{
  fetchgit,
  lib,
  makeWrapper,
  maven,
  openjdk21,
  wrapGAppsHook3,
  pkcs11-module ? null,
}: let
  jdk = openjdk21.override {
    enableJavaFX = true;
  };

  version = "2.0.0+master";
in
  maven.buildMavenPackage {
    pname = "firmador";
    inherit version;

    src = fetchgit {
      url = "https://codeberg.org/firmador/firmador";
      rev = "76a16ff5fa7c1a9c3f4a03359742fc09cb98b2c4";
      hash = "sha256-xzcJXIU3NFPUdwRNUvymScpBS1eeJYdb8ffevUbAS1o=";
    };

    patches = [
      ./0001-Remove-CheckUpdatePlugin-from-default-list.patch
    ];

    mvnJdk = jdk;
    mvnHash = "sha256-SCTXlLqc4SxWWZlQLJc+T7jM991LLwU9MqDALcbECsw=";

    nativeBuildInputs = [
      makeWrapper
      wrapGAppsHook3
    ];

    postPatch = lib.optionalString (pkcs11-module != null) ''
      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${pkcs11-module}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java
    '';

    installPhase = ''
      runHook preInstall

      mkdir -p $out/bin $out/share/java
      install -Dm644 target/firmador.jar $out/share/java

      makeWrapper ${jdk}/bin/java $out/bin/firmador \
        --add-flags "-jar $out/share/java/firmador.jar"

      runHook postInstall
    '';

    meta = {
      homepage = "https://firmador.libre.cr";
      license = lib.licenses.gpl3Plus;
    };
  }