diff --git a/pkgs/by-name/ga/galleta/package.nix b/pkgs/by-name/ga/galleta/package.nix
index 9127d5293c3c..651a8eafa326 100644
--- a/pkgs/by-name/ga/galleta/package.nix
+++ b/pkgs/by-name/ga/galleta/package.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchzip
+, fetchpatch
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -12,8 +13,30 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-tc5XLToyQZutb51ZoBlGWXDpsSqdJ89bjzJwY8kRncA=";
   };
 
+  patches = [
+    # fix some GCC warnings.
+    (fetchpatch {
+      url = "https://salsa.debian.org/pkg-security-team/galleta/-/raw/998470d8151b2f3a4bec71ae340c30f252d03a9b/debian/patches/10_fix-gcc-warnings.patch";
+      hash = "sha256-b8VJGSAoSnWteyUbC2Ue3tqkpho7gyn+E/yrN2O3G9c=";
+    })
+    # make Makefile compliant with Debian and add GCC hardening.
+    (fetchpatch {
+      url = "https://salsa.debian.org/pkg-security-team/galleta/-/raw/553c237a34995d9f7fc0383ee547d4f5cd004d5b/debian/patches/20_fix-makefile.patch";
+      hash = "sha256-+rnoTrlXtWl9zmZlkvqbJ+YlIXFCpKOqvxIkN8xxtsg=";
+    })
+    # Fix cross compilation.
+    # Galleta fails to cross build from source, because the upstream
+    # Makefile hard codes the build architecture compiler. The patch
+    # makes the compiler substitutable and galleta cross buildable.
+    (fetchpatch {
+      url = "https://salsa.debian.org/pkg-security-team/galleta/-/raw/f0f51a5a9e5adc0279f78872461fa57ee90d6842/debian/patches/30-fix-FTBS-cross-compilation.patch";
+      hash = "sha256-ZwymEVJy7KvLFvNOcVZqDtJPxEcpQBVg+u+G+kSDZBo=";
+    })
+  ];
+
   makeFlags = [
     "-C src"
+    "CC=cc"
   ];
 
   enableParallelBuilding = true;
@@ -21,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
-    cp bin/galleta $out/bin
+    cp src/galleta $out/bin
     runHook postInstall
   '';