diff --git a/pkgs/development/libraries/libpwquality/default.nix b/pkgs/development/libraries/libpwquality/default.nix
index dd610989617b..d80f4c8ab318 100644
--- a/pkgs/development/libraries/libpwquality/default.nix
+++ b/pkgs/development/libraries/libpwquality/default.nix
@@ -1,14 +1,15 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, fetchpatch
-, autoreconfHook
-, perl
-, cracklib
-, enablePAM ? stdenv.hostPlatform.isLinux
-, pam
-, enablePython ? false
-, python
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  autoreconfHook,
+  perl,
+  cracklib,
+  enablePAM ? stdenv.hostPlatform.isLinux,
+  pam,
+  enablePython ? false,
+  python,
 }:
 
 # python binding generates a shared library which are unavailable with musl build
@@ -18,7 +19,12 @@ stdenv.mkDerivation rec {
   pname = "libpwquality";
   version = "1.4.5";
 
-  outputs = [ "out" "dev" "lib" "man" ] ++ lib.optionals enablePython [ "py" ];
+  outputs = [
+    "out"
+    "dev"
+    "lib"
+    "man"
+  ] ++ lib.optionals enablePython [ "py" ];
 
   src = fetchFromGitHub {
     owner = "libpwquality";
@@ -27,21 +33,53 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-YjvHzd4iEBvg+qHOVJ7/y9HqyeT+QDalNE/jdNM9BNs=";
   };
 
-  patches = [
-    # ensure python site-packages goes in $py output
-    ./python-binding-prefix.patch
+  patches =
+    lib.optionals (!enablePython) [
+      # this patch isn't useful but keeping it to avoid rebuilds on !enablePython
+      # before 24.11 fully lands
+      ./python-binding-prefix.patch
+    ]
+    ++ [
+      # remove next release
+      (fetchpatch {
+        name = "musl.patch";
+        url = "https://github.com/libpwquality/libpwquality/commit/b0fcd96954be89e8c318e5328dd27c40b401de96.patch";
+        hash = "sha256-ykN1hcRKyX3QAqWTH54kUjOxN6+IwRpqQVsujTd9XWs=";
+      })
+    ]
+    ++ lib.optionals enablePython [
+      # remove next release
+      (fetchpatch {
+        name = "pr-74-use-setuptools-instead-of-distutils.patch";
+        url = "https://github.com/libpwquality/libpwquality/commit/509b0a744adf533b524daaa65f25dda144a6ff40.patch";
+        hash = "sha256-AxiynPVxv/gONujyj8y6b1XlsNkKszzW5TT9oINR/oo=";
+      })
+      # remove next release
+      (fetchpatch {
+        name = "pr-80-respect-pythonsitedir.patch";
+        url = "https://github.com/libpwquality/libpwquality/commit/f92351b3998542e33d2b243fc446a4dd852dc972.patch";
+        hash = "sha256-1lmigZX/UiEFe9b0JXmlfw/371UYT4PF7Ev2Hv66v74=";
+      })
+      # ensure python site-packages goes in $py output
+      ./python-binding-root.patch
+    ];
 
-    (fetchpatch {
-      name = "musl.patch";
-      url = "https://github.com/libpwquality/libpwquality/commit/b0fcd96954be89e8c318e5328dd27c40b401de96.patch";
-      hash = "sha256-ykN1hcRKyX3QAqWTH54kUjOxN6+IwRpqQVsujTd9XWs=";
-    })
-  ];
-
-  nativeBuildInputs = [ autoreconfHook perl ] ++ lib.optionals enablePython [ (python.withPackages (ps: with ps; [ distutils ])) ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+  ] ++ lib.optionals enablePython [ (python.withPackages (ps: with ps; [ setuptools ])) ];
   buildInputs = [ cracklib ] ++ lib.optionals enablePAM [ pam ];
 
-  configureFlags = lib.optionals (!enablePython) [ "--disable-python-bindings" ];
+  configureFlags =
+    if enablePython then
+      [
+        "--enable-python-bindings=yes"
+        "--with-pythonsitedir=\"${python.sitePackages}\""
+      ]
+    else
+      # change to `--enable-python-bindings=no` in the future
+      # leave for now to avoid rebuilds on !enablePython before 24.11 fully lands
+      [ "--disable-python-bindings" ];
 
   meta = with lib; {
     homepage = "https://github.com/libpwquality/libpwquality";
@@ -57,7 +95,11 @@ stdenv.mkDerivation rec {
       function and PAM module that can be used instead of pam_cracklib. The
       module supports all the options of pam_cracklib.
     '';
-    license = with licenses; [ bsd3 /* or */ gpl2Plus ];
+    license = with licenses; [
+      bsd3
+      # or
+      gpl2Plus
+    ];
     maintainers = with maintainers; [ jk ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/libpwquality/python-binding-root.patch b/pkgs/development/libraries/libpwquality/python-binding-root.patch
new file mode 100644
index 000000000000..9c789bf2d07d
--- /dev/null
+++ b/pkgs/development/libraries/libpwquality/python-binding-root.patch
@@ -0,0 +1,13 @@
+diff --git a/python/Makefile.am b/python/Makefile.am
+index 64d3892..365dc8e 100644
+--- a/python/Makefile.am
++++ b/python/Makefile.am
+@@ -14,7 +14,7 @@ all-local:
+ 	CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV)
+ 
+ install-exec-local:
+-	CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix} --install-lib=$(pythonsitedir)
++	CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${py} --install-lib=$(pythonsitedir)
+ 
+ clean-local:
+ 	rm -rf py$(PYTHONREV)