diff --git a/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch b/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
index ef8f2b65ca0a..997d28aaecbf 100644
--- a/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
+++ b/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
@@ -1,4 +1,4 @@
-From 64a767136c16aad2b94b4d9a3268b0d4deba7272 Mon Sep 17 00:00:00 2001
+From 269cc4c9558549f340ec186d9246654564b2f633 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Tue, 18 Aug 2020 10:22:36 +0100
 Subject: [PATCH] add nixos support
@@ -14,13 +14,13 @@ Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
  create mode 100644 cloudinit/distros/nixos.py
 
 diff --git a/cloudinit/distros/__init__.py b/cloudinit/distros/__init__.py
-index c7163e1c..c147e2b3 100755
+index 2537608f..c533b585 100755
 --- a/cloudinit/distros/__init__.py
 +++ b/cloudinit/distros/__init__.py
-@@ -46,6 +46,7 @@ OSFAMILIES = {
-     'freebsd': ['freebsd'],
+@@ -47,6 +47,7 @@ OSFAMILIES = {
+     'gentoo': ['gentoo'],
+     'redhat': ['amazon', 'centos', 'fedora', 'rhel'],
      'suse': ['opensuse', 'sles'],
-     'arch': ['arch'],
 +    'nixos': ['nixos'],
  }
  
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index 66ce16d985e3..24ecb7f99c37 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -17,7 +17,7 @@
 , openssh
 }:
 
-let version = "20.2";
+let version = "20.3";
 
 in buildPythonApplication {
   pname = "cloud-init";
@@ -28,7 +28,7 @@ in buildPythonApplication {
     owner = "canonical";
     repo = "cloud-init";
     rev = version;
-    sha256 = "sha256-QeY/fdIIUSsp5oNxyRtZwpTB747Jf5KAJuYY9yiKUvc=";
+    sha256 = "1fmckxf4q4sxjqs758vw7ca0rnhl9hyq67cqpqzz2v3s1gqzjhm4";
   };
 
   patches = [ ./0001-add-nixos-support.patch ];
@@ -72,6 +72,8 @@ in buildPythonApplication {
     "test_dhclient_run_with_tmpdir"
     # clears path and fails because mkdir is not found
     "test_path_env_gets_set_from_main"
+    # tries to read from /etc/ca-certificates.conf while inside the sandbox
+    "test_handler_ca_certs"
   ];
 
   preCheck = ''