diff --git a/pkgs/browserpass-extension/default.nix b/pkgs/browserpass-extension/default.nix
index 9c5fd923..56ee2cd8 100644
--- a/pkgs/browserpass-extension/default.nix
+++ b/pkgs/browserpass-extension/default.nix
@@ -10,22 +10,21 @@
 let
   pname = "browserpass-extension";
   version = "3.7.2-20221121";
-  src = fetchFromGitHub {
-    owner = "browserpass";
-    repo = "browserpass-extension";
-    # rev = version;
-    rev = "21f3431d09e1d7ffd33e0b9fc5d2965b7bd93a1a";
-    sha256 = "sha256-XIgbaQSAXx7L1e/9rzN7oBQy9U3HWJHOX2auuvgdvbc=";
-  };
-  # src = fetchFromGitea {
-  #   domain = "git.uninsane.org";
-  #   owner = "colin";
+  # src = fetchFromGitHub {
+  #   owner = "browserpass";
   #   repo = "browserpass-extension";
-  #   # fix `enableOTP` handling to match docs: prioritize store, then extension config
-  #   # upstream PR: <https://github.com/browserpass/browserpass-extension/pull/308/>
-  #   rev = "a5f5e27b5f3abe2252f68c59959c3c30ac1a603b";
+  #   # rev = version;
+  #   rev = "21f3431d09e1d7ffd33e0b9fc5d2965b7bd93a1a";
   #   sha256 = "sha256-XIgbaQSAXx7L1e/9rzN7oBQy9U3HWJHOX2auuvgdvbc=";
   # };
+  src = fetchFromGitea {
+    domain = "git.uninsane.org";
+    owner = "colin";
+    repo = "browserpass-extension";
+    # hack in sops support
+    rev = "e36da973d4367b0f0b9c7a68001a3fb093a43c39";
+    sha256 = "sha256-nViFtAWV5UKCxG29CHArv59R+w1zRq2fWIot5OyJwtc=";
+  };
   browserpass-extension-yarn-modules = mkYarnModules {
     inherit pname version;
     packageJSON = "${src}/src/package.json";
diff --git a/pkgs/browserpass/default.nix b/pkgs/browserpass/default.nix
index 1e0001c4..983b07c5 100644
--- a/pkgs/browserpass/default.nix
+++ b/pkgs/browserpass/default.nix
@@ -31,8 +31,9 @@ in
     domain = "git.uninsane.org";
     owner = "colin";
     repo = "browserpass-native";
-    rev = "8de7959fa5772aca406bf29bb17707119c64b81e";
-    hash = "sha256-ewB1YdWqfZpt8d4p9LGisiGUsHzRW8RiSO/+NZRiQpk=";
+    # don't forcibly append '.gpg'
+    rev = "85bdb08379c03297c1236f66e8764160c922d397";
+    hash = "sha256-SEfihU+GreWhYfLVr7tTnMCo6Iq20a78F8iVbycOQUQ=";
   };
   installPhase = ''
     make install