diff --git a/nixos/tests/cloud-init.nix b/nixos/tests/cloud-init.nix
index aafa6e24e84..8debb9e8ed9 100644
--- a/nixos/tests/cloud-init.nix
+++ b/nixos/tests/cloud-init.nix
@@ -24,7 +24,8 @@ let
       instance-id: iid-local01
       local-hostname: "test"
       public-keys:
-          - "should be a key!"
+        ec2-keypair.us-east-1:
+          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5L7Xuh49VS5VQheFE7VDmXKH0BOnB1R0avAE91QgOB root@test
       EOF
       ${pkgs.cdrkit}/bin/genisoimage -volid cidata -joliet -rock -o $out/metadata.iso $out/iso
       '';
@@ -45,8 +46,6 @@ in makeTest {
       machine.wait_for_unit("cloud-init.service")
       machine.succeed("cat /tmp/cloudinit-write-file | grep -q 'cloudinit'")
 
-      machine.wait_until_succeeds(
-          "cat /root/.ssh/authorized_keys | grep -q 'should be a key!'"
-      )
+      machine.wait_until_succeeds("cat /root/.ssh/authorized_keys | grep -q root@test")
   '';
 }
diff --git a/pkgs/tools/virtualization/cloud-init/add-nixos-support.patch b/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
similarity index 73%
rename from pkgs/tools/virtualization/cloud-init/add-nixos-support.patch
rename to pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
index 00cb7d070c6..ef8f2b65ca0 100644
--- a/pkgs/tools/virtualization/cloud-init/add-nixos-support.patch
+++ b/pkgs/tools/virtualization/cloud-init/0001-add-nixos-support.patch
@@ -1,18 +1,36 @@
-diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/__init__.py cloud-init-0.7.6/cloudinit/distros/__init__.py
---- cloud-init-0.7.6.orig/cloudinit/distros/__init__.py	2014-10-10 15:26:25.000000000 +0000
-+++ cloud-init-0.7.6/cloudinit/distros/__init__.py	2016-06-08 07:51:45.230357099 +0000
-@@ -43,6 +43,7 @@
+From 64a767136c16aad2b94b4d9a3268b0d4deba7272 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Tue, 18 Aug 2020 10:22:36 +0100
+Subject: [PATCH] add nixos support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ cloudinit/distros/__init__.py |   1 +
+ cloudinit/distros/nixos.py    | 103 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 104 insertions(+)
+ create mode 100644 cloudinit/distros/nixos.py
+
+diff --git a/cloudinit/distros/__init__.py b/cloudinit/distros/__init__.py
+index c7163e1c..c147e2b3 100755
+--- a/cloudinit/distros/__init__.py
++++ b/cloudinit/distros/__init__.py
+@@ -46,6 +46,7 @@ OSFAMILIES = {
      'freebsd': ['freebsd'],
-     'suse': ['sles'],
+     'suse': ['opensuse', 'sles'],
      'arch': ['arch'],
 +    'nixos': ['nixos'],
  }
  
  LOG = logging.getLogger(__name__)
-diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/nixos.py cloud-init-0.7.6/cloudinit/distros/nixos.py
---- cloud-init-0.7.6.orig/cloudinit/distros/nixos.py	1970-01-01 00:00:00.000000000 +0000
-+++ cloud-init-0.7.6/cloudinit/distros/nixos.py	2016-06-08 07:50:58.602616595 +0000
-@@ -0,0 +1,98 @@
+diff --git a/cloudinit/distros/nixos.py b/cloudinit/distros/nixos.py
+new file mode 100644
+index 00000000..d53d2a61
+--- /dev/null
++++ b/cloudinit/distros/nixos.py
+@@ -0,0 +1,103 @@
 +# vi: ts=4 expandtab
 +#
 +#    Copyright (C) 2012 Canonical Ltd.
@@ -35,10 +53,13 @@ diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/nixos.py cloud-init-0.7.6/clou
 +#    You should have received a copy of the GNU General Public License
 +#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +
++import os
++
 +from cloudinit import distros
 +from cloudinit import helpers
 +from cloudinit import log as logging
 +from cloudinit import util
++from cloudinit import atomic_helper
 +
 +from cloudinit.distros.parsers.hostname import HostnameConf
 +
@@ -52,6 +73,8 @@ diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/nixos.py cloud-init-0.7.6/clou
 +        # calls from repeatly happening (when they
 +        # should only happen say once per instance...)
 +        self._runner = helpers.Runners(paths)
++        self.usr_lib_exec = os.path.join(os.path.dirname(__file__),
++                                         "../../../../../libexec")
 +        self.osfamily = 'nixos'
 +
 +    def _select_hostname(self, hostname, fqdn):
@@ -72,7 +95,7 @@ diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/nixos.py cloud-init-0.7.6/clou
 +        if not conf:
 +            conf = HostnameConf('')
 +        conf.set_hostname(your_hostname)
-+        util.write_file(out_fn, str(conf), 0644)
++        atomic_helper.write_file(out_fn, str(conf).encode("utf-8"))
 +
 +    def _read_system_hostname(self):
 +        sys_hostname = self._read_hostname(self.hostname_conf_fn)
@@ -111,3 +134,6 @@ diff -ruN cloud-init-0.7.6.orig/cloudinit/distros/nixos.py cloud-init-0.7.6/clou
 +
 +    def update_package_sources(self):
 +        raise NotImplementedError()
+-- 
+2.28.0
+
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index bf932ff1ad4..66ce16d985e 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -1,40 +1,83 @@
-{ lib, pythonPackages, fetchurl, cloud-utils }:
+{ lib
+, fetchFromGitHub
+, buildPythonApplication
+, jinja2
+, oauthlib
+, configobj
+, pyyaml
+, requests
+, jsonschema
+, jsonpatch
+, pytest
+, httpretty
+, dmidecode
+, pytestCheckHook
+, shadow
+, cloud-utils
+, openssh
+}:
 
