diff --git a/pkgs/applications/misc/devilspie2/default.nix b/pkgs/applications/misc/devilspie2/default.nix
index 89af855c78625..8fc86ff3a3bab 100644
--- a/pkgs/applications/misc/devilspie2/default.nix
+++ b/pkgs/applications/misc/devilspie2/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   version = "0.44";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/devilspie2/devilspie2-${version}.tar.xz";
-    sha256 = "Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/klog/default.nix b/pkgs/applications/radio/klog/default.nix
index 9ac067a418970..f4729c183ed97 100644
--- a/pkgs/applications/radio/klog/default.nix
+++ b/pkgs/applications/radio/klog/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "1.3.2";
 
   src = fetchurl {
-    url = "https://download.savannah.nongnu.org/releases/klog/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     sha256 = "1d5x7rq0mgfrqws3q1y4z8wh2qa3gvsmd0ssf2yqgkyq3fhdrb5c";
   };
 
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index ea6ee11b23b3f..731ad01042066 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -215,13 +215,19 @@
 
   # SAMBA
   samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
+    "https://download.samba.org/pub/"
+    "http://download.samba.org/pub/"
   ];
 
   # GNU Savannah
   savannah = [
-    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
+    # Try the official HTTP(S) dispatchers first.
+    # These generate redirects to mirrors appropriate for the user.
+    "https://download.savannah.gnu.org/releases/"
+    "https://download.savannah.nongnu.org/releases/"
+
+    # If the above fail, try some individual mirrors.
+    # These are taken from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
     "https://mirror.easyname.at/nongnu/"
     "https://savannah.c3sl.ufpr.br/"
     "https://mirror.csclub.uwaterloo.ca/nongnu/"
diff --git a/pkgs/by-name/cu/cuyo/package.nix b/pkgs/by-name/cu/cuyo/package.nix
index f95a9d3b5a91e..1f816b9fa00c3 100644
--- a/pkgs/by-name/cu/cuyo/package.nix
+++ b/pkgs/by-name/cu/cuyo/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   version = "2.1.0";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/cuyo/cuyo-2.1.0.tar.gz";
+    url = "mirror://savannah/cuyo/cuyo-2.1.0.tar.gz";
     sha256 = "17yqv924x7yvwix7yz9jdhgyar8lzdhqvmpvv0any8rdkajhj23c";
   };
 
diff --git a/pkgs/by-name/fa/fastjar/package.nix b/pkgs/by-name/fa/fastjar/package.nix
index c2d5f56dd08df..f7489cabea26f 100644
--- a/pkgs/by-name/fa/fastjar/package.nix
+++ b/pkgs/by-name/fa/fastjar/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchzip {
     pname = "fastjar-source";
     inherit (finalAttrs) version;
-    url = "https://download.savannah.gnu.org/releases/fastjar/fastjar-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/fastjar/fastjar-${finalAttrs.version}.tar.gz";
     hash = "sha256-8VyKNQaPLrXAy/UEm2QkBx56SSSoLdU/7w4IwrxbsQc=";
   };
 
diff --git a/pkgs/by-name/gu/guile-reader/package.nix b/pkgs/by-name/gu/guile-reader/package.nix
index 8dc4a06fe0804..ab79f2232cc33 100644
--- a/pkgs/by-name/gu/guile-reader/package.nix
+++ b/pkgs/by-name/gu/guile-reader/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.6.3";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     hash = "sha256-OMK0ROrbuMDKt42QpE7D6/9CvUEMW4SpEBjO5+tk0rs=";
   };
 
