diff --git a/nixpatches/list.nix b/nixpatches/list.nix
index 21e6fda4f..40f6dcdb0 100644
--- a/nixpatches/list.nix
+++ b/nixpatches/list.nix
@@ -33,6 +33,13 @@ in [
     # hash = "sha256-n6xatVeqMweuy/bm68cxWUkgUoS+H1xNRjT0JDFXeEs=";
     hash = "sha256-PXatkvLjEgQJ4rRIjEOadKscM0WYWTozIFt2vzWOMKY=";
   })
+  (fetchpatch' {
+    title = "gcr: remove build gnupg from runtime closure";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/263158";
+    saneCommit = "8c71ab22c6df4e5ce290e131a7769688b0c5a017";
+    # hash = "sha256-9PNKzNlJ62WAq6H+tqlt0spFZ1DPP1hHmpx0YPuieFE=";
+    hash = "sha256-6hUdsExHSMHy6FMY1+OLtVmKpRwysGIVkcDpYv7RRBk=";
+  })
   (fetchpatch' {
     title = "trust-dns: 0.23.0 -> 0.24.0";
     prUrl = "https://github.com/NixOS/nixpkgs/pull/263054";
diff --git a/overlays/cross.nix b/overlays/cross.nix
index 6b2b1ec46..14385ae99 100644
--- a/overlays/cross.nix
+++ b/overlays/cross.nix
@@ -631,7 +631,7 @@ in {
     outputs = lib.remove "devdoc" upstream.outputs;
   });
 
-  # 2023/07/31: upstreaming is unblocked
+  # 2023/07/31: upstreaming is blocked on qttranslations (via pipewire)
   # N.B.: should be able to remove gnupg/ssh from {native}buildInputs when upstreaming
   gcr_4 = prev.gcr_4.overrideAttrs (upstream: {
     # fixes (meson): "ERROR: Program 'gpg2 gpg' not found or not executable"
@@ -639,11 +639,13 @@ in {
       "-Dgpg_path=${final.gnupg}/bin/gpg"
     ];
   });
-  gcr = prev.gcr.overrideAttrs (upstream: {
-    mesonFlags = (upstream.mesonFlags or []) ++ [
-      "-Dgpg_path=${final.gnupg}/bin/gpg"
-    ];
-  });
+  # 2023/10/23: upstreaming: <https://github.com/NixOS/nixpkgs/pull/263158>
+  # gcr = prev.gcr.overrideAttrs (upstream: {
+  #   # removes build platform's gnupg from runtime closure
+  #   mesonFlags = (upstream.mesonFlags or []) ++ [
+  #     "-Dgpg_path=${final.gnupg}/bin/gpg"
+  #   ];
+  # });
   # gnustep = prev.gnustep.overrideScope' (self: super: {
   #   # gnustep is going to need a *lot* of work/domain-specific knowledge to truly cross-compile,
   #   # base = emulated.gnustep.base;