diff --git a/pkgs/by-name/os/ostree/fix-1592.patch b/pkgs/by-name/os/ostree/fix-1592.patch
new file mode 100644
index 0000000000000..ddc0b2b7e096a
--- /dev/null
+++ b/pkgs/by-name/os/ostree/fix-1592.patch
@@ -0,0 +1,151 @@
+diff --git a/tests/basic-test.sh b/tests/basic-test.sh
+index c8f853f8..a58ad3de 100644
+--- a/tests/basic-test.sh
++++ b/tests/basic-test.sh
+@@ -242,7 +242,7 @@ cd ${test_tmpdir}
+ if $OSTREE commit ${COMMIT_ARGS} -b test-bootable --bootable $test_tmpdir/checkout-test2-4 2>err.txt; then
+     fatal "committed non-bootable tree"
+ fi
+-assert_file_has_content err.txt "error: .*No such file or directory"
++assert_file_has_content err.txt "error:.*No such file or directory"
+ echo "ok commit fails bootable if no kernel"
+ 
+ cd ${test_tmpdir}
+diff --git a/tests/pull-test.sh b/tests/pull-test.sh
+index d61735a0..9e751d82 100644
+--- a/tests/pull-test.sh
++++ b/tests/pull-test.sh
+@@ -297,7 +297,7 @@ ostree_repo_init mirrorrepo-local --mode=archive
+ if ${CMD_PREFIX} ostree --repo=mirrorrepo-local pull-local otherrepo 2>err.txt; then
+     fatal "pull with mixed refs succeeded?"
+ fi
+-assert_file_has_content err.txt "error: Invalid ref name origin:main"
++assert_file_has_content err.txt "Invalid ref name origin:main"
+ ${CMD_PREFIX} ostree --repo=mirrorrepo-local pull-local otherrepo localbranch
+ ${CMD_PREFIX} ostree --repo=mirrorrepo-local rev-parse localbranch
+ ${CMD_PREFIX} ostree --repo=mirrorrepo-local fsck
+@@ -308,7 +308,7 @@ if ${CMD_PREFIX} ostree --repo=mirrorrepo-local pull-local otherrepo nosuchbranc
+     fatal "pulled nonexistent branch"
+ fi
+ # So true
+-assert_file_has_content_literal err.txt "error: Refspec 'nosuchbranch' not found"
++assert_file_has_content_literal err.txt "Refspec 'nosuchbranch' not found"
+ echo "ok pull-local nonexistent branch"
+ 
+ cd ${test_tmpdir}
+@@ -687,5 +687,5 @@ rm ostree-srv/gnomerepo/summary
+ if ${CMD_PREFIX} ostree --repo=repo pull origin main 2>err.txt; then
+     fatal "pull of invalid ref succeeded"
+ fi
+-assert_file_has_content_literal err.txt 'error: Fetching checksum for ref ((empty), main): Invalid rev lots of html here  lots of html here  lots of html here  lots of'
++assert_file_has_content_literal err.txt 'Fetching checksum for ref ((empty), main): Invalid rev lots of html here  lots of html here  lots of html here  lots of'
+ echo "ok pull got HTML for a ref"
+diff --git a/tests/test-config.sh b/tests/test-config.sh
+index 2d9aaf53..f1e28614 100755
+--- a/tests/test-config.sh
++++ b/tests/test-config.sh
+@@ -44,7 +44,7 @@ assert_file_has_content list.txt "http://example\.com/ostree/repo/"
+ if ${CMD_PREFIX} ostree config --repo=repo get --group=core lock-timeout-secs extra 2>err.txt; then
+     assert_not_reached "ostree config get should error out if too many arguments are given"
+ fi
+-assert_file_has_content err.txt "error: Too many arguments given"
++assert_file_has_content err.txt "Too many arguments given"
+ echo "ok config get"
+ 
+ ${CMD_PREFIX} ostree config --repo=repo set core.mode bare-user-only
+@@ -61,7 +61,7 @@ assert_file_has_content repo/config "http://example\.com/ostree/"
+ if ${CMD_PREFIX} ostree config --repo=repo set --group=core lock-timeout-secs 120 extra 2>err.txt; then
+     assert_not_reached "ostree config set should error out if too many arguments are given"
+ fi
+-assert_file_has_content err.txt "error: Too many arguments given"
++assert_file_has_content err.txt "Too many arguments given"
+ echo "ok config set"
+ 
+ # Check that using `--` works and that "ostree config unset" works
+@@ -78,7 +78,7 @@ if ${CMD_PREFIX} ostree config --repo=repo get core.lock-timeout-secs 2>err.txt;
+ fi
+ # Check for any character where quotation marks would be as they appear differently in the Fedora and Debian
+ # test suites (“” and '' respectively). See: https://github.com/ostreedev/ostree/pull/1839
+-assert_file_has_content err.txt "error: Key file does not have key .lock-timeout-secs. in group .core."
