diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index 5b1a1fad5b1a..e7b661ae6ae7 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -8,7 +8,7 @@
 , flask
 , flask-httpauth
 , flask-socketio
-, stem
+, cepa
 , psutil
 , pyqt5
 , pycrypto
@@ -21,15 +21,16 @@
 , unidecode
 , tor
 , obfs4
+, snowflake
 }:
 
 let
-  version = "2.4";
+  version = "2.5";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-Lclm7mIkaAkQpWcNILTRJtLA43dpiyHtWAeHS2r3+ZQ=";
+    sha256 = "xCAM+tjjyDg/gqAXr4YNPhM8R3n9r895jktisAGlpZo=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";
@@ -55,16 +56,9 @@ let
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ lourkeur ];
   };
-  stem' = stem.overridePythonAttrs (_: rec {
-    version = "1.8.1";
 
-    src = fetchFromGitHub {
-      owner = "onionshare";
-      repo = "stem";
-      rev = version;
-      sha256 = "Dzpvx7CgAr5OtGmfubWAYDLqq5LkGqcwjr3bxpfL/3A=";
-    };
-  });
+  # TODO: package meek https://support.torproject.org/glossary/meek/
+  meek = "/meek-not-available";
 
 in
 rec {
@@ -76,7 +70,7 @@ rec {
       # hardcode store paths of dependencies
       (substituteAll {
         src = ./fix-paths.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
         inherit (tor) geoip;
       })
     ];
@@ -86,7 +80,7 @@ rec {
       flask
       flask-httpauth
       flask-socketio
-      stem'
+      cepa
       psutil
       pycrypto
       pynacl
@@ -109,8 +103,6 @@ rec {
     '';
 
     disabledTests = [
-      "test_firefox_like_behavior"
-      "test_if_unmodified_since"
       "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
     ] ++ lib.optionals stdenv.isDarwin [
       # on darwin (and only on darwin) onionshare attempts to discover
@@ -123,12 +115,12 @@ rec {
   onionshare-gui = buildPythonApplication {
     pname = "onionshare";
     inherit version meta;
-    src = "${src}/desktop/src";
+    src = "${src}/desktop";
     patches = [
       # hardcode store paths of dependencies
       (substituteAll {
         src = ./fix-paths-gui.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
         inherit (tor) geoip;
       })
     ];
diff --git a/pkgs/applications/networking/onionshare/fix-paths-gui.patch b/pkgs/applications/networking/onionshare/fix-paths-gui.patch
index 841af8fa95af..4eb611c860db 100644
--- a/pkgs/applications/networking/onionshare/fix-paths-gui.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths-gui.patch
@@ -1,25 +1,46 @@
 --- a/onionshare/gui_common.py
 +++ b/onionshare/gui_common.py
-@@ -391,29 +391,10 @@ class GuiCommon:
+@@ -410,52 +410,12 @@ class GuiCommon:
          }
  
      def get_tor_paths(self):
 -        if self.common.platform == "Linux":
--            tor_path = shutil.which("tor")
--            obfs4proxy_file_path = shutil.which("obfs4proxy")
--            prefix = os.path.dirname(os.path.dirname(tor_path))
--            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
--            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
--        elif self.common.platform == "Windows":
+-            base_path = self.get_resource_path("tor")
+-            if base_path and os.path.isdir(base_path):
+-                self.common.log(
+-                    "GuiCommon", "get_tor_paths", "using paths in resources"
+-                )
+-                tor_path = os.path.join(base_path, "tor")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-            else:
+-                # Fallback to looking in the path
+-                self.common.log("GuiCommon", "get_tor_paths", "using paths from PATH")
+-                tor_path = shutil.which("tor")
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
+-        if self.common.platform == "Windows":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
 -        elif self.common.platform == "Darwin":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "tor")
 -            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-            meek_client_file_path = os.path.join(base_path, "meek-client")
 -            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
 -        elif self.common.platform == "BSD":
@@ -27,10 +48,14 @@
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
++        meek_client_file_path = "@meek@/bin/meek-client"
++        snowflake_file_path = "@snowflake@/bin/snowflake-client"
  
          return (
              tor_path,
diff --git a/pkgs/applications/networking/onionshare/fix-paths.patch b/pkgs/applications/networking/onionshare/fix-paths.patch
index 9280ec4d255a..fec4b4e0395b 100644
--- a/pkgs/applications/networking/onionshare/fix-paths.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths.patch
@@ -1,41 +1,76 @@
 --- a/onionshare_cli/common.py
 +++ b/onionshare_cli/common.py
-@@ -308,33 +308,10 @@ class Common:
+@@ -318,67 +318,12 @@ class Common:
          return path
-
+ 
      def get_tor_paths(self):
 -        if self.platform == "Linux":
 -            tor_path = shutil.which("tor")
 -            if not tor_path:
 -                raise CannotFindTor()
 -            obfs4proxy_file_path = shutil.which("obfs4proxy")
+-            snowflake_file_path = shutil.which("snowflake-client")
+-            meek_client_file_path = shutil.which("meek-client")
 -            prefix = os.path.dirname(os.path.dirname(tor_path))
 -            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
 -            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
 -        elif self.platform == "Windows":
+-            # In Windows, the Tor binaries are in the onionshare package, not the onionshare_cli package
 -            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-
+-            # If tor.exe isn't there, mayber we're running from the source tree
+-            if not os.path.exists(tor_path):
+-                base_path = os.path.join(os.getcwd(), "onionshare", "resources", "tor")
+-
+-                tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
+-
 -        elif self.platform == "Darwin":
--            tor_path = shutil.which("tor")
--            if not tor_path:
--                raise CannotFindTor()
--            obfs4proxy_file_path = shutil.which("obfs4proxy")
--            prefix = os.path.dirname(os.path.dirname(tor_path))
--            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
--            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-            # Let's see if we have tor binaries in the onionshare GUI package
+-            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
+-            tor_path = os.path.join(base_path, "tor")
+-            if os.path.exists(tor_path):
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-            else:
+-                # Fallback to looking in the path
+-                tor_path = shutil.which("tor")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
 -        elif self.platform == "BSD":
 -            tor_path = "/usr/local/bin/tor"
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
-
++        snowflake_file_path = "@snowflake@/bin/snowflake-client"
++        meek_client_file_path = "@meek@/bin/meek-client"
+ 
          return (
              tor_path,
-