diff --git a/pkgs/by-name/dr/dracut/package.nix b/pkgs/by-name/dr/dracut/package.nix
index 2dcac697dc05..3a05313aa796 100644
--- a/pkgs/by-name/dr/dracut/package.nix
+++ b/pkgs/by-name/dr/dracut/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   gitUpdater,
   makeBinaryWrapper,
   pkg-config,
@@ -38,6 +39,32 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-zSyC2SnSQkmS/mDpBXG2DtVVanRRI9COKQJqYZZCPJM=";
   };
 
+  patches = [
+    # dracut-lib.sh moved from 99base to 80base after 059.
+    # Required by the CVE-2026-15816 fix below; remove when updating to 112 or newer.
+    (fetchpatch2 {
+      name = "add-escape-function.patch";
+      url = "https://github.com/dracut-ng/dracut/commit/207c339728eff81127469c2f6fe106447c781009.patch?full_index=1";
+      relative = "modules.d/80base";
+      extraPrefix = "modules.d/99base/";
+      hash = "sha256-r8dsJvmb09QH6ZRTceBg3Bo+WbCKA8U7Pj0rAjXDcm4=";
+    })
+    # Remove when updating to the first release after 112 containing this fix.
+    (fetchpatch2 {
+      name = "CVE-2026-15816.patch";
+      url = "https://github.com/dracut-ng/dracut/commit/c4d555716d569038ca38365741e94ee07908f261.patch?full_index=1";
+      relative = "modules.d/80base";
+      extraPrefix = "modules.d/99base/";
+      hash = "sha256-ja15T++ojzjExRgPjyyuUx/vkLhR9AWBBWgz9hTzHCU=";
+    })
+  ];
+
+  # Don't create .orig files when the backported patches apply with offsets.
+  patchFlags = [
+    "--no-backup-if-mismatch"
+    "-p1"
+  ];
+
   strictDeps = true;
 
   buildInputs = [