++assert_file_has_content err.txt "Key file does not have key .lock-timeout-secs. in group .core."
+ 
+ # Check that it's idempotent
+ ${CMD_PREFIX} ostree config --repo=repo unset core.lock-timeout-secs
+@@ -95,5 +95,5 @@ ${CMD_PREFIX} ostree config --repo=repo unset --group='remote "aoeuhtns"' 'xa.ti
+ if ${CMD_PREFIX} ostree config --repo=repo unset core.lock-timeout-secs extra 2>err.txt; then
+     assert_not_reached "ostree config unset should error out if too many arguments are given"
+ fi
+-assert_file_has_content err.txt "error: Too many arguments given"
++assert_file_has_content err.txt "Too many arguments given"
+ echo "ok config unset"
+diff --git a/tests/test-fsck-collections.sh b/tests/test-fsck-collections.sh
+index 3dbcdd23..d6359979 100755
+--- a/tests/test-fsck-collections.sh
++++ b/tests/test-fsck-collections.sh
+@@ -98,7 +98,7 @@ ${CMD_PREFIX} ostree fsck --repo=repo
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-bindings > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Commit has no requested ref ‘new-ref’ in ref binding metadata (‘ref1’)"
++assert_file_has_content fsck-error "Commit has no requested ref .new-ref. in ref binding metadata (.ref1.)"
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ 
+ echo "ok 3 fsck detects missing ref bindings"
+@@ -111,7 +111,7 @@ ${CMD_PREFIX} ostree --repo=repo refs --collections --create=org.example.Collect
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-bindings > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Commit has no requested ref ‘new-ref’ in ref binding metadata (‘ref1’)"
++assert_file_has_content fsck-error "Commit has no requested ref .new-ref. in ref binding metadata (.ref1.)"
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ assert_file_has_content fsck "^Validating refs in collections\.\.\.$"
+ 
+@@ -125,7 +125,7 @@ ${CMD_PREFIX} ostree --repo=repo refs --collections --create=org.example.Collect
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-bindings > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Commit has collection ID ‘org\.example\.Collection’ in collection binding metadata, while the remote it came from has collection ID ‘org\.example\.Collection2’"
++assert_file_has_content fsck-error "Commit has collection ID .org\.example\.Collection. in collection binding metadata, while the remote it came from has collection ID .org\.example\.Collection2."
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ assert_file_has_content fsck "^Validating refs in collections\.\.\.$"
+ 
+@@ -145,7 +145,7 @@ echo "ok 6 fsck ignores unreferenced ref bindings"
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-back-refs > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Collection–ref (org\.example\.Collection, ref1) in bindings for commit .* does not exist"
++assert_file_has_content fsck-error 'Collection.ref (org\.example\.Collection, ref1) in bindings for commit .* does not exist'
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ assert_file_has_content fsck "^Validating refs in collections\.\.\.$"
+ 
+@@ -184,7 +184,7 @@ ${CMD_PREFIX} ostree --repo=repo refs --create=new-ref $(cat ref3-checksum)
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-bindings > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Commit has no requested ref ‘new-ref’ in ref binding metadata (‘ref3’, ‘ref4’)"
++assert_file_has_content fsck-error "Commit has no requested ref .new-ref. in ref binding metadata (.ref3., .ref4.)"
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ 
+ echo "ok 9 fsck detects missing ref bindings"
+@@ -203,7 +203,7 @@ echo "ok 10 fsck ignores unreferenced ref bindings"
+ if ${CMD_PREFIX} ostree fsck --repo=repo --verify-back-refs > fsck 2> fsck-error; then
+     assert_not_reached "fsck unexpectedly succeeded after adding unbound ref!"
