diff --git a/changelog.d/5-internal/pr-3194 b/changelog.d/5-internal/pr-3194
new file mode 100644
index 0000000000..a173e3b04d
--- /dev/null
+++ b/changelog.d/5-internal/pr-3194
@@ -0,0 +1 @@
+Updated rusty-jwt-tools to version 0.3.4
diff --git a/nix/pkgs/rusty_jwt_tools_ffi/default.nix b/nix/pkgs/rusty_jwt_tools_ffi/default.nix
index fad8264b7f..7bb8570965 100644
--- a/nix/pkgs/rusty_jwt_tools_ffi/default.nix
+++ b/nix/pkgs/rusty_jwt_tools_ffi/default.nix
@@ -6,20 +6,34 @@
 , gitMinimal
 }:
 
-rustPlatform.buildRustPackage rec {
-  name = "rusty_jwt-tools_ffi-${version}";
-  version = "0.2.0";
-  nativeBuildInputs = [ pkg-config perl gitMinimal ];
+let
+  version = "0.3.4";
   src = fetchFromGitHub {
     owner = "wireapp";
     repo = "rusty-jwt-tools";
-    # https://github.com/wireapp/rusty-jwt-tools/pull/52
-    rev = "2d947e3a62d58ea5a3f0c36a6ba0a28d56bd4ba6";
-    sha256 = "sha256-bADW6u4v86M6WwAIfMmXbHfTiAZEAmFxLxO2izj4xV8=";
+    rev = "v${version}";
+    sha256 = "sha256-awfpyMmDGWLViKI8Pr/BjbfnmFKo4JAcUB0+o6/prOA=";
   };
-  doCheck = false;
-  cargoSha256 = "sha256-JdNBBzRrTlTno0PWf2B0TpltdQt4YqF2KRI/WghGsl4=";
-  cargoDepsHook = ''
-    mkdir -p rusty_jwt-tools_ffi-${version}-vendor.tar.gz/ring/.git
+  cargoLockFile = builtins.toFile "cargo.lock" (builtins.readFile "${src}/ffi/Cargo.lock");
+
+in
+rustPlatform.buildRustPackage {
+  name = "rusty_jwt-tools_ffi-${version}";
+  inherit version src;
+
+  cargoLock = {
+    lockFile = cargoLockFile;
+    outputHashes = {
+      # if any of these need updating, replace / create new key with
+      # lib.fakeSha256, rebuild, and replace with actual hash.
+      "biscuit-0.6.0-beta1" = "sha256-j8Pxi2nHgsKz6umroYjwR8sr1xLQAaWdnej5U9+L5ko=";
+      "jwt-simple-0.11.3" = "sha256-kVBTXYtBW9SE6F6nmH71iVc0KKxvpX/axCvMAP1cZvY=";
+      "ring-0.17.0-not-released-yet" = "sha256-9M4lR68r8phscSFw9Xh+CVHnOkilDI0brAdU0tW3xaA=";
+    };
+  };
+
+  postPatch = ''
+    cp ${cargoLockFile} Cargo.lock
   '';
+  doCheck = false;
 }