succeed("ping -c 4 {}".format(alice_ip6))
-    carol.succeed("ping -c 4 {}".format(bob_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
 
-    alice.succeed("ping -c 4 {}".format(bob_ip6))
-    bob.succeed("ping -c 4 {}".format(alice_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
 
     alice.wait_for_unit("httpd.service")
 
diff --git a/pkgs/by-name/cj/cjdns-tools/package.nix b/pkgs/by-name/cj/cjdns-tools/package.nix
index 9e68412928e6..43c2fb28cafb 100644
--- a/pkgs/by-name/cj/cjdns-tools/package.nix
+++ b/pkgs/by-name/cj/cjdns-tools/package.nix
@@ -37,12 +37,12 @@ stdenv.mkDerivation {
     cp -r node_modules $out/node_modules
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Tools for cjdns managment";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     maintainers = [ ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "cjdns-tools";
   };
 }
diff --git a/pkgs/by-name/cj/cjdns/package.nix b/pkgs/by-name/cj/cjdns/package.nix
index e095b3f3b35f..34199ed5b181 100644
--- a/pkgs/by-name/cj/cjdns/package.nix
+++ b/pkgs/by-name/cj/cjdns/package.nix
@@ -2,11 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   rustPlatform,
   nodejs,
   which,
-  python3,
-  libuv,
   util-linux,
   nixosTests,
   libsodium,
@@ -16,26 +15,34 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cjdns";
-  version = "21.4";
+  version = "22.1";
 
   src = fetchFromGitHub {
     owner = "cjdelisle";
     repo = "cjdns";
-    rev = "cjdns-v${version}";
-    sha256 = "sha256-vI3uHZwmbFqxGasKqgCl0PLEEO8RNEhwkn5ZA8K7bxU=";
+    tag = "cjdns-v${version}";
+    hash = "sha256-0imQrkcvIA+2Eq/zlC65USMR7T3OUKwQxrB1KtVexyU=";
   };
 
   patches = [
     (replaceVars ./system-libsodium.patch {
       libsodium_include_dir = "${libsodium.dev}/include";
     })
+    # Remove mkpasswd since it is failing the build
+    (fetchpatch {
+      url = "https://github.com/cjdelisle/cjdns/commit/6391dba3f5fdab45df4b4b6b71dbe9620286ce32.patch";
+      hash = "sha256-XVA4tdTVMLrV6zuGoBCkOgQq6NXh0x7u8HgmaxFeoRI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/cjdelisle/cjdns/commit/436d9a9784bae85734992c2561c778fbd2f5ac32.patch";
+      hash = "sha256-THcYNGVbMx/xf3/5UIxEhz3OlODE0qiYgDBOlHunhj8=";
+    })
   ];
 
-  cargoHash = "sha256-LJEKjhyAsK6b7mKObX8tNJdKt53iagMD/YLzoY5GVPw=";
+  cargoHash = "sha256-f96y6ZW0HxC+73ts5re8GIo2aigQgK3gXyF7fMrcJ0o=";
 
   nativeBuildInputs = [
     which
-    python3
     nodejs
     pkg-config
   ]
@@ -43,10 +50,7 @@ rustPlatform.buildRustPackage rec {
     # for flock
     lib.optional stdenv.hostPlatform.isLinux util-linux;
 
-  buildInputs = [
-    libuv
-    libsodium
-  ];
+  buildInputs = [ libsodium ];
 
   env.SODIUM_USE_PKG_CONFIG = 1;
   env.NIX_CFLAGS_COMPILE = toString (
@@ -61,14 +65,26 @@ rustPlatform.buildRustPackage rec {
     ]
   );
 
+  cargoTestFlags = [
+    # don't run doctests since they fail with "cannot find type `Ctx` in this scope"
+    "--lib"
+    "--bins"
+    "--tests"
+  ];
+
+  checkFlags = [
+    # Tests don't seem to work - "called `Result::unwrap()` on an `Err` value: DecryptErr: NO_SESSION"
+    "--skip=crypto::crypto_auth::tests::test_wireguard_iface_encrypt_decrypt"
+    "--skip=crypto::crypto_auth::tests::test_wireguard_iface_encrypt_decrypt_with_auth"
+  ];
+
   passthru.tests.basic = nixosTests.cjdns;
 
-  meta = with lib; {
-    broken = true; # outdated, incompatible with supported python versions
+  meta = {
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Encrypted networking for regular people";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ehmry ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }