diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index d0dabbd88fc7..31ae8c923ca0 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -32,6 +32,18 @@ buildDotnetModule (finalAttrs: {
       hash = "sha256-TxGo+sLLG+C9omxrwvO6byzw+iRqONVLXrQKwkrY22s=";
     })
 
+    # GHSA-6828-c7cx-hvqm: confine virtual-folder operations to the libraries root.
+    (fetchpatch {
+      url = "https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e.patch";
+      hash = "sha256-K/og9MDP4BNexkDGLOm346O9anqAjb13UViSAmOw2OA=";
+    })
+
+    # GHSA-4vx8-xhc9-qg6x: enforce remote-control permissions between user sessions.
+    (fetchpatch {
+      url = "https://github.com/jellyfin/jellyfin/commit/dd7de4187879082e10b474856f705b6c5d9b963a.patch";
+      hash = "sha256-OCj4aaKaX4F/+KbCz6BAsifdYe/6BOu6y39ZgMSUKFA=";
+    })
+
     # Fix MaxLoginAttempts not honored.
     # https://github.com/jellyfin/jellyfin/pull/17274
     (fetchpatch {