diff --git a/pkgs/development/libraries/libwebsockets/default.nix b/pkgs/development/libraries/libwebsockets/default.nix
index faf6acd40b922f..e0ee94faf0d485 100644
--- a/pkgs/development/libraries/libwebsockets/default.nix
+++ b/pkgs/development/libraries/libwebsockets/default.nix
@@ -5,12 +5,13 @@
 , openssl
 , zlib
 , libuv
+, fetchpatch
 # External poll is required for e.g. mosquitto, but discouraged by the maintainer.
 , withExternalPoll ? false
 }:
 
 let
-  generic = { version, sha256 }: stdenv.mkDerivation rec {
+  generic = { version, sha256, patches ? [] }: stdenv.mkDerivation rec {
     pname = "libwebsockets";
     inherit version;
 
@@ -21,6 +22,8 @@ let
       inherit sha256;
     };
 
+    inherit patches;
+
     buildInputs = [ openssl zlib libuv ];
 
     nativeBuildInputs = [ cmake ];
@@ -76,7 +79,15 @@ in {
   };
 
   libwebsockets_4_3 = generic {
-    version = "4.3.0";
-    sha256 = "13lxb487mqlzbsbv6fbj50r1717mfwdy87ps592lgfy3307yqpr4";
+    version = "4.3.1";
+    sha256 = "sha256-lB3JHh058cQc5rycLnHk3JAOgtku0nRCixN5U6lPKq8=";
+    patches = [
+      # fixes the propagated cmake files, fixing the build of ttyd
+      # see also https://github.com/tsl0922/ttyd/issues/918
+      (fetchpatch {
+        url = "https://github.com/warmcat/libwebsockets/commit/99a8b9c4422bed45c8b7412a1e121056f2a6132a.patch";
+        hash = "sha256-zHBo2ZEayvibM+jzeVaZqySxghaOLUglpSFwuGhl6HM=";
+      })
+    ];
   };
 }