diff --git a/pkgs/by-name/ko/koodo-reader/bump-node-abi.patch b/pkgs/by-name/ko/koodo-reader/bump-node-abi.patch
new file mode 100644
index 0000000000000..ca73761e30f91
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/bump-node-abi.patch
@@ -0,0 +1,17 @@
+diff --git a/yarn.lock b/yarn.lock
+index 83cf080..8bee81e 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -10914,9 +10914,9 @@ node-abi@^3.0.0, node-abi@^3.3.0:
+     semver "^7.3.5"
+ 
+ node-abi@^3.45.0:
+-  version "3.74.0"
+-  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.74.0.tgz#5bfb4424264eaeb91432d2adb9da23c63a301ed0"
+-  integrity sha512-c5XK0MjkGBrQPGYG24GBADZud0NCbznxNx0ZkS+ebUTrmV1qTDxPxSL8zEAPURXSbLRWVexxmP4986BziahL5w==
++  version "3.77.0"
++  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.77.0.tgz#3ad90d5c9d45663420e5aa4ff58dbf4e3625419a"
++  integrity sha512-DSmt0OEcLoK4i3NuscSbGjOf3bqiDEutejqENSplMSFA/gmB8mkED9G4pKWnPl7MDU4rSHebKPHeitpDfyH0cQ==
+   dependencies:
+     semver "^7.3.5"
+ 
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 58e24532da6c9..34f6ebf930896 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -3,54 +3,75 @@
   stdenv,
   fetchFromGitHub,
   fetchYarnDeps,
-  yarnConfigHook,
-  yarnBuildHook,
-  nodejs,
   makeDesktopItem,
+
   copyDesktopItems,
+  cctools,
   makeWrapper,
+  nodejs,
+  yarnConfigHook,
+  yarnBuildHook,
   wrapGAppsHook3,
-  electron,
+  xcbuild,
+
+  electron_37,
 }:
 
+let
+  electron = electron_37; # don't use latest electron to avoid going over the supported abi numbers
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "koodo-reader";
-  version = "1.7.4";
+  version = "2.0.9";
 
   src = fetchFromGitHub {
     owner = "troyeguo";
     repo = "koodo-reader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rLW5FS8xM7Z49AaLq0KzBCoRgAVxwTDCHQFdIaEyygA=";
+    hash = "sha256-t93yRd9TrtGZogjpSy0Bse0cM5BFyMaSxFYQFZZyvPM=";
   };
 
+  patches = [
+    ./bump-node-abi.patch
+  ];
+
   offlineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-58mxYt2wD6SGzhvo9c44CPmdX+/tLnbJCMPafo4txbY=";
+    inherit (finalAttrs) src patches;
+    hash = "sha256-gRaHVWSTBwjVcswy6DVk5yLympudbDcKkvWDry4rsvI=";
   };
 
   nativeBuildInputs = [
     makeWrapper
+    nodejs
+    (nodejs.python.withPackages (ps: [ ps.setuptools ]))
     yarnConfigHook
     yarnBuildHook
-    nodejs
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     copyDesktopItems
     wrapGAppsHook3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools
+    xcbuild
   ];
 
-  dontWrapGApps = true;
-
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on Darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   postBuild = ''
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
+
+    # we need to build cpu-features with the non-electron headers first
+    export npm_config_nodedir=${nodejs}
+    npm rebuild --verbose cpu-features
+
+    export npm_config_nodedir=${electron.headers}
+    npm run postinstall
+
+    # Explicitly set identity to null to avoid signing on darwin
     yarn --offline run electron-builder --dir \
+      -c.mac.identity=null \
       -c.electronDist=electron-dist \
       -c.electronVersion=${electron.version}
   '';
@@ -75,6 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  dontWrapGApps = true;
+
   # we use makeShellWrapper instead of the makeBinaryWrapper provided by wrapGAppsHook for proper shell variable expansion
   postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     makeShellWrapper ${lib.getExe electron} $out/bin/koodo-reader \