+ fi
+-assert_file_has_content fsck-error "Ref ‘ref3’ in bindings for commit .* does not exist"
++assert_file_has_content fsck-error 'Ref .ref3. in bindings for commit .* does not exist'
+ assert_file_has_content fsck "^Validating refs\.\.\.$"
+ 
+ echo "ok 11 fsck ignores unreferenced ref bindings"
+diff --git a/tests/test-remote-add.sh b/tests/test-remote-add.sh
+index 2f5ea634..0f63853c 100755
+--- a/tests/test-remote-add.sh
++++ b/tests/test-remote-add.sh
+@@ -81,7 +81,7 @@ echo "ok remote delete"
+ if $OSTREE remote delete nosuchremote 2>err.txt; then
+     assert_not_reached "Deleting remote unexpectedly succeeded"
+ fi
+-assert_file_has_content err.txt "error: "
++assert_file_has_content err.txt "not found"
+ 
+ $OSTREE remote delete --if-exists nosuchremote
+ echo "ok"
diff --git a/pkgs/by-name/os/ostree/fix-test-paths.patch b/pkgs/by-name/os/ostree/fix-test-paths.patch
new file mode 100644
index 0000000000000..2cc06e9f5bc3b
--- /dev/null
+++ b/pkgs/by-name/os/ostree/fix-test-paths.patch
@@ -0,0 +1,55 @@
+diff --git a/tests/libtest.sh b/tests/libtest.sh
+index 2c2a33f0..4e9d3fa2 100755
+--- a/tests/libtest.sh
++++ b/tests/libtest.sh
+@@ -761,12 +761,12 @@ gen_ed25519_keys ()
+ {
+   # Generate private key in PEM format
+   pemfile="$(mktemp -p ${test_tmpdir} ed25519_XXXXXX.pem)"
+-  openssl genpkey -algorithm ed25519 -outform PEM -out "${pemfile}"
++  @openssl@ genpkey -algorithm ed25519 -outform PEM -out "${pemfile}"
+ 
+   # Based on: http://openssl.6102.n7.nabble.com/ed25519-key-generation-td73907.html
+   # Extract the private and public parts from generated key.
+-  ED25519PUBLIC="$(openssl pkey -outform DER -pubout -in ${pemfile} | tail -c 32 | base64)"
+-  ED25519SEED="$(openssl pkey -outform DER -in ${pemfile} | tail -c 32 | base64)"
++  ED25519PUBLIC="$(@openssl@ pkey -outform DER -pubout -in ${pemfile} | tail -c 32 | base64)"
++  ED25519SEED="$(@openssl@ pkey -outform DER -in ${pemfile} | tail -c 32 | base64)"
+   # Secret key is concantination of SEED and PUBLIC
+   ED25519SECRET="$(echo ${ED25519SEED}${ED25519PUBLIC} | base64 -d | base64 -w 0)"
+ 
+@@ -777,7 +777,7 @@ gen_ed25519_keys ()
+ 
+ gen_ed25519_random_public()
+ {
+-  openssl genpkey -algorithm ED25519 | openssl pkey -outform DER | tail -c 32 | base64
++  @openssl@ genpkey -algorithm ED25519 | @openssl@ pkey -outform DER | tail -c 32 | base64
+ }
+ 
+ is_bare_user_only_repo () {
+diff --git a/tests/test-basic-user-only.sh b/tests/test-basic-user-only.sh
+index f6e8606d..1fed2465 100755
+--- a/tests/test-basic-user-only.sh
++++ b/tests/test-basic-user-only.sh
+@@ -27,7 +27,7 @@ extra_basic_tests=7
+ . $(dirname $0)/basic-test.sh
+ 
+ $CMD_PREFIX ostree --version > version.yaml
+-python3 -c 'import yaml; yaml.safe_load(open("version.yaml"))'
++@python3@ -c 'import yaml; yaml.safe_load(open("version.yaml"))'
+ echo "ok yaml version"
+ 
+ # Reset things so we don't inherit a lot of state from earlier tests
+diff --git a/tests/test-remote-headers.sh b/tests/test-remote-headers.sh
+index d3bf4f97..0d2331ba 100755
+--- a/tests/test-remote-headers.sh
++++ b/tests/test-remote-headers.sh
+@@ -24,7 +24,7 @@ echo '1..2'
+ . $(dirname $0)/libtest.sh
+ 
+ V=$($CMD_PREFIX ostree --version | \
+-  python3 -c 'import sys, yaml; print(yaml.safe_load(sys.stdin)["libostree"]["Version"])')
