diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index ae7a489d4b35..8158c3d2d32b 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -36,6 +36,7 @@
 , nixosTests
 , libiconv
 , testers
+, pkgsCross
 
 , enableLDAP ? false, openldap
 , enablePrinting ? false, cups
@@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./patch-source3__libads__kerberos_keytab.c.patch
     ./4.x-no-persistent-install-dynconfig.patch
     ./4.x-fix-makeflags-parsing.patch
+    ./build-find-pre-built-heimdal-build-tools-in-case-of-.patch
     (fetchpatch {
       # workaround for https://github.com/NixOS/nixpkgs/issues/303436
       name = "samba-reproducible-builds.patch";
@@ -160,6 +162,9 @@ stdenv.mkDerivation (finalAttrs: {
     "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--disable-rpath"
+    # otherwise third_party/waf/waflib/Tools/python.py would
+    # get the wrong pythondir from build platform python
+    "--pythondir=${placeholder "out"}/${python.sitePackages}"
     (lib.enableFeature enablePrinting "cups")
   ] ++ optional (!enableDomainController)
     "--without-ad-dc"
@@ -245,6 +250,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = {
     samba = nixosTests.samba;
+    cross = pkgsCross.aarch64-multiplatform.samba;
     pkg-config = testers.hasPkgConfigModules {
       package = finalAttrs.finalPackage;
     };
diff --git a/pkgs/servers/samba/build-find-pre-built-heimdal-build-tools-in-case-of-.patch b/pkgs/servers/samba/build-find-pre-built-heimdal-build-tools-in-case-of-.patch
new file mode 100644
index 000000000000..48bf641457e5
--- /dev/null
+++ b/pkgs/servers/samba/build-find-pre-built-heimdal-build-tools-in-case-of-.patch
@@ -0,0 +1,63 @@
+From 48f7e6d66e2850088b8922024641173776222242 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Thu, 21 Nov 2024 15:30:00 -0500
+Subject: [PATCH] build: find pre-built heimdal build tools in case of embedded
+ heimdal
+
+This patch fixes the case of finding asn1_compile and compile_et for
+building embedded heimdal, by setting
+--bundled-libraries='!asn1_compile,!compile_et' as configure flags.
+
+The Heimdal build tools compile_et and asn1_compile are needed *only*
+if we use the embedded heimdal (otherwise we don't build heimdal and
+use headers that have been generated by those tools elsewhere).
+
+For cross-compilation with embedded heimdal, it is vital to use host build
+tools, and so asn1_compile and compile_et must be supplied and not
+built. One way of doing this would be to set the COMPILE_ET and
+ASN1_COMPILE env vars to the location of supplied binaries. Another way,
+which is more commonly used, is to exclude asn1_compile and compile_et
+from bundled packages via the switch
+-bundled-libraries='!asn1_compile,!compile_et'. When this is done,
+the build script searches the path for those tools and sets the
+ASN1_COMPILE and COMPILE_ET vars accordingly. (this is admittedly
+kind of a round-about way of doing things but this has become the
+de-facto standard amongst embedded distro builders).
+
+In commit 8061983d4882f3ba3f12da71443b035d7b672eec, this process of
+finding the binaris has been moved to be carried out only in the
+system heimdal case. As explained above, we only need these tools,
+and hence the check, in bundled mode.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=14164
+
+Signed-off-by: Uri Simchoni <uri@samba.org>
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+[Bachp: rebased for version 4.15.0]
+[Mats: rebased for version 4.18.5]
+---
+ wscript_configure_embedded_heimdal | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/wscript_configure_embedded_heimdal b/wscript_configure_embedded_heimdal
+index 45f47721de..6c5a4bcf01 100644
+--- a/wscript_configure_embedded_heimdal
++++ b/wscript_configure_embedded_heimdal
+@@ -13,3 +13,14 @@ conf.RECURSE('third_party/heimdal_build')
+ # when this will be available also in
+ # system libraries...
+ conf.define('HAVE_CLIENT_GSS_C_CHANNEL_BOUND_FLAG', 1)
++
++def check_system_heimdal_binary(name):
++    if conf.LIB_MAY_BE_BUNDLED(name):
++        return False
++    if not conf.find_program(name, var=name.upper()):
++        return False
++    conf.define('USING_SYSTEM_%s' % name.upper(), 1)
++    return True
++
++check_system_heimdal_binary("compile_et")
++check_system_heimdal_binary("asn1_compile")
+-- 
+2.47.0
+