diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 8c5df4cc9ae..9950e1f7177 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,32 +1,35 @@
-{ fetchurl, stdenv, zlib, lzo, libgcrypt
+{ fetchurl, stdenv, zlib, lzo, libtasn1, libgcrypt
 , guileBindings, guile }:
 
 assert guileBindings -> guile != null;
 
 stdenv.mkDerivation rec {
 
-  name = "gnutls-2.8.4";
+  name = "gnutls-2.8.5";
 
   src = fetchurl {
     url = "mirror://gnu/gnutls/${name}.tar.bz2";
-    sha256 = "175qn6m9h5mj77qa0wf3v290cf4ya9z1r01kgg1zz8gpbmxz98a4";
+    sha256 = "1s6a2plds995q8rb8x19rz3c8v6xfqc4wvqqw01f6l8myyfw4jcj";
   };
 
+  patches = [ ./gnutls-cli-libgcrypt.patch ];
+
   configurePhase = ''
     ./configure --prefix="$out"                                 \
       --disable-dependency-tracking --enable-fast-install       \
+      --with-lzo --with-libtasn1-prefix="${libtasn1}"		\
       ${if guileBindings
         then "--enable-guile --with-guile-site-dir=\"$out/share/guile/site\""
         else ""}
   '';
 
-  buildInputs = [zlib lzo]
+  buildInputs = [ zlib lzo libtasn1 ]
     ++ stdenv.lib.optional guileBindings guile;
 
-  propagatedBuildInputs = [libgcrypt];
+  propagatedBuildInputs = [ libgcrypt ];
 
   doCheck = true;
-  
+
   meta = {
     description = "The GNU Transport Layer Security Library";
 
diff --git a/pkgs/development/libraries/gnutls/gnutls-cli-libgcrypt.patch b/pkgs/development/libraries/gnutls/gnutls-cli-libgcrypt.patch
new file mode 100644
index 00000000000..b8af852705d
--- /dev/null
+++ b/pkgs/development/libraries/gnutls/gnutls-cli-libgcrypt.patch
@@ -0,0 +1,14 @@
+This patch is to make sure `gnutls-cli' is explicitly linked against
+libgcrypt since it really needs to.
+
+--- gnutls-2.8.5/src/Makefile.in	2009-11-02 11:36:01.000000000 +0100
++++ gnutls-2.8.5/src/Makefile.in	2009-11-06 23:30:42.000000000 +0100
+@@ -840,6 +840,7 @@ libcmd_psk_la_CFLAGS = 
+ libcmd_psk_la_SOURCES = psk.gaa psk-gaa.h psk-gaa.c
+ gnutls_cli_SOURCES = cli.c common.h common.c
+ gnutls_cli_LDADD = ../lib/libgnutls.la ../libextra/libgnutls-extra.la \
++	-lgcrypt \
+ 	libcmd-cli.la ../gl/libgnu.la $(LIBSOCKET) $(GETADDRINFO_LIB)
+ libcmd_cli_la_CFLAGS = 
+ libcmd_cli_la_SOURCES = cli.gaa cli-gaa.h cli-gaa.c
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e3fa8377103..f7b5bbeb8d1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3533,7 +3533,7 @@ let
   };
 
   gnutls = import ../development/libraries/gnutls {
-    inherit fetchurl stdenv libgcrypt zlib lzo guile;
+    inherit fetchurl stdenv libgcrypt zlib lzo libtasn1 guile;
     guileBindings = getConfig ["gnutls" "guile"] true;
   };