diff --git a/pkgs/by-name/cr/cryptpad/package.nix b/pkgs/by-name/cr/cryptpad/package.nix
index 7238621b3a1c..a588aaccda80 100644
--- a/pkgs/by-name/cr/cryptpad/package.nix
+++ b/pkgs/by-name/cr/cryptpad/package.nix
@@ -14,22 +14,60 @@
 }:
 
 let
-  version = "2025.3.0";
+  version = "2025.6.0";
   # nix version of install-onlyoffice.sh
   # a later version could rebuild from sdkjs/web-apps as per
   # https://github.com/cryptpad/onlyoffice-builds/blob/main/build.sh
-  onlyoffice_build =
-    rev: hash:
-    fetchFromGitHub {
-      inherit rev hash;
-      owner = "cryptpad";
-      repo = "onlyoffice-builds";
-    };
+  onlyoffice_fetch =
+    {
+      rev ? null,
+      version ? null,
+      hash,
+      ...
+    }:
+    assert (
+      lib.assertMsg (lib.xor (rev == null) (
+        version == null
+      )) "onlyoffice_fetch requires one of either `rev` or `version` to be provided (not both)."
+    );
+    if rev != null then
+      fetchFromGitHub {
+        inherit rev hash;
+        owner = "cryptpad";
+        repo = "onlyoffice-builds";
+      }
+    # New method for v7+ versions that use ZIP releases
+    else
+      fetchurl {
+        url = "https://github.com/cryptpad/onlyoffice-editor/releases/download/${version}/onlyoffice-editor.zip";
+        inherit hash;
+      };
+
   onlyoffice_install = oo: ''
     oo_dir="$out_cryptpad/www/common/onlyoffice/dist/${oo.subdir}"
-    cp -a "${onlyoffice_build oo.rev oo.hash}/." "$oo_dir"
-    chmod -R +w "$oo_dir"
-    echo "${oo.rev}" > "$oo_dir/.commit"
+    ${
+      if oo ? "version" then
+        ''
+          mkdir -p "$oo_dir"
+          unzip ${onlyoffice_fetch oo} -d "$oo_dir"
+          echo "${oo.version}" > "$oo_dir/.version"
+
+          # Clean up help files and dictionaries as per upstream
+          ${lib.optionalString (oo.subdir == "v7") ''
+            rm -rf "$oo_dir"/web-apps/apps/*/main/resources/help
+            rm -rf "$oo_dir"/dictionaries/
+          ''}
+        ''
+      else
+        ''
+          cp -a "${onlyoffice_fetch oo}/." "$oo_dir"
+          chmod -R +w "$oo_dir"
+          echo "${oo.rev}" > "$oo_dir/.commit"
+
+          # Clean up help files as per upstream
+          rm -rf "$oo_dir"/web-apps/apps/*/main/resources/help
+        ''
+    }
   '';
   onlyoffice_versions = [
     {
@@ -59,8 +97,13 @@ let
     }
     {
       subdir = "v7";
-      rev = "e1267803";
-      hash = "sha256-iIds0GnCHAyeIEdSD4aCCgDtnnwARh3NE470CywseS0=";
+      version = "v7.3.3.60+11";
+      hash = "sha256-He8RwsaJPBhaxFklA7vSxxNUpmcM41lW859gQUUJWbQ=";
+    }
+    {
+      subdir = "v8";
+      version = "v8.3.3.23+4";
+      hash = "sha256-DeK84fa7Jc1L1+vF8LBKLXM5oWS0SV2qBnAWG3Xzu4U=";
     }
   ];
 
@@ -83,11 +126,11 @@ buildNpmPackage {
   src = fetchFromGitHub {
     owner = "cryptpad";
     repo = "cryptpad";
-    rev = version;
-    hash = "sha256-NxkVMsfLzdzifdn+f0C6mBJGd1oLwcMTAIXv+gBG7rI=";
+    tag = version;
+    hash = "sha256-R8Oonrnb1tqvl1zTkWv5Xv/f8bFtUljD6X/re72IvsU=";
   };
 
-  npmDepsHash = "sha256-GWkyRlizPSA72WwoY+mRLwaMeD/SXdo6oUVwsd2gp7c=";
+  npmDepsHash = "sha256-4Zr+8ANZJ9XX2umY/SY7BrEHPheVelFSeZipgOaW6bI==";
 
   nativeBuildInputs = [
     makeBinaryWrapper
@@ -120,8 +163,13 @@ buildNpmPackage {
     # Move to install directory manually.
     npm run install:components
     mv www/components "$out_cryptpad/www/"
-    # and fix absolute symlink to /build...
-    ln -Tfs ../../src/tweetnacl "$out_cryptpad/www/components/tweetnacl"
+    # optimization: replace copies with symlinks...
+    for d in "$out_cryptpad/www/components/"*; do
+      d="''${d##*/}"
+      [ -e "$out_cryptpad/node_modules/$d" ] || continue
+      rm -rf "$out_cryptpad/www/components/$d"
+      ln -Tfs "../../node_modules/$d" "$out_cryptpad/www/components/$d"
+    done
 
     # install OnlyOffice (install-onlyoffice.sh without network)
     mkdir -p "$out_cryptpad/www/common/onlyoffice/dist"
@@ -130,8 +178,10 @@ buildNpmPackage {
     # Run upstream's `install-onlyoffice.sh` script in `--check` mode to
     # verify that we've installed the correct versions of the various
     # OnlyOffice components.
-    patchShebangs --build $out_cryptpad/install-onlyoffice.sh
-    $out_cryptpad/install-onlyoffice.sh --accept-license --check --rdfind
+
+    # TODO: Patch the new install method to only verify versions;
+    # patchShebangs --build $out_cryptpad/install-onlyoffice.sh
+    # $out_cryptpad/install-onlyoffice.sh --accept-license --check --rdfind
 
     # cryptpad assumes it runs in the source directory and also outputs
     # its state files there, which is not exactly great for us.
@@ -144,7 +194,7 @@ buildNpmPackage {
     # directory.
     makeWrapper "${lib.getExe nodejs}" "$out/bin/cryptpad" \
       --add-flags "$out_cryptpad/server.js" \
-      --run "for d in customize.dist lib www scripts; do ${coreutils}/bin/ln -sf \"$out_cryptpad/\$d\" .; done" \
+      --run "for d in src customize.dist lib www scripts; do ${coreutils}/bin/ln -sf \"$out_cryptpad/\$d\" .; done" \
       --run "if ! [ -d customize ]; then \"${lib.getExe nodejs}\" \"$out_cryptpad/scripts/build.js\"; fi"
   '';