diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index ec4e72dba079..5ac637ed6b1c 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -1,20 +1,27 @@
-{ stdenv, fetchurl, coreutils, utillinux,
-  which, gnused, gnugrep,
-  groff, man-db, getent, libiconv, pcre2,
-  gettext, ncurses, python3,
-  cmake
-  , fetchpatch
-
-  , writeText
-  , nixosTests
-  , useOperatingSystemEtc ? true
+{ stdenv
+, lib
+, fetchurl
+, coreutils
+, utillinux
+, which
+, gnused
+, gnugrep
+, groff
+, man-db
+, getent
+, libiconv
+, pcre2
+, gettext
+, ncurses
+, python3
+, cmake
 
+, writeText
+, nixosTests
+, useOperatingSystemEtc ? true
 }:
-
-with stdenv.lib;
-
 let
-  etcConfigAppendixText = ''
+  etcConfigAppendix = writeText "config.fish.appendix" ''
     ############### ↓ Nix hook for sourcing /etc/fish/config.fish ↓ ###############
     #                                                                             #
     # Origin:
@@ -46,7 +53,7 @@ let
     ############### ↑ Nix hook for sourcing /etc/fish/config.fish ↑ ###############
   '';
 
-  fishPreInitHooks = ''
+  fishPreInitHooks = writeText "__fish_build_paths_suffix.fish" ''
     # source nixos environment
     # note that this is required:
     #   1. For all shells, not just login shells (mosh needs this as do some other command-line utilities)
@@ -90,40 +97,49 @@ let
 
   fish = stdenv.mkDerivation rec {
     pname = "fish";
-    version = "3.1.0";
-
-    etcConfigAppendix = builtins.toFile "etc-config.appendix.fish" etcConfigAppendixText;
+    version = "3.1.1";
 
     src = fetchurl {
-      # There are differences between the release tarball and the tarball github packages from the tag
-      # Hence we cannot use fetchFromGithub
+      # There are differences between the release tarball and the tarball GitHub
+      # packages from the tag. Specifically, it comes with a file containing its
+      # version, which is used in `build_tools/git_version_gen.sh` to determine
+      # the shell's actual version (and what it displays when running `fish
+      # --version`), as well as the local documentation for all builtins (and
+      # maybe other things).
       url = "https://github.com/fish-shell/fish-shell/releases/download/${version}/${pname}-${version}.tar.gz";
-      sha256 = "0s2356mlx7fp9kgqgw91lm5ds2i9iq9hq071fbqmcp3875l1xnz5";
+      sha256 = "1f12c56v7n4s0f9mi9xinviwj6kpwlcjwaig1d4vsk5wlgp7ip07";
     };
 
-    nativeBuildInputs = [ cmake ];
-    buildInputs = [ ncurses libiconv pcre2 ];
+    # We don't have access to the codesign executable, so we patch this out.
+    # For more information, see: https://github.com/fish-shell/fish-shell/issues/6952
+    patches = lib.optional stdenv.isDarwin ./dont-codesign-on-mac.diff;
+
+    nativeBuildInputs = [
+      cmake
+    ];
+
+    buildInputs = [
+      ncurses
+      libiconv
+      pcre2
+    ];
 
     preConfigure = ''
       patchShebangs ./build_tools/git_version_gen.sh
     '';
 
-    patches = [
-      # Fixes compilation on old Apple SDKs
-      (fetchpatch {
-        url = "https://github.com/fish-shell/fish-shell/commit/10385d422b3e2a823faebfdaf13edd0e7f48a27f.patch";
-        sha256 = "0hj13kyjf5wr9j5afd4mfylcr7mz68ilbncbcf307drk1lv1lvrn";
-      })
-    ];
-
     # Required binaries during execution
     # Python: Autocompletion generated from manpages and config editing
     propagatedBuildInputs = [
-      coreutils gnugrep gnused
-      python3 groff gettext
-    ] ++ optional (!stdenv.isDarwin) man-db;
+      coreutils
+      gnugrep
+      gnused
+      python3
+      groff
+      gettext
+    ] ++ lib.optional (!stdenv.isDarwin) man-db;
 