-let version = "0.7.9";
+let version = "20.2";
 
-in pythonPackages.buildPythonApplication {
+in buildPythonApplication {
   pname = "cloud-init";
   inherit version;
   namePrefix = "";
 
-  src = fetchurl {
-    url = "https://launchpad.net/cloud-init/trunk/${version}/+download/cloud-init-${version}.tar.gz";
-    sha256 = "0wnl76pdcj754pl99wxx76hkir1s61x0bg0lh27sdgdxy45vivbn";
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "cloud-init";
+    rev = version;
+    sha256 = "sha256-QeY/fdIIUSsp5oNxyRtZwpTB747Jf5KAJuYY9yiKUvc=";
   };
 
-  patches = [ ./add-nixos-support.patch ];
+  patches = [ ./0001-add-nixos-support.patch ];
   prePatch = ''
-    patchShebangs ./tools
+    substituteInPlace setup.py --replace /lib/systemd $out/lib/systemd
+  '';
 
-    substituteInPlace setup.py \
-      --replace /usr $out \
-      --replace /etc $out/etc \
-      --replace /lib/systemd $out/lib/systemd \
-      --replace 'self.init_system = ""' 'self.init_system = "systemd"'
+  postInstall = ''
+    install -D -m755 ./tools/write-ssh-key-fingerprints $out/libexec/write-ssh-key-fingerprints
+    for i in $out/libexec/*; do
+      wrapProgram $i --prefix PATH : "${lib.makeBinPath [ openssh ]}"
+    done
+  '';
 
-    substituteInPlace cloudinit/config/cc_growpart.py \
-      --replace 'util.subp(["growpart"' 'util.subp(["${cloud-utils}/bin/growpart"'
+  propagatedBuildInputs = [
+    jinja2
+    oauthlib
+    configobj
+    pyyaml
+    requests
+    jsonschema
+    jsonpatch
+  ];
 
-    # Argparse is part of python stdlib
-    sed -i s/argparse// requirements.txt
-    '';
+  checkInputs = [
+    pytestCheckHook
+    httpretty
+    dmidecode
+    # needed for tests; at runtime we rather want the setuid wrapper
+    shadow
+  ];
 
-  propagatedBuildInputs = with pythonPackages; [ cheetah jinja2 prettytable
-    oauthlib pyserial configobj pyyaml requests jsonpatch ];
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [
+      dmidecode cloud-utils.guest
+    ]}/bin"
+  ];
 
-  checkInputs = with pythonPackages; [ contextlib2 httpretty mock unittest2 ];
+  disabledTests = [
+    # tries to create /var
+    "test_dhclient_run_with_tmpdir"
+    # clears path and fails because mkdir is not found
+    "test_path_env_gets_set_from_main"
+  ];
 
-  doCheck = false;
+  preCheck = ''
+    # TestTempUtils.test_mkdtemp_default_non_root does not like TMPDIR=/build
+    export TMPDIR=/tmp
+  '';
 
   meta = {
     homepage = "https://cloudinit.readthedocs.org";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41e7af4c09d..0ca018ee10b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1557,7 +1557,7 @@ in
 
   clog-cli = callPackage ../development/tools/clog-cli { };
 
-  cloud-init = callPackage ../tools/virtualization/cloud-init { };
+  cloud-init = python3.pkgs.callPackage ../tools/virtualization/cloud-init { };
 
   cloudflared = callPackage ../applications/networking/cloudflared { };