diff --git a/patches/248103.patch b/patches/248103.patch
new file mode 100644
index 00000000..d71b653c
--- /dev/null
+++ b/patches/248103.patch
@@ -0,0 +1,62 @@
+diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
+index 102313ddbdfcb..7dbf26822a2bb 100644
+--- a/pkgs/tools/security/eid-mw/default.nix
++++ b/pkgs/tools/security/eid-mw/default.nix
+@@ -1,21 +1,21 @@
+ { lib
+ , stdenv
+ , fetchFromGitHub
+-, autoreconfHook
+ , autoconf-archive
+-, pkg-config
++, autoreconfHook
+ , makeWrapper
++, pkg-config
++, substituteAll
+ , curl
+ , gtk3
+ , libassuan
+ , libbsd
+ , libproxy
+ , libxml2
++, nssTools
+ , openssl
+ , p11-kit
+ , pcsclite
+-, nssTools
+-, substituteAll
+ }:
+ 
+ stdenv.mkDerivation rec {
+@@ -30,24 +30,27 @@ stdenv.mkDerivation rec {
+     hash = "sha256-70UjfkH+rx1Q+2XEuAByoDsP5ZelyuGXaHdkjTe/sCY=";
+   };
+ 
++  postPatch = ''
++    sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
++  '';
++
++
+   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
+   buildInputs = [ curl gtk3 libassuan libbsd libproxy libxml2 openssl p11-kit pcsclite ];
++
+   preConfigure = ''
+     mkdir openssl
+     ln -s ${lib.getLib openssl}/lib openssl
+     ln -s ${openssl.bin}/bin openssl
+     ln -s ${openssl.dev}/include openssl
+     export SSL_PREFIX=$(realpath openssl)
++    substituteInPlace configure --replace 'p11kitcfdir=""' 'p11kitcfdir="'$out/share/p11-kit/modules'"'
+     substituteInPlace plugins_tools/eid-viewer/Makefile.in \
+       --replace "c_rehash" "openssl rehash"
+   '';
+   # pinentry uses hardcoded `/usr/bin/pinentry`, so use the built-in (uglier) dialogs for pinentry.
+   configureFlags = [ "--disable-pinentry" ];
+ 
+-  postPatch = ''
+-    sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
+-  '';
+-
+   postInstall =
+     let
+       eid-nssdb-in = substituteAll {