diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index cdbdf04f4454..00d1c5c568d0 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, pkgconfig, gnutls, jansson, liburcu, lmdb, libcap_ng, libidn
 , systemd, nettle, libedit, zlib, libiconv, libintlOrEmpty
+, fetchpatch
 }:
 
 let inherit (stdenv.lib) optional optionals; in
@@ -14,6 +15,12 @@ stdenv.mkDerivation rec {
     sha256 = "68e04961d0bf6ba193cb7ec658b295c4ff6e60b3754d64bcd77ebdcee0f283fd";
   };
 
+  patches = [(fetchpatch { # remove for >= 2.6.1
+    name = "kdig-tls.patch";
+    url = "https://gitlab.labs.nic.cz/knot/knot-dns/commit/b72d5cd032795.diff";
+    sha256 = "0ig31rp82j49jh8n3s0dcf5abhh35mcp2k2wii7bh0c60ngb29k6";
+  })];
+
   outputs = [ "bin" "out" "dev" ];
 
   nativeBuildInputs = [ pkgconfig ];