diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index ec8f3ac259d3..d7722df1ee37 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -112,6 +112,8 @@
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
+- `amtterm` has been updated to 1.8. `amtterm` and `amtider` now connect with TLS on port 16995 by default, and verify the certificate only when given `-C <cacert>`. Use `-P` to connect without TLS on port 16994 as before, for AMT that doesn't have TLS configured. AMT accepts only TLS from CSME 16.1 on. `amttool` no longer verifies certificates for HTTPS connections.
+
 - The existing `wasm32-wasi` target has become `wasm32-wasip1` and `pkgsCross.wasi32` has become `pkgsCross.wasm32-wasip1`, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).
 
 - `sing-box` has been updated to 1.14.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/migration/) for details and migration options.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f959b8e8f6b2..92caec80f7f6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14926,6 +14926,12 @@
     github = "Kalitsune";
     githubId = 74075397;
   };
+  kallisti-dev = {
+    email = "kallisti.dev@gmail.com";
+    github = "kallisti-dev";
+    githubId = 1530244;
+    name = "Adam Curtis";
+  };
   kamadorueda = {
     name = "Kevin Amado";
     email = "kamadorueda@gmail.com";
diff --git a/pkgs/by-name/am/amtterm/package.nix b/pkgs/by-name/am/amtterm/package.nix
index dd3b15d92bf7..8801261e714b 100644
--- a/pkgs/by-name/am/amtterm/package.nix
+++ b/pkgs/by-name/am/amtterm/package.nix
@@ -1,10 +1,14 @@
 {
-  fetchFromGitHub,
+  fetchFromGitLab,
+  fetchpatch,
   lib,
   stdenv,
   makeWrapper,
+  glib,
+  gnutls,
   gtk3,
-  openssl,
+  meson,
+  ninja,
   perl,
   perlPackages,
   pkg-config,
@@ -14,14 +18,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "amtterm";
-  version = "1.7-1-unstable-2023-10-27";
+  version = "1.8";
 
   buildInputs =
     (with perlPackages; [
       perl
       SOAPLite
     ])
-    ++ [ openssl ]
+    ++ [
+      glib
+      gnutls
+    ]
 
     ++ lib.optionals withGamt [
       gtk3
@@ -29,28 +36,46 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   nativeBuildInputs = [
     makeWrapper
+    meson
+    ninja
     pkg-config
   ];
 
-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
     owner = "kraxel";
     repo = "amtterm";
-    rev = "ed5da502cbb150982ad982211ad9475414b8689a";
-    hash = "sha256-JwS2agmJJ6VcGLkNbkFRb5bzKV8el1DMDjalmLnOdE8=";
+    tag = "amtterm-${finalAttrs.version}-1";
+    hash = "sha256-RedbapQgbtAeUmrz8hwuKeFusl/ePSspOjZxW8XYaag=";
   };
 
-  makeFlags = [
-    "prefix=$(out)"
-    "STRIP="
-    "USE_OPENSSL=1"
+  patches = [
+    # In 1.8, plaintext connections fail and gamt ignores -C.
+    # https://gitlab.com/kraxel/amtterm/-/merge_requests/3
+    (fetchpatch {
+      name = "redir-set-connect-error-before-reporting.patch";
+      url = "https://gitlab.com/kraxel/amtterm/-/commit/5b79b25a7933ee4b770b892393f695d31cdaa44d.patch";
+      hash = "sha256-yJfwJoZPs/NDoETKd032XtozuVyi2+YETRVwmYNRWos=";
+    })
+    (fetchpatch {
+      name = "redir-fix-non-ssl-connections.patch";
+      url = "https://gitlab.com/kraxel/amtterm/-/commit/649f0654c598b2e8075a3b9f815fa693f4a171fe.patch";
+      hash = "sha256-4GRaSyBVAK2ETM8cz5VaXKWcpzNAVctK9PNDJ1OhxAI=";
+    })
+    (fetchpatch {
+      name = "gamt-use-ssl-when-c-is-given.patch";
+      url = "https://gitlab.com/kraxel/amtterm/-/commit/ec2ce0fad989b828c0529b0298d15745987a1092.patch";
+      hash = "sha256-NUbaZhi8KqC9CIPwN2GaBZhzz9GCxPKBB2jQT+wz6g8=";
+    })
   ];
 
   postInstall = "wrapProgram $out/bin/amttool --prefix PERL5LIB : $PERL5LIB";
 
   meta = {
     description = "Intel AMT® SoL client + tools";
-    homepage = "https://github.com/kraxel/amtterm";
+    homepage = "https://gitlab.com/kraxel/amtterm";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ kallisti-dev ];
+    # gamt uses GTK's X11 backend; nixpkgs' gtk3 uses Quartz on Darwin.
+    platforms = lib.platforms.linux ++ lib.optionals (!withGamt) lib.platforms.darwin;
   };
 })