diff --git a/pkgs/development/python-modules/ssh-mitm/default.nix b/pkgs/tools/security/ssh-mitm/default.nix
similarity index 60%
rename from pkgs/development/python-modules/ssh-mitm/default.nix
rename to pkgs/tools/security/ssh-mitm/default.nix
index d5c890b2dda4..9d40f86354b5 100644
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/tools/security/ssh-mitm/default.nix
@@ -1,25 +1,30 @@
 { lib
-, argcomplete
-, buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-, colored
-, packaging
-, paramiko
-, pytz
-, pyyaml
-, rich
-, sshpubkeys
-, pytestCheckHook
+, python3
 }:
 
-buildPythonPackage rec {
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+      paramiko = super.paramiko.overridePythonAttrs (oldAttrs: rec {
+        version = "3.1.0";
+        src = oldAttrs.src.override {
+          inherit version;
+          hash = "sha256-aVD6ymgZrNMhnUrmlKI8eofuONCE9wwXJLDA27i3V2k=";
+        };
+        patches = [ ];
+        propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ python3.pkgs.icecream ];
+      });
+    };
+  };
+in
+with py.pkgs;
+
+buildPythonApplication rec {
   pname = "ssh-mitm";
   version = "3.0.2";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
@@ -35,6 +40,7 @@ buildPythonPackage rec {
     pytz
     pyyaml
     rich
+    setuptools
     sshpubkeys
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c6ad14c09721..9d6033cb97e7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3698,7 +3698,7 @@ with pkgs;
 
   ssh-key-confirmer = callPackage ../tools/networking/ssh-key-confirmer { };
 
-  ssh-mitm = with python3Packages; toPythonApplication ssh-mitm;
+  ssh-mitm = callPackage ../tools/security/ssh-mitm { };
 
   sshchecker = callPackage ../tools/security/sshchecker { };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 1e84bbb2563c..c09963627d50 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -280,6 +280,7 @@ mapAliases ({
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
   setuptools_scm = setuptools-scm; # added 2021-06-03
   sharkiqpy = sharkiq; # added 2022-05-21
+  ssh-mitm = throw "ssh-mitm was removed in favor of the top-level ssh-mitm"; # added 2023-05-09
   smart_open = smart-open; # added 2021-03-14
   smmap2 = throw "smmap2 has been deprecated, use smmap instead."; # added 2020-03-14
   somecomfort = throw "somecomfort was removed because Home Assistant switched to aiosomecomfort"; # added 2023-02-01
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7210c1a1a03f..ebccdd17911c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11551,8 +11551,6 @@ self: super: with self; {
 
   sseclient-py = callPackage ../development/python-modules/sseclient-py { };
 
-  ssh-mitm = callPackage ../development/python-modules/ssh-mitm { };
-
   sshfs = callPackage ../development/python-modules/sshfs { };
 
   sshpubkeys = callPackage ../development/python-modules/sshpubkeys { };