diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 1cdf7ad2ed0..a31846c54aa 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -19,11 +19,11 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "samba-4.2.3";
+  name = "samba-4.2.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${name}.tar.gz";
-    sha256 = "0z2c17d2id0m59mfdxdljhizp97l29clmw6g5zp93n0q92pabpxn";
+    sha256 = "1hsakc8h6rs48xr6i55m90pd53hpxcqjjnlwq8i2rp0nq4ws5sip";
   };
 
   patches =
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d66ebf21e1a..16f19bdc7d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9153,6 +9153,7 @@ let
   samba4 = callPackage ../servers/samba/4.x.nix {
     python = python2;
     kerberos = null;  # Bundle kerberos because samba uses internal, non-stable functions
+    gnutls = gnutls33;
     # enableLDAP
   };