diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index d3b62d3259cc..d06399169707 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,18 +1,29 @@
-{ stdenv, fetchFromGitHub, python3Packages, glibcLocales }:
+{ stdenv, fetchFromGitHub, python3Packages, glibcLocales, fetchpatch }:
 
 with python3Packages;
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "3.0.4";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "10l761ds46r1p2kjxlgby9vdxbjjlgq72s6adjypghi41s3qf034";
+    sha256 = "14i9dkafvyl15rq2qa8xldscn5lmkk2g52kbi2hl63nzx9yibx6r";
   };
 
+  patches = [
+    (fetchpatch {
+      # Tests failed due to expired test certificates,
+      # https://github.com/mitmproxy/mitmproxy/issues/3316
+      # TODO: remove on next update
+      name = "test-certificates.patch";
+      url = "https://github.com/mitmproxy/mitmproxy/commit/1b6a8d6acd3d70f9b9627ad4ae9def08103f8250.patch";
+      sha256 = "03y79c25yir7d8xj79czdc81y3irqq1i3ks9ca0mv1az8b7xsvfv";
+    })
+  ];
+
   postPatch = ''
     # remove dependency constraints
     sed 's/>=\([0-9]\.\?\)\+\( \?, \?<\([0-9]\.\?\)\+\)\?//' -i setup.py
@@ -23,8 +34,7 @@ buildPythonPackage rec {
   checkPhase = ''
     export HOME=$(mktemp -d)
     export LC_CTYPE=en_US.UTF-8
-    # test_echo resolves hostnames
-    pytest -k 'not test_echo and not test_find_unclaimed_URLs '
+    pytest -k 'not test_find_unclaimed_URLs'
   '';
 
   propagatedBuildInputs = [
@@ -38,6 +48,7 @@ buildPythonPackage rec {
   checkInputs = [
     beautifulsoup4 flask pytest
     requests glibcLocales
+    asynctest parver pytest-asyncio
   ];
 
   meta = with stdenv.lib; {