{ final, prev, flakeInputs, ... }:
{
  keepassxc = final.stdenv.mkDerivation (finalAttrs: {
    pname = "keepassxc";
    version = "2.8.0-beta1";

    src = final.fetchFromGitHub {
      owner = "keepassxreboot";
      repo = "keepassxc";
      tag = finalAttrs.version;
      hash = "sha256-fksThYmGZed66zxGDxlS2SHQzJYRf+T9AuZPbaNZV5Y=";
    };

    env =
      final.lib.optionalAttrs final.stdenv.cc.isClang {
        NIX_CFLAGS_COMPILE = toString [
          "-Wno-old-style-cast"
          "-Wno-error"
          "-D__BIG_ENDIAN__=${if final.stdenv.hostPlatform.isBigEndian then "1" else "0"}"
        ];
      };

    # Upstream develops against a build of PCSC from Xcode.
    # The types are incompatible with nixpkgs pcsclite.
    # https://github.com/NixOS/nixpkgs/issues/520227
    postPatch = ''
      substituteInPlace src/keys/drivers/YubiKeyInterfacePCSC.cpp \
        --replace-fail "typedef uint32_t RETVAL;" "typedef int32_t RETVAL;"
    '';

    cmakeFlags = [
      (final.lib.cmakeFeature "KEEPASSXC_BUILD_TYPE" "Release")
      (final.lib.cmakeBool "WITH_GUI_TESTS" true)
      (final.lib.cmakeBool "WITH_XC_UPDATECHECK" false)
      (final.lib.cmakeBool "WITH_XC_X11" false)
      (final.lib.cmakeBool "WITH_XC_BROWSER" true)
      (final.lib.cmakeBool "WITH_XC_BROWSER_PASSKEYS" true)
      (final.lib.cmakeBool "WITH_XC_KEESHARE" true)
      (final.lib.cmakeBool "WITH_XC_NETWORKING" true)
      (final.lib.cmakeBool "WITH_XC_SSHAGENT" true)
      (final.lib.cmakeBool "WITH_XC_FDOSECRETS" true)
      (final.lib.cmakeBool "WITH_XC_YUBIKEY" true)
    ];

    doCheck = true;
    checkPhase =
      let
        disabledTests = final.lib.concatStringsSep "|" (
          [
            # flaky
            "testcli"
            "testgui"
          ]
        );
      in
      ''
        runHook preCheck

        export LC_ALL="en_US.UTF-8"
        export QT_QPA_PLATFORM=offscreen
        export QT_PLUGIN_PATH="${final.qt6.qtbase}/${final.qt6.qtbase.qtPluginPrefix}"

        make test ARGS+="-E '${disabledTests}' --output-on-failure"

        runHook postCheck
      '';

    nativeBuildInputs = with final; [
      asciidoctor
      cmake
      qt6.wrapQtAppsHook
      qt6.qttools
      pkg-config
      wrapGAppsHook3
    ];

    dontWrapGApps = true;
    preFixup = ''
      qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
    '';

    postInstall = final.lib.concatLines [
      # See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/src/browser/NativeMessageInstaller.cpp#L317
      # See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/utils/keepassxc-snap-helper.sh#L48-L58
      ''
        mkdir -p "$out/lib/mozilla/native-messaging-hosts"
        substituteAll "${toString (flakeInputs.nixpkgs) + "/pkgs/by-name/ke/keepassxc/firefox-native-messaging-host.json"}" "$out/lib/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"

        mkdir -p "$out/etc/chromium/native-messaging-hosts"
        substituteAll "${toString (flakeInputs.nixpkgs) + "/pkgs/by-name/ke/keepassxc/chromium-native-messaging-host.json"}" "$out/etc/chromium/native-messaging-hosts/org.keepassxc.keepassxc_browser.json"
      ''
    ];

    buildInputs = with final; [
      botan3
      curl
      libxi
      libxtst
      libargon2
      qt6.qtbase
      qt6.qtsvg
      minizip
      pcsclite
      qrencode
      readline
      zlib
      libusb1
      keyutils
    ];
  });
}