++  @python3@ -c 'import sys, yaml; print(yaml.safe_load(sys.stdin)["libostree"]["Version"])')
+ 
+ setup_fake_remote_repo1 "archive" "" \
+   --expected-header foo=bar \
diff --git a/pkgs/by-name/os/ostree/package.nix b/pkgs/by-name/os/ostree/package.nix
index 7164d36566708..86bcedcd8731d 100644
--- a/pkgs/by-name/os/ostree/package.nix
+++ b/pkgs/by-name/os/ostree/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  fetchpatch,
   pkg-config,
   gtk-doc,
   nixosTests,
@@ -11,8 +10,7 @@
   glib,
   xz,
   e2fsprogs,
-  libsoup_2_4,
-  wrapGAppsNoGuiHook,
+  libsoup_3,
   gpgme,
   which,
   makeWrapper,
@@ -36,14 +34,15 @@
   composefs,
   withGjs ? lib.meta.availableOn stdenv.hostPlatform gjs,
   gjs,
-  withGlibNetworking ? lib.meta.availableOn stdenv.hostPlatform glib-networking,
-  glib-networking,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   gobject-introspection,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
+  replaceVars,
+  openssl,
+  ostree-full,
 }:
 
 let
@@ -53,9 +52,9 @@ let
     ]
   );
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ostree";
-  version = "2024.10";
+  version = "2025.2";
 
   outputs = [
     "out"
@@ -65,15 +64,19 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "https://github.com/ostreedev/ostree/releases/download/v${version}/libostree-${version}.tar.xz";
-    sha256 = "sha256-VOM4fe4f8WAxoGeayitg2pCrf0omwhGCIzPH8jAAq+4=";
+    url = "https://github.com/ostreedev/ostree/releases/download/v${finalAttrs.version}/libostree-${finalAttrs.version}.tar.xz";
+    hash = "sha256-8kSkCMkJmYp3jhJ/zCLBtQK00BPxXyaUj0fMcv/i7vQ=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "static-pkg-config.patch";
-      url = "https://github.com/ostreedev/ostree/pull/3382.patch";
-      hash = "sha256-VCQLq4OqmojtB7WFHNNV82asgXPGq5tKoJun66eUntY=";
+    # Workarounds for installed tests failing in pseudoterminal
+    # https://github.com/ostreedev/ostree/issues/1592
+    ./fix-1592.patch
+
+    # Hard-code paths in installed tests
+    (replaceVars ./fix-test-paths.patch {
+      python3 = testPython.interpreter;
+      openssl = "${openssl}/bin/openssl";
     })
   ];
 
@@ -91,7 +94,6 @@ stdenv.mkDerivation rec {
       libxslt
       docbook-xsl-nons
       docbook_xml_dtd_42
-      wrapGAppsNoGuiHook
     ]
     ++ lib.optionals withIntrospection [
       gobject-introspection
@@ -102,7 +104,7 @@ stdenv.mkDerivation rec {
       curl
       glib
       e2fsprogs
-      libsoup_2_4
+      libsoup_3 # for trivial-httpd for tests
       gpgme
       fuse3
       libselinux
@@ -122,9 +124,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withGjs [
       gjs
     ]
-    ++ lib.optionals withGlibNetworking [
-      glib-networking
-    ]
     ++ lib.optionals withSystemd [
       systemd
     ];
@@ -160,7 +159,7 @@ stdenv.mkDerivation rec {
     let
       typelibPath = lib.makeSearchPath "/lib/girepository-1.0" [
         (placeholder "out")
-        gobject-introspection
+        glib.out
       ];
     in
     lib.optionalString withIntrospection ''
@@ -173,6 +172,7 @@ stdenv.mkDerivation rec {
     tests = {
       musl = pkgsCross.musl64.ostree;
       installedTests = nixosTests.installed-tests.ostree;
+      inherit ostree-full;
     };
   };
 
@@ -183,4 +183,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
   };
-}
+})