diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 659f8d5dea43..fd5e79b6efb8 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@ let inherit (stdenv.lib) optional optionals; in
 # Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
   name = "knot-dns-${version}";
-  version = "2.7.6";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "a1cb1877f04f7c2549c977c2658cfafd07c7e0e924f8e8aa8d4ae4b707f697a2";
+    sha256 = "494ad926705018bd754d96711dc2129f3173f326a0b57d33978090ba4eef87ef";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 04d0a0cf8d0c..3882db1124a5 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, runCommand, pkgconfig, hexdump, which
+{ stdenv, fetchurl, fetchpatch, runCommand, pkgconfig, hexdump, which
 , knot-dns, luajit, libuv, lmdb, gnutls, nettle
 , cmocka, systemd, dns-root-data, makeWrapper
 , extraFeatures ? false /* catch-all if defaults aren't enough */
@@ -19,6 +19,14 @@ unwrapped = stdenv.mkDerivation rec {
     sha256 = "d1396888ec3a63f19dccdf2b7dbcb0d16a5d8642766824b47f4c21be90ce362b";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-libzscanner-2.8.diff";
+      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/commit/186f263.diff";
+      sha256 = "19zqigvc7m2a4j6bk9whx7gj0v009568rz5qwk052z7pzfikr8mk";
+    })
+  ];
+
   # Short-lived cross fix, as upstream is migrating to meson anyway.
   postPatch = ''
     substituteInPlace platform.mk --replace "objdump" "$OBJDUMP"