diff --git a/pkgs/by-name/cp/cpio/package.nix b/pkgs/by-name/cp/cpio/package.nix
index 30e608bda31f..e8d8c6221980 100644
--- a/pkgs/by-name/cp/cpio/package.nix
+++ b/pkgs/by-name/cp/cpio/package.nix
@@ -41,6 +41,13 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  postPatch = ''
+    # This file determines the date shown in the infopage.
+    # It is unreproducible because CVE-2026-66486.patch touches it.
+    # We could reset it to SOURCE_DATE_EPOCH or the date of that patch.
+    touch -d $(date --utc --date="@''${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d) doc/cpio.texi
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     texinfo # for makeinfo
@@ -70,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.gnu.org/software/cpio/";
     description = "Program to create or extract from cpio archives";
     license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ raboof ];
     platforms = lib.platforms.all;
     priority = 6; # resolves collision with gnutar's "libexec/rmt"
     mainProgram = "cpio";