diff --git a/pkgs/by-name/ti/tinyproxy/package.nix b/pkgs/by-name/ti/tinyproxy/package.nix
index 035c3194b91e..bb07a0bf0a4d 100644
--- a/pkgs/by-name/ti/tinyproxy/package.nix
+++ b/pkgs/by-name/ti/tinyproxy/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
+  fetchpatch,
   autoreconfHook,
   perl,
   nixosTests,
@@ -22,10 +22,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Fix case-sensitive matching of "chunked" (CVE-2026-31842)
-    (fetchpatch2 {
+    (fetchpatch {
       name = "fix-chunked-case-sensitivity.patch";
       url = "https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98.patch";
-      hash = "sha256-Nav3nXyxdoM/tIvfyPJHEYEjAtrRrJlvkMXzsQCZan4=";
+      hash = "sha256-kU9Vqf2YtnKNJU4eQlau/ijtXkGPS/n+YSeficfu7JM=";
+    })
+    # Remove when updating to the first upstream release containing these fixes.
+    (fetchpatch {
+      name = "CVE-2026-54387.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb.patch";
+      hash = "sha256-BSnK3XkBFW43cnD937RKr7FJzQT90BxJkILXz/QPZo8=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-54388.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb.patch";
+      hash = "sha256-+Z/Rj/zNldfOPVzWUlFHa37LEfSh/PtXOaN8z++ONJQ=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-55202.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce.patch";
+      hash = "sha256-kwYk5E95KQK42ebLV0nHB706VynDnjHB/5eENKO7Eaw=";
     })
   ];