diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 7f873e9c8a72..a938d00cc3ff 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -29,6 +29,10 @@
 
 - `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
 
+- `yeswiki` has been updated from 4.4.2 to 4.6.7 and now requires PHP 8.3 or newer.
+  The release also removes legacy JSONP endpoints and changes several security-sensitive operations from GET to POST with CSRF tokens.
+  Review the upstream [4.6.7 release notes](https://github.com/YesWiki/yeswiki/releases/tag/v4.6.7) before upgrading custom themes or integrations.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
diff --git a/pkgs/by-name/ye/yeswiki/package.nix b/pkgs/by-name/ye/yeswiki/package.nix
index 6dd92d78f53f..f79583e0a8df 100644
--- a/pkgs/by-name/ye/yeswiki/package.nix
+++ b/pkgs/by-name/ye/yeswiki/package.nix
@@ -4,15 +4,16 @@
   unzip,
 }:
 let
-  version = "4.4.2";
+  version = "4.6.7";
 in
 stdenv.mkDerivation {
   pname = "yeswiki";
   inherit version;
 
+  # The release archive contains the bundled PHP and JavaScript dependencies.
   src = fetchurl {
-    url = "https://repository.yeswiki.net/doryphore/yeswiki-doryphore-${version}.zip";
-    hash = "sha256-TNiVBragEnLkMTu/Op6sCFsk9wWXUQ2GUPqmWgPV/vk=";
+    url = "https://github.com/YesWiki/yeswiki/releases/download/v${version}/yeswiki-v${version}.zip";
+    hash = "sha256-QgF08amdCh4q3E3/wat4e/KhIWMtBTkFJzT3p5m61FU=";
   };
 
   nativeBuildInputs = [