diff --git a/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch b/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
new file mode 100644
index 000000000000..3b6094bd02f0
--- /dev/null
+++ b/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
@@ -0,0 +1,36 @@
+From 1a914beafe2b00770213fa4d146ffad9d897dc0c Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sat, 12 Aug 2023 12:27:25 +0200
+Subject: [PATCH] Disable broken `test_help_output` testcase
+
+The assertion fails, but checking for the exact whereabouts of helptext
+doesn't bring too much value anyways, so it seems OK to just skip the
+test.
+---
+ .../tests/commands/test_attachments_to_file.py      | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/hyperkitty/tests/commands/test_attachments_to_file.py b/hyperkitty/tests/commands/test_attachments_to_file.py
+index b3e61f3a..8db7c4b2 100644
+--- a/hyperkitty/tests/commands/test_attachments_to_file.py
++++ b/hyperkitty/tests/commands/test_attachments_to_file.py
+@@ -83,16 +83,3 @@ class CommandTestCase(TestCase):
+             self.assertEqual(fp.getvalue(), """\
+ 2 attachments moved.
+ """)
+-
+-    def test_help_output(self):
+-        with io.StringIO() as fp, redirect_stdout(fp):
+-            with suppress(SystemExit):
+-                call_command('attachments_to_file', '--help')
+-
+-            output_value = fp.getvalue()
+-            assert (
+-                "HYPERKITTY_ATTACHMENT_FOLDER" in output_value
+-                and "-c CHUNK_SIZE" in output_value
+-                and "-c CHUNK_SIZE, --chunk-size CHUNK_SIZE" in output_value
+-                and "-v {0,1}, --verbosity {0,1}" in output_value
+-            )
+-- 
+2.40.1
+
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index f0cac80bb5fd..334a24b1ed00 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,36 +1,22 @@
 { lib
 , python3
 , fetchPypi
-, fetchpatch
 }:
 
 with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  # Note: Mailman core must be on the latest version before upgrading HyperKitty.
-  # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.5";
+  version = "1.3.7";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gmkiK8pIHfubbbxNdm/D6L2o722FptxYgINYdIUOn4Y=";
+    sha256 = "sha256-TXSso+wwVGdBymIzns5yOS4pj1EdConmm87b/NyBAss=";
   };
 
   patches = [
-    # FIXME: backport Python 3.10 support fix, remove for next release
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/hyperkitty/-/commit/551a44a76e46931fc5c1bcb341235d8f579820be.patch";
-      sha256 = "sha256-5XCrvyrDEqH3JryPMoOXSlVVDLQ+PdYBqwGYxkExdvk=";
-      includes = [ "hyperkitty/*" ];
-    })
-
-    # Fix for Python >=3.9.13
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/hyperkitty/-/commit/3efe7507944dbdbfcfa4c182d332528712476b28.patch";
-      sha256 = "sha256-yXuhTbmfDiYEXEsnz+zp+xLHRqI4GtkOhGHN+37W0iQ=";
-    })
+    ./0001-Disable-broken-test_help_output-testcase.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index fefffffc87c8..1e93b20f3232 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,13 +4,11 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "postorius";
-  # Note: Mailman core must be on the latest version before upgrading Postorious.
-  # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.6";
+  version = "1.3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KwzEU9IfcQ6YPZu3jPuFrd6ux/3e2pzoLfTrak/aGmg=";
+    sha256 = "sha256-1mSt+PVx3xUJDc5JwrCmKiRNIDwbsjjbM2Fi5Sgz6h8=";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index 288e48d814e4..cd18fa161fac 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -1,19 +1,23 @@
-{ python3, fetchPypi }:
+{ python3, lib, overlay ? (_: _: {}) }:
 
 python3.override {
-  packageOverrides = self: super: {
-    # does not find tests
-    alembic = super.alembic.overridePythonAttrs (oldAttrs: {
-      doCheck = false;
-    });
-    # Fixes `AssertionError: database connection isn't set to UTC`
-    psycopg2 = super.psycopg2.overridePythonAttrs (a: rec {
-      version = "2.8.6";
-      src = fetchPypi {
-        inherit version;
-        inherit (a) pname;
-        sha256 = "fb23f6c71107c37fd667cb4ea363ddeb936b348bbd6449278eb92c189699f543";
-      };
-    });
-  };
+  packageOverrides = lib.composeExtensions
+    (self: super: {
+      /*
+        This overlay can be used whenever we need to override
+        dependencies specific to the mailman ecosystem: in the past
+        this was necessary for e.g. psycopg2[1] or sqlalchemy[2].
+
+        In such a large ecosystem this sort of issue is expected
+        to arise again. Since we don't want to clutter the python package-set
+        itself with version overrides and don't want to change the APIs
+        in here back and forth every time this comes up (and as a result
+        force users to change their code accordingly), this empty overlay
+        is kept on purpose.
+
+        [1] 72a14ea563a3f5bf85db659349a533fe75a8b0ce
+        [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
+      */
+    })
+    overlay;
 }
diff --git a/pkgs/servers/mail/mailman/web.nix b/pkgs/servers/mail/mailman/web.nix
index bb50586e8d56..b63fa8c65505 100644
--- a/pkgs/servers/mail/mailman/web.nix
+++ b/pkgs/servers/mail/mailman/web.nix
@@ -6,12 +6,12 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mailman-web";
-  version = "0.0.5";
+  version = "0.0.6";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9pvs/VATAsMcGNrj58b/LifysEPTNhrAP57sfp4nX6Q=";
+    sha256 = "sha256-UWdqrcx529r6kwgf0YEHiDrpZlGoUBR6OdYtHMTPMGY=";
   };
 
   postPatch = ''