diff --git a/pkgs/development/libraries/ilmbase/bootstrap.patch b/pkgs/development/libraries/ilmbase/bootstrap.patch
deleted file mode 100644
index db6af6daebd0..000000000000
--- a/pkgs/development/libraries/ilmbase/bootstrap.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -ur openexr-v2.2.0-src-orig/IlmBase/bootstrap openexr-v2.2.0-src/IlmBase/bootstrap
---- IlmBase/bootstrap	2015-03-31 01:02:41.000000000 -0400
-+++ IlmBase/bootstrap	2015-03-31 01:03:35.000000000 -0400
-@@ -47,11 +47,6 @@
-     fi
- }
- 
--# Check if /usr/local/share/aclocal exists
--if [ -d /usr/local/share/aclocal ]; then
--	ACLOCAL_INCLUDE="$ACLOCAL_INCLUDE -I /usr/local/share/aclocal"
--fi	
--
- run_cmd aclocal -I m4 $ACLOCAL_INCLUDE
- run_cmd $LIBTOOLIZE --automake --copy
- run_cmd automake --add-missing --copy
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 99e47b0b303f..4ea16a59e8b4 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which,
-  fetchpatch }:
+{ stdenv, lib, buildPackages, automake, autoconf, libtool, which,
+  fetchpatch, openexr }:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
-  version = "2.3.0";
+  version = lib.getVersion openexr;
 
-  src = fetchurl {
-    url = "https://github.com/openexr/openexr/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0qiq5bqq9rxhqjiym2k36sx4vq8adgrz6xf6qwizi9bqm78phsa5";
-  };
+  # the project no longer provides separate tarballs. We may even want to merge
+  # the ilmbase package into openexr in the future.
+  src = openexr.src;
+
+  sourceRoot = "source/IlmBase";
 
   outputs = [ "out" "dev" ];
 
@@ -23,15 +24,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_LINK = "-pthread";
 
   patches = [
-    ./bootstrap.patch
     ./cross.patch
-    (fetchpatch {
-      name = "CVE-2018-18443.patch";
-      url = "https://github.com/kdt3rd/openexr/commit/5fa930b82cff2db386c64ca512af19e60c14d32a.patch";
-      sha256 = "1j6xd0qkx99acc1szycxaj0wwp01yac67jz48hwc4fwwpz8blx4s";
-      stripLen = 1;
-      excludes = [ "CHANGES.md" ];
-    })
   ];
 
   # fails 1 out of 1 tests with
diff --git a/pkgs/development/libraries/openexr/bootstrap.patch b/pkgs/development/libraries/openexr/bootstrap.patch
deleted file mode 100644
index af6669c16a45..000000000000
--- a/pkgs/development/libraries/openexr/bootstrap.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -ur openexr-v2.2.0-src-orig/OpenEXR/bootstrap openexr-v2.2.0-src/OpenEXR/bootstrap
---- OpenEXR/bootstrap	2015-03-31 01:02:41.000000000 -0400
-+++ OpenEXR/bootstrap	2015-03-31 01:03:35.000000000 -0400
-@@ -47,11 +47,6 @@
-     fi
- }
- 
--# Check if /usr/local/share/aclocal exists
--if [ -d /usr/local/share/aclocal ]; then
--	ACLOCAL_INCLUDE="$ACLOCAL_INCLUDE -I /usr/local/share/aclocal"
--fi	
--
- run_cmd aclocal -I m4 $ACLOCAL_INCLUDE
- run_cmd $LIBTOOLIZE --automake --copy
- run_cmd automake --add-missing --copy
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 328bce35357f..da8fb4294650 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, libtool, pkgconfig,
+{ lib, stdenv, buildPackages, fetchFromGitHub, autoconf, automake, libtool, pkgconfig,
   zlib, ilmbase, fetchpatch }:
 
 let
@@ -8,22 +8,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = lib.getVersion ilmbase;
+  version = "2.4.1";
 
-  src = fetchurl {
-    url = "https://github.com/openexr/openexr/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "19jywbs9qjvsbkvlvzayzi81s976k53wg53vw4xj66lcgylb6v7x";
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "openexr";
+    rev = "v${version}";
+    sha256 = "020gyl8zv83ag6gbcchmqiyx9rh2jca7j8n52zx1gk4rck7kwc01";
   };
 
-  patches = [
-    ./bootstrap.patch
-    (fetchpatch {
-      name = "CVE-2018-18444.patch";
-      url = "https://github.com/openexr/openexr/commit/1b0f1e5d7dcf2e9d6cbb4e005e803808b010b1e0.patch";
-      sha256 = "0f5m4wdwqqg8wfg7azzsz5yfpdrvws314rd4sqfc74j1g6wrcnqj";
-      stripLen = 1;
-    })
-  ];
+  sourceRoot = "source/OpenEXR";
 
   outputs = [ "bin" "dev" "out" "doc" ];