diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 6b389a379d68..a54433b92c93 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -1,32 +1,46 @@
-{ stdenv, fetchFromGitLab, lib, darwin
-, git, nettle, llvmPackages, cargo, rustc
-, rustPlatform, pkgconfig, glib
-, openssl, sqlite, capnproto
-, ensureNewerSourcesForZipFilesHook, pythonSupport ? true, pythonPackages ? null
+{ stdenv
+, fetchFromGitLab
+, lib
+, darwin
+, git
+, nettle
+# Use the same llvmPackages version as Rust
+, llvmPackages_10
+, cargo
+, rustc
+, rustPlatform
+, pkg-config
+, glib
+, openssl
+, sqlite
+, capnproto
+, ensureNewerSourcesForZipFilesHook
+, pythonSupport ? true
+, pythonPackages ? null
 }:
 
 assert pythonSupport -> pythonPackages != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
-    repo = pname;
+    repo = "sequoia";
     rev = "v${version}";
-    sha256 = "18acv0185y51yz6jwchi1vf701shz37z5qmnzpq6z419lpjdaskd";
+    sha256 = "1870wd03c3x0da9p3jmkvfx8am87ak0dcsvp2qkjvglbl396kd8y";
   };
 
-  cargoSha256 = "1jazwpv5mrsd0hxfavk0lvq8n26iglzl8pggw311ysi0lwabjq0y";
+  cargoSha256 = "0bb51vdppdjhsxbfy3lyqvw5r5j58r3wi0qb68m2a45k3za7liss";
 
   nativeBuildInputs = [
-    pkgconfig
+    pkg-config
     cargo
     rustc
     git
-    llvmPackages.libclang
-    llvmPackages.clang
+    llvmPackages_10.libclang
+    llvmPackages_10.clang
     ensureNewerSourcesForZipFilesHook
     capnproto
   ] ++
@@ -54,27 +68,24 @@ rustPlatform.buildRustPackage rec {
     "build-release"
   ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages_10.libclang}/lib";
 
-  # Please check if this is still needed when updating.
-  # Exlude tests for sequoia-store, they often error with 'Too many open files' Hydra.
-  CARGO_TEST_ARGS = " --all --exclude sequoia-store";
+  # Sometimes, tests fail on CI (ofborg) & hydra without this
+  CARGO_TEST_ARGS = "--workspace --exclude sequoia-store";
 
+  # Without this, the examples won't build
   postPatch = ''
-    # otherwise, the check fails because we delete the `.git` in the unpack phase
-    substituteInPlace openpgp-ffi/Makefile \
-      --replace 'git grep' 'grep -R'
-    # Without this, the check fails
     substituteInPlace openpgp-ffi/examples/Makefile \
       --replace '-O0 -g -Wall -Werror' '-g'
     substituteInPlace ffi/examples/Makefile \
       --replace '-O0 -g -Wall -Werror' '-g'
   '';
 
+
   preInstall = lib.optionalString pythonSupport ''
     export installFlags="PYTHONPATH=$PYTHONPATH:$out/${pythonPackages.python.sitePackages}"
   '' + lib.optionalString (!pythonSupport) ''
-    export installFlags="PYTHON=disable"
+    export makeFlags="PYTHON=disable"
   '';
 
   # Don't use buildRustPackage phases, only use it for rust deps setup