-    postInstall = ''
+    postInstall = with lib; ''
       sed -r "s|command grep|command ${gnugrep}/bin/grep|" \
           -i "$out/share/fish/functions/grep.fish"
       sed -i "s|which |${which}/bin/which |"               \
@@ -169,14 +185,14 @@ let
       sed -i "s|command manpath|command ${man-db}/bin/manpath|"     \
               "$out/share/fish/functions/man.fish"
     '' + optionalString useOperatingSystemEtc ''
-      tee -a $out/etc/fish/config.fish < ${(writeText "config.fish.appendix" etcConfigAppendixText)}
+      tee -a $out/etc/fish/config.fish < ${etcConfigAppendix}
     '' + ''
-      tee -a $out/share/fish/__fish_build_paths.fish < ${(writeText "__fish_build_paths_suffix.fish" fishPreInitHooks)}
+      tee -a $out/share/fish/__fish_build_paths.fish < ${fishPreInitHooks}
     '';
 
     enableParallelBuilding = true;
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "Smart and user-friendly command line shell";
       homepage = "http://fishshell.com/";
       license = licenses.gpl2;
@@ -195,21 +211,22 @@ let
     # Test the fish_config tool by checking the generated splash page.
     # Since the webserver requires a port to run, it is not started.
     fishConfig =
-      let fishScript = writeText "test.fish" ''
-        set -x __fish_bin_dir ${fish}/bin
-        echo $__fish_bin_dir
-        cp -r ${fish}/share/fish/tools/web_config/* .
-        chmod -R +w *
-        # we delete everything after the fileurl is assigned
-        sed -e '/fileurl =/q' -i webconfig.py
-        echo "print(fileurl)" >> webconfig.py
-        # and check whether the message appears on the page
-        cat (${python3}/bin/python ./webconfig.py \
-          | tail -n1 | sed -ne 's|.*\(/tmp/.*\)|\1|p' \
-        ) | grep 'a href="http://localhost.*Start the Fish Web config'
+      let
+        fishScript = writeText "test.fish" ''
+          set -x __fish_bin_dir ${fish}/bin
+          echo $__fish_bin_dir
+          cp -r ${fish}/share/fish/tools/web_config/* .
+          chmod -R +w *
+          # we delete everything after the fileurl is assigned
+          sed -e '/fileurl =/q' -i webconfig.py
+          echo "print(fileurl)" >> webconfig.py
+          # and check whether the message appears on the page
+          cat (${python3}/bin/python ./webconfig.py \
+            | tail -n1 | sed -ne 's|.*\(/tmp/.*\)|\1|p' \
+          ) | grep 'a href="http://localhost.*Start the Fish Web config'
 
-        # cannot test the http server because it needs a localhost port
-      '';
+          # cannot test the http server because it needs a localhost port
+        '';
       in ''
         HOME=$(mktemp -d)
         ${fish}/bin/fish ${fishScript}
@@ -217,6 +234,6 @@ let
   };
 
   # FIXME(Profpatsch) replace withTests stub
-  withTests = flip const;
-
-in withTests tests fish
+  withTests = with lib; flip const;
+in
+withTests tests fish
diff --git a/pkgs/shells/fish/dont-codesign-on-mac.diff b/pkgs/shells/fish/dont-codesign-on-mac.diff
new file mode 100644
index 000000000000..c61350b0549f
--- /dev/null
+++ b/pkgs/shells/fish/dont-codesign-on-mac.diff
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7d220a032..786b60e6e 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -183,7 +183,6 @@ ENDFUNCTION(CODESIGN_ON_MAC target)
+ # Define a function to link dependencies.
+ FUNCTION(FISH_LINK_DEPS_AND_SIGN target)
+   TARGET_LINK_LIBRARIES(${target} fishlib)
+-  CODESIGN_ON_MAC(${target})
+ ENDFUNCTION(FISH_LINK_DEPS_AND_SIGN)
+ 
+ # Define libfish.a.