diff --git a/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch b/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
new file mode 100644
index 000000000000..8c4c3eff5492
--- /dev/null
+++ b/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
@@ -0,0 +1,92 @@
+From 65d90cd17ad7cd3f9aeeb805a08be780fc5bae1a Mon Sep 17 00:00:00 2001
+From: Sjoerd Simons <sjoerd@collabora.com>
+Date: Sun, 22 Aug 2021 16:36:55 +0200
+Subject: [PATCH] rpi: Copy properties from firmware dtb to the loaded dtb
+
+The RPI firmware adjusts several property values in the dtb it passes
+to u-boot depending on the board/SoC revision. Inherit some of these
+when u-boot loads a dtb itself. Specificaly copy:
+
+* /model: The firmware provides a more specific string
+* /memreserve: The firmware defines a reserved range, better keep it
+* emmc2bus and pcie0 dma-ranges: The C0T revision of the bcm2711 Soc (as
+  present on rpi 400 and some rpi 4B boards) has different values for
+  these then the B0T revision. So these need to be adjusted to boot on
+  these boards
+* blconfig: The firmware defines the memory area where the blconfig
+  stored. Copy those over so it can be enabled.
+* /chosen/kaslr-seed: The firmware generates a kaslr seed, take advantage
+  of that.
+
+Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
+Origin: https://patchwork.ozlabs.org/project/uboot/patch/20210822143656.289891-1-sjoerd@collabora.com/
+---
+ board/raspberrypi/rpi/rpi.c | 48 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c
+index 372b26b6f2..64b8684b68 100644
+--- a/board/raspberrypi/rpi/rpi.c
++++ b/board/raspberrypi/rpi/rpi.c
+@@ -495,10 +495,58 @@ void *board_fdt_blob_setup(void)
+ 	return (void *)fw_dtb_pointer;
+ }
+ 
++int copy_property(void *dst, void *src, char *path, char *property)
++{
++	int dst_offset, src_offset;
++	const fdt32_t *prop;
++	int len;
++
++	src_offset = fdt_path_offset(src, path);
++	dst_offset = fdt_path_offset(dst, path);
++
++	if (src_offset < 0 || dst_offset < 0)
++		return -1;
++
++	prop = fdt_getprop(src, src_offset, property, &len);
++	if (!prop)
++		return -1;
++
++	return fdt_setprop(dst, dst_offset, property, prop, len);
++}
++
++/* Copy tweaks from the firmware dtb to the loaded dtb */
++void  update_fdt_from_fw(void *fdt, void *fw_fdt)
++{
++	/* Using dtb from firmware directly; leave it alone */
++	if (fdt == fw_fdt)
++		return;
++
++	/* The firmware provides a more precie model; so copy that */
++	copy_property(fdt, fw_fdt, "/", "model");
++
++	/* memory reserve as suggested by the firmware */
++	copy_property(fdt, fw_fdt, "/", "memreserve");
++
++	/* Adjust dma-ranges for the SD card and PCI bus as they can depend on
++	 * the SoC revision
++	 */
++	copy_property(fdt, fw_fdt, "emmc2bus", "dma-ranges");
++	copy_property(fdt, fw_fdt, "pcie0", "dma-ranges");
++
++	/* Bootloader configuration template exposes as nvmem */
++	if (copy_property(fdt, fw_fdt, "blconfig", "reg") == 0)
++		copy_property(fdt, fw_fdt, "blconfig", "status");
++
++	/* kernel address randomisation seed as provided by the firmware */
++	copy_property(fdt, fw_fdt, "/chosen", "kaslr-seed");
++}
++
+ int ft_board_setup(void *blob, struct bd_info *bd)
+ {
+ 	int node;
+ 
++	update_fdt_from_fw(blob, (void *)fw_dtb_pointer);
++
+ 	node = fdt_node_offset_by_compatible(blob, -1, "simple-framebuffer");
+ 	if (node < 0)
+ 		lcd_dt_simplefb_add_node(blob);
+-- 
+2.32.0
+
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index a49779e72232..c640153f6161 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -42,6 +42,11 @@ let
 
     patches = [
       ./0001-configs-rpi-allow-for-bigger-kernels.patch
+
+      # Make U-Boot forward some important settings from the firmware-provided FDT. Fixes booting on BCM2711C0 boards.
+      # See also: https://github.com/NixOS/nixpkgs/issues/135828
+      # Source: https://patchwork.ozlabs.org/project/uboot/patch/20210822143656.289891-1-sjoerd@collabora.com/
+      ./0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
     ] ++ extraPatches;
 
     postPatch = ''
@@ -108,7 +113,6 @@ let
       maintainers = with maintainers; [ dezgeg samueldr lopsided98 ];
     } // extraMeta;
   } // removeAttrs args [ "extraMeta" ]);
-
 in {
   inherit buildUBoot;