diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 7c0c6476bd0..343118fb587 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.6";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "1wg3sprl0bzy49cmbwwm91vw67hk1x5i3ksdygsciyxz587hsk6j";
+    sha256 = "0qpi1qp3bcvqdsaxy2pzg530db95x8qjahkynxgwvr6dy5760ald";
   };
 })
diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index 735fe373533..edaebc21352 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation ({
   nativeBuildInputs = [ gnum4 ];
   propagatedBuildInputs = [ gmp ];
 
-  configureFlags = [ "--enable-fat" ]; # runtime selection of HW-accelerated code
+  configureFlags = [ "--enable-fat" ]; # runtime selection of HW-accelerated code; it's default since 3.7
 
   doCheck = (stdenv.hostPlatform.system != "i686-cygwin" && !stdenv.isDarwin);