diff --git a/pkgs/tools/networking/shadowfox/default.nix b/pkgs/tools/networking/shadowfox/default.nix
index 109188d0b1b5..5b0eae5a595f 100644
--- a/pkgs/tools/networking/shadowfox/default.nix
+++ b/pkgs/tools/networking/shadowfox/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, fetchpatch }:
 
 buildGoModule rec {
   pname = "shadowfox";
@@ -11,7 +11,16 @@ buildGoModule rec {
     sha256 = "125mw70jidbp436arhv77201jdp6mpgqa2dzmrpmk55f9bf29sg6";
   };
 
-  vendorSha256 = null; #vendorSha256 = "";
+  patches = [
+    # get vendoring to work with go1.20
+    # https://github.com/arguablykomodo/shadowfox-updater/pull/70
+    (fetchpatch {
+      url = "https://github.com/arguablykomodo/shadowfox-updater/commit/c16be00829373e0de7de47d6fb4d4c341fc36f75.patch";
+      hash = "sha256-buijhFLI8Sf9qBDntf689Xcpr6me+aVDoRqwSIcKKEw=";
+    })
+  ];
+
+  vendorHash = "sha256-3pHwyktSGxNM7mt0nPOe6uixS+bBJH9R8xqCyY6tlb0=";
 
   doCheck = false;
 
@@ -27,6 +36,5 @@ buildGoModule rec {
     license = licenses.mit;
     maintainers = with maintainers; [ infinisil ];
     mainProgram = "shadowfox-updater";
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }