{
  stalwart-mail,
  callPackage,
  nixLib,
}: let
  spamfilter = callPackage ./spam-filter.nix {};
in
  stalwart-mail.overrideAttrs (final: prev: {
    pname = "stalwart-mail-patched";

    passthru = nixLib.warnMerge (prev.passthru or {}) {
      # Use a reproducible source for the spamfilter instead of fetching it at runtime from GitHub.
      inherit spamfilter;
    } "stalwart-mail passthru";

    # The NixOS build tests should check if this works.
    # And this shaves of around 50% of the build time.
    doCheck = false;

    # We are already overriding it, so shaving of some unused features is okay.
    buildNoDefaultFeatures = true;
    buildFeatures = [
      # "sqlite"
      # "postgres"
      # "mysql"
      "rocks"
      # "elastic"
      # "s3"
      "redis"
      "tls-native-roots"
    ];

    cargoPatches =
      (prev.cargoPatches or [])
      ++ [
        # `stalwart-mail` uses their bundled store, which makes it impossible to use our
        # own CA certificate (e.g., for tests). Thus use a native version.
        ./patches/use-platform-ca-roots.patch
      ];

    # Check that the enterprise feature is really disabled.
    postCheck =
      (prev.postCheck or "")
      +
      # bash
      ''
        if grep "enterprise" ./target/*/release/stalwart-mail.d; then
          echo "ERROR: Proprietary 'enterprise' feature active."
          exit 1
        fi
      '';

    meta.mainProgram = prev.meta.mainProgram or "stalwart-mail";
  })