diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 9d9c21cc690d..e1710813db80 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     #  https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
     #  https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
     ./gcc-13-esr.patch
-  ] ++ lib.optionals (lib.versionAtLeast version "3.90") [
+  ] ++ lib.optionals (lib.versionAtLeast version "3.90" && lib.versionOlder version "3.91") [
     # https://bugzilla.mozilla.org/show_bug.cgi?id=1836925
     # https://phabricator.services.mozilla.com/D180068
     ./remove-c25519-support.patch
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 9434ccf1b3e9..4be20ad1ff77 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.90";
-  hash = "sha256-ms1lNMQdjq0Z/Kb8s//+0vnwnEN8PXn+5qTuZoqqk7Y=";
+  version = "3.91";
+  hash = "sha256-hL1GN23xcRjFX21z0w/ZOgryEpbGbnaQRxVH5YmPxLM=";
 }