diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index 935838a5d60a..3d35b4d07750 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -8,7 +8,9 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "nitrokey-app2";
   version = "2.1.2";
-  format = "flit";
+  pyproject = true;
+
+  disabled = python3.pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Nitrokey";
@@ -17,11 +19,22 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-VyhIFNXxH/FohgjhBeZXoQYppP7PEz+ei0qzsWz1xhk=";
   };
 
+  # https://github.com/Nitrokey/nitrokey-app2/issues/152
+  #
+  # pythonRelaxDepsHook does not work here, because it runs in postBuild and
+  # only modifies the dependencies in the built distribution.
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace "pynitrokey ==" "pynitrokey >="
+  '';
+
+  # The pyproject.toml file seems to be incomplete and does not generate
+  # resources (i.e. run pyrcc5 and pyuic5) but the Makefile does.
   preBuild = ''
     make build-ui
   '';
 
   nativeBuildInputs = with python3.pkgs; [
+    flit-core
     pyqt5
     wrapQtAppsHook
   ];
@@ -41,9 +54,14 @@ python3.pkgs.buildPythonApplication rec {
       --set-default CRYPTOGRAPHY_OPENSSL_NO_LEGACY 1
   '';
 
+  pythonImportsCheck = [
+    "nitrokeyapp"
+  ];
+
   meta = with lib; {
     description = "This application allows to manage Nitrokey 3 devices";
     homepage = "https://github.com/Nitrokey/nitrokey-app2";
+    changelog = "https://github.com/Nitrokey/nitrokey-app2/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ _999eagle ];
     mainProgram = "nitrokeyapp";