diff --git a/pkgs/applications/graphics/pdfcpu/default.nix b/pkgs/applications/graphics/pdfcpu/default.nix
index eb1d89a0083f..9fdc77ac745f 100644
--- a/pkgs/applications/graphics/pdfcpu/default.nix
+++ b/pkgs/applications/graphics/pdfcpu/default.nix
@@ -2,16 +2,49 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dEAlOKjNXL7zqlll6lqGmbopjdplDR3ewMMNu9TMsmw=";
+    hash = "sha256-New0+pWtKdEx/k69pNisNKYj6p998HoEjAhQEDugP/g=";
+    # Apparently upstream requires that the compiled executable will know the
+    # commit hash and the date of the commit. This information is also presented
+    # in the output of `pdfcpu version` which we use as a sanity check in the
+    # installCheckPhase. This was discussed upstream in:
+    #
+    # - https://github.com/pdfcpu/pdfcpu/issues/751
+    # - https://github.com/pdfcpu/pdfcpu/pull/752
+    #
+    # The trick used here is to write that information into files in `src`'s
+    # `$out`, and then read them into the `ldflags`. We also delete the `.git`
+    # directories in `src`'s $out afterwards, imitating what's done if
+    # `leaveDotGit = false;` See also:
+    # https://github.com/NixOS/nixpkgs/issues/8567
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > $out/SOURCE_DATE
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
 
-  vendorHash = "sha256-WZsm2wiKedMP0miwnzhnSrF7Qw+jqd8dnpcehlsdMCA=";
+  vendorHash = "sha256-jVX/CFf9dd9qD3gyGVDjbfINtPLCsgdjWFix4BCpDZ0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
+
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+    ldflags+=" -X main.date=$(cat SOURCE_DATE)"
+  '';
+
 
   # No tests
   doCheck = false;
@@ -20,6 +53,8 @@ buildGoModule rec {
     export HOME=$(mktemp -d)
     echo checking the version print of pdfcpu
     $out/bin/pdfcpu version | grep ${version}
+    $out/bin/pdfcpu version | grep $(cat COMMIT | cut -c1-8)
+    $out/bin/pdfcpu version | grep $(cat SOURCE_DATE)
   '';
 
   subPackages = [ "cmd/pdfcpu" ];