diff --git a/pkgs/by-name/m1/m17n_db/package.nix b/pkgs/by-name/m1/m17n_db/package.nix
index 4109b37a3613a..416479917efca 100644
--- a/pkgs/by-name/m1/m17n_db/package.nix
+++ b/pkgs/by-name/m1/m17n_db/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "1.8.9";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-db-${version}.tar.gz";
-    sha256 = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
+    hash = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/by-name/mi/mi2ly/package.nix b/pkgs/by-name/mi/mi2ly/package.nix
index 56fb4f5b3a877..f78d1df79a5e0 100644
--- a/pkgs/by-name/mi/mi2ly/package.nix
+++ b/pkgs/by-name/mi/mi2ly/package.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
   version = "0.12";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/mi2ly/mi2ly.${version}.tar.bz2";
-    sha256 = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
+    url = "mirror://savannah/${pname}/${pname}.${version}.tar.bz2";
+    hash = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/nm/nmh/package.nix b/pkgs/by-name/nm/nmh/package.nix
index 0eebc1cb85e02..1faefd68d6c66 100644
--- a/pkgs/by-name/nm/nmh/package.nix
+++ b/pkgs/by-name/nm/nmh/package.nix
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "New MH Mail Handling System";
     homepage = "https://nmh.nongnu.org/";
-    downloadPage = "http://download.savannah.nongnu.org/releases/nmh/";
-    changelog = "http://savannah.nongnu.org/news/?group=nmh";
+    downloadPage = "https://download.savannah.nongnu.org/releases/nmh/";
+    changelog = "https://savannah.nongnu.org/news/?group=nmh";
     license = [ lib.licenses.bsd3 ];
     longDescription = ''
       This is the nmh mail user agent (reader/sender), a command-line based
diff --git a/pkgs/by-name/sk/skribilo/package.nix b/pkgs/by-name/sk/skribilo/package.nix
index 2fe0eb835f7a9..35e715b3aece0 100644
--- a/pkgs/by-name/sk/skribilo/package.nix
+++ b/pkgs/by-name/sk/skribilo/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "0.10.0";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/skribilo/skribilo-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/skribilo/skribilo-${finalAttrs.version}.tar.gz";
     hash = "sha256-jP9I7hds7f1QMmSaNJpGlSvqUOwGcg+CnBzMopIS9Q4=";
   };
 
diff --git a/pkgs/by-name/st/storeBackup/package.nix b/pkgs/by-name/st/storeBackup/package.nix
index 8a58698c0cdfb..35610056b2a50 100644
--- a/pkgs/by-name/st/storeBackup/package.nix
+++ b/pkgs/by-name/st/storeBackup/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ];
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
+    url = "mirror://savannah/storebackup/storeBackup-${version}.tar.bz2";
     hash = "sha256-Ki1DT2zypFFiiMVd9Y8eSX7T+yr8moWMoALmAexjqWU=";
   };
 
diff --git a/pkgs/by-name/xl/xlog/package.nix b/pkgs/by-name/xl/xlog/package.nix
index 5b3d66411233e..a424c48df43f1 100644
--- a/pkgs/by-name/xl/xlog/package.nix
+++ b/pkgs/by-name/xl/xlog/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "2.0.25";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
+    hash = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
   };
 
   # glib-2.62 deprecations
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 80a6ed8b6ea72..f1b8f9b472e34 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -21,8 +21,13 @@ lib.fix (
     version = "1.3.7";
 
     src = fetchurl {
-      url = "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
-      sha256 = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
+      urls = [
+        "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz"
+
+        # for when the ${version} gets older than the last two
+        "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${version}.tar.gz"
+      ];
+      hash = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
     };
 
     patches = [
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 9e520493597b7..735e13d741426 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -192,8 +192,8 @@ buildPythonPackage rec {
       doCheck = true;
       freetype = freetype.overrideAttrs (_: {
         src = fetchurl {
-          url = "https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz";
-          sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
+          url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
+          hash = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
         };
         patches = [ ];
       });
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index cf8bc4ea0a1a9..0148e07407ba4 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   version = "1.8.4";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     hash = "sha256-xqJYLG5PKowueihE+lx+s2Oq0lOLBS8gPHEGSd1CHMg=";
   };
 
diff --git a/pkgs/tools/inputmethods/m17n-lib/otf.nix b/pkgs/tools/inputmethods/m17n-lib/otf.nix
index b92b57746e851..92dc9f5d06831 100644
--- a/pkgs/tools/inputmethods/m17n-lib/otf.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/otf.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.9.16";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     sha256 = "0sq6g3xaxw388akws6qrllp3kp2sxgk2dv4j79k6mm52rnihrnv8";
   };