diff --git a/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch b/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
new file mode 100644
index 000000000000..245395899afe
--- /dev/null
+++ b/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
@@ -0,0 +1,13 @@
+diff --git a/apps/desktop/src/platform/main/biometric/biometric.unix.main.ts b/apps/desktop/src/platform/main/biometric/biometric.unix.main.ts
+index e2428d9d12..de4e9e1e62 100644
+--- a/apps/desktop/src/platform/main/biometric/biometric.unix.main.ts
++++ b/apps/desktop/src/platform/main/biometric/biometric.unix.main.ts
+@@ -109,7 +109,7 @@ export default class BiometricUnixMain implements OsBiometricService {
+     // The user needs to manually set up the polkit policy outside of the sandbox
+     // since we allow access to polkit via dbus for the sandboxed clients, the authentication works from
+     // the sandbox, once the policy is set up outside of the sandbox.
+-    return isLinux() && !isSnapStore() && !isFlatpak();
++    return false;
+   }
+ 
+   async osBiometricsSetup(): Promise<void> {
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index a45712bfe801..8dd09aa0be92 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -40,11 +40,15 @@ in buildNpmPackage rec {
 
   patches = [
     ./electron-builder-package-lock.patch
+    ./dont-auto-setup-biometrics.patch
+    ./set-exe-path.patch # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
   ];
 
   postPatch = ''
     # remove code under unfree license
     rm -r bitwarden_license
+
+    substituteInPlace apps/desktop/src/main.ts --replace-fail '%%exePath%%' "$out/bin/bitwarden"
   '';
 
   nodejs = nodejs_20;
@@ -174,6 +178,13 @@ in buildNpmPackage rec {
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
 
+    # Extract the polkit policy file from the multiline string in the source code.
+    # This may break in the future but its better than copy-pasting it manually.
+    mkdir -p $out/share/polkit-1/actions/
+    pushd apps/desktop/src/platform/main/biometric
+    awk '/const polkitPolicy = `/{gsub(/^.*`/, ""); print; str=1; next} str{if (/`;/) str=0; gsub(/`;/, ""); print}' biometric.unix.main.ts > $out/share/polkit-1/actions/com.bitwarden.Bitwarden.policy
+    popd
+
     pushd apps/desktop/resources/icons
     for icon in *.png; do
       dir=$out/share/icons/hicolor/"''${icon%.png}"/apps
diff --git a/pkgs/by-name/bi/bitwarden-desktop/set-exe-path.patch b/pkgs/by-name/bi/bitwarden-desktop/set-exe-path.patch
new file mode 100644
index 000000000000..deba588d11bc
--- /dev/null
+++ b/pkgs/by-name/bi/bitwarden-desktop/set-exe-path.patch
@@ -0,0 +1,13 @@
+diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
+index 86d07440a7..be9fa6b4ab 100644
+--- a/apps/desktop/src/main.ts
++++ b/apps/desktop/src/main.ts
+@@ -80,6 +80,8 @@ export class Main {
+       appDataPath = path.join(process.env.SNAP_USER_DATA, "appdata");
+     }
+ 
++    app.setPath("exe", "%%exePath%%");
++
+     app.on("ready", () => {
+       // on ready stuff...
+     });