diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index f81e650e4db7..e60a45dd9410 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -4,11 +4,11 @@
 stdenv.mkDerivation {
   name = "lsh-2.0.4";
   src = fetchurl {
-    url = http://www.lysator.liu.se/~nisse/archive/lsh-2.0.4.tar.gz;
+    url = "mirror://gnu/lsh/${name}.tar.gz";
     sha256 = "614b9d63e13ad3e162c82b6405d1f67713fc622a8bc11337e72949d613713091";
   };
 
-  patches = [ ./pam-service-name.patch ];
+  patches = [ ./pam-service-name.patch ./lshd-no-root-login.patch ];
 
   preConfigure = ''
     # Patch `lsh-make-seed' so that it can gather enough entropy.
diff --git a/pkgs/tools/networking/lsh/lshd-no-root-login.patch b/pkgs/tools/networking/lsh/lshd-no-root-login.patch
new file mode 100644
index 000000000000..9dd81de3fbc1
--- /dev/null
+++ b/pkgs/tools/networking/lsh/lshd-no-root-login.patch
@@ -0,0 +1,16 @@
+Correctly handle the `--no-root-login' option.
+
+--- lsh-2.0.4/src/lshd.c	2006-05-01 13:47:44.000000000 +0200
++++ lsh-2.0.4/src/lshd.c	2009-09-08 12:20:36.000000000 +0200
+@@ -758,6 +758,10 @@ main_argp_parser(int key, char *arg, str
+       self->allow_root = 1;
+       break;
+ 
++    case OPT_NO_ROOT_LOGIN:
++      self->allow_root = 0;
++      break;
++
+     case OPT_KERBEROS_PASSWD:
+       self->pw_helper = PATH_KERBEROS_HELPER;
+       break;
+