diff --git a/pkgs/tools/backup/zbackup/default.nix b/pkgs/tools/backup/zbackup/default.nix
index 795a45f8864d..ee5cc6fd89e9 100644
--- a/pkgs/tools/backup/zbackup/default.nix
+++ b/pkgs/tools/backup/zbackup/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchFromGitHub, cmake, zlib, openssl, protobuf, protobufc, lzo, libunwind }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, cmake, protobufc
+, libunwind, lzo, openssl, protobuf, zlib
+}:
+
 stdenv.mkDerivation rec {
   pname = "zbackup";
   version = "1.4.4";
@@ -10,6 +14,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-9Fk4EhEeQ2J4Kirc7oad4CzmW70Mmza6uozd87qfgZI=";
   };
 
+  patches = [
+    # compare with https://github.com/zbackup/zbackup/pull/158;
+    # but that doesn't apply cleanly to this version
+    ./protobuf-api-change.patch
+  ];
+
   buildInputs = [ zlib openssl protobuf lzo libunwind ];
   nativeBuildInputs = [ cmake protobufc ];
 
diff --git a/pkgs/tools/backup/zbackup/protobuf-api-change.patch b/pkgs/tools/backup/zbackup/protobuf-api-change.patch
new file mode 100644
index 000000000000..d071709878be
--- /dev/null
+++ b/pkgs/tools/backup/zbackup/protobuf-api-change.patch
@@ -0,0 +1,11 @@
+--- a/backup_restorer.cc
++++ b/backup_restorer.cc
+@@ -48,7 +48,7 @@
+   // TODO: this disables size checks for each separate message. Figure a better
+   // way to do this while keeping them enabled. It seems we need to create an
+   // instance of CodedInputStream for each message, but it might be expensive
+-  cis.SetTotalBytesLimit( backupData.size(), -1 );
++  cis.SetTotalBytesLimit( backupData.size() );
+ 
+   // Used when emitting chunks
+   string chunk;