diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 0357da7f37f56..a9388f6ad64ec 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -3,6 +3,7 @@
   lib,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
   rustPlatform,
   cmake,
   yq,
@@ -21,6 +22,7 @@
   nodejs,
   git,
   python3,
+  esbuild,
 }:
 
 let
@@ -28,28 +30,46 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.3.5";
+  version = "2.3.6";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-lu3r1v3iB9NIruooRrV9NawUnKqufqlYJQe+Aumgn8E=";
+    hash = "sha256-l3cWnv2cEmoeecYj38eMIlgqlRjDbtQuc6Q3DmOJoqE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XJy7+cARYEX8tAPXLHJnEwXyZIwPaqhM7ZUzoem1Wo0=";
+  cargoHash = "sha256-alvn+d7XTYrw8KXw+k+++J3CsBwAUbQQlh24/EOEzwY=";
+  cargoPatches = [
+    (fetchpatch {
+      name = "fix-sigsegv-on-x86_64-unknown-linux-gnu-targets";
+      url = "https://github.com/denoland/deno/commit/400a9565c335b51d78c8909f4dbf1dbd4fb5e5d8.patch";
+      hash = "sha256-dTIw7P6sB6Esf+lSe/gc3cX54GkzLWF5X55yxP/QYoo=";
+      includes = [ "cli/Cargo.toml" ];
+    })
+  ];
 
   patches = [
     ./tests-replace-hardcoded-paths.patch
     ./tests-darwin-differences.patch
     ./tests-no-chown.patch
   ];
-  postPatch = ''
-    # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
-    tomlq -ti '.workspace.dependencies.libffi = { "version": .workspace.dependencies.libffi, "features": ["system"] }' Cargo.toml
-  '';
+  postPatch =
+    ''
+      # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
+      tomlq -ti '.workspace.dependencies.libffi = { "version": .workspace.dependencies.libffi, "features": ["system"] }' Cargo.toml
+    ''
+    +
+      lib.optionalString
+        (stdenv.hostPlatform.isLinux || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64))
+        ''
+          # LTO crashes with the latest Rust + LLVM combination.
+          # https://github.com/rust-lang/rust/issues/141737
+          # TODO: remove this once LLVM is upgraded to 20.1.7
+          tomlq -ti '.profile.release.lto = false' Cargo.toml
+        '';
 
   buildInputs = [
     libffi
@@ -82,11 +102,42 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
   env.RUSTY_V8_ARCHIVE = librusty_v8;
 
-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Unset the env var defined by bintools-wrapper because it triggers Deno's sandbox protection in some tests.
-    # ref: https://github.com/denoland/deno/pull/25271
-    unset LD_DYLD_PATH
-  '';
+  # Many tests depend on prebuilt binaries being present at `./third_party/prebuilt`.
+  # We provide nixpkgs binaries for these for all platforms, but the test runner itself only handles
+  # these four arch+platform combinations.
+  doCheck =
+    stdenv.hostPlatform.isDarwin
+    || (stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isx86_64));
+
+  preCheck =
+    # Provide esbuild binary at `./third_party/prebuilt/` just like upstream:
+    # https://github.com/denoland/deno_third_party/tree/master/prebuilt
+    # https://github.com/denoland/deno/blob/main/tests/util/server/src/servers/npm_registry.rs#L402
+    let
+      platform =
+        if stdenv.hostPlatform.isLinux then
+          "linux64"
+        else if stdenv.hostPlatform.isDarwin then
+          "mac"
+        else
+          throw "Unsupported platform";
+      arch =
+        if stdenv.hostPlatform.isAarch64 then
+          "aarch64"
+        else if stdenv.hostPlatform.isx86_64 then
+          "x64"
+        else
+          throw "Unsupported architecture";
+    in
+    ''
+      mkdir -p ./third_party/prebuilt/${platform}
+      cp ${lib.getExe esbuild} ./third_party/prebuilt/${platform}/esbuild-${arch}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Unset the env var defined by bintools-wrapper because it triggers Deno's sandbox protection in some tests.
+      # ref: https://github.com/denoland/deno/pull/25271
+      unset LD_DYLD_PATH
+    '';
 
   cargoTestFlags = [
     "--lib" # unit tests
@@ -119,9 +170,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
       # Flaky
       "--skip=init::init_subcommand_serve"
+      "--skip=serve::deno_serve_parallel"
+      "--skip=js_unit_tests::stat_test" # timing-sensitive
+      "--skip=repl::pty_complete_imports"
+      "--skip=repl::pty_complete_expression"
 
       # Test hangs, needs investigation
       "--skip=repl::pty_complete_imports_no_panic_empty_specifier"
+
+      # Use of VSOCK, might not be available on all platforms
+      "--skip=js_unit_tests::serve_test"
+      "--skip=js_unit_tests::fetch_test"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # Expects specific shared libraries from macOS to be linked