diff --git a/pkgs/applications/misc/pwsafe/default.nix b/pkgs/applications/misc/pwsafe/default.nix
index 534f6adecdf8..3549fead8e28 100644
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, zip, gettext, perl
+{ lib, stdenv, fetchFromGitHub
+, cmake, pkg-config, zip, gettext, perl
 , wxGTK30, libXext, libXi, libXt, libXtst, xercesc
 , qrencode, libuuid, libyubikey, yubikey-personalization
 , curl, openssl, file
@@ -6,13 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pwsafe";
-  version = "3.56.0";
+  version = "1.14.0"; # do NOT update to 3.x Windows releases
+  # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
+    hash = "sha256-s3IXe4gTwUOzQslNfWrcN/srrG9Jv02zfkGgiZN3C1s=";
   };
 
   nativeBuildInputs = [
@@ -32,19 +34,19 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # Fix perl scripts used during the build.
-    for f in `find . -type f -name '*.pl'`; do
+    for f in $(find . -type f -name '*.pl') ; do
       patchShebangs $f
     done
 
     # Fix hard coded paths.
-    for f in `grep -Rl /usr/share/ src`; do
+    for f in $(grep -Rl /usr/share/ src) ; do
       substituteInPlace $f --replace /usr/share/ $out/share/
     done
 
     # Fix hard coded zip path.
     substituteInPlace help/Makefile.linux --replace /usr/bin/zip ${zip}/bin/zip
 
-    for f in `grep -Rl /usr/bin/ .`; do
+    for f in $(grep -Rl /usr/bin/ .) ; do
       substituteInPlace $f --replace /usr/bin/ ""
     done
   '';