diff --git a/pkgs/development/libraries/nss/85_security_load.patch b/pkgs/development/libraries/nss/85_security_load.patch
index d20572a051ef..3e51e2908873 100644
--- a/pkgs/development/libraries/nss/85_security_load.patch
+++ b/pkgs/development/libraries/nss/85_security_load.patch
@@ -48,7 +48,7 @@ diff -ru nss-3.16-orig/nss/lib/util/secload.c nss-3.16/nss/lib/util/secload.c
 +    if (!c) { /* referencePath doesn't contain a / means that dladdr gave us argv[0]
 +               * and program was called from $PATH. Hack to get libs from NIX_NSS_LIBDIR */
 +        referencePath = NIX_NSS_LIBDIR;
-+        c = &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */
++        c = (char*) &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */
 +    }
      if (c) {
          size_t referencePathSize = 1 + c - referencePath;
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 47bb5cde228a..ee8e38a72965 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -11,11 +11,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.20.1";
+  version = "3.21";
 
   src = fetchurl {
-    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_20_1_RTM/src/${name}.tar.gz";
-    sha256 = "ad3c8f11dfd9570c2d04a6140d5ef7c2bdd0fe30d6c9e5548721a4251a5e8c97";
+    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_21_RTM/src/${name}.tar.gz";
+    sha256 = "3f7a5b027d7cdd5c0e4ff7544da33fdc6f56c2f8c27fff02938fd4a6fbe87239";
   };
 
   buildInputs = [ nspr perl zlib sqlite ];
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
   '';
 
   patches =
-    [ ./nss-3.17-gentoo-fixups.patch
+    [ ./nss-3.21-gentoo-fixups.patch
       # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
       ./85_security_load.patch
     ];
@@ -58,6 +58,8 @@ in stdenv.mkDerivation rec {
     "NSS_USE_SYSTEM_SQLITE=1"
   ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1";
 
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
   postInstall = ''
     rm -rf $out/private
     mv $out/public $out/include
diff --git a/pkgs/development/libraries/nss/nss-3.17-gentoo-fixups.patch b/pkgs/development/libraries/nss/nss-3.21-gentoo-fixups.patch
similarity index 82%
rename from pkgs/development/libraries/nss/nss-3.17-gentoo-fixups.patch
rename to pkgs/development/libraries/nss/nss-3.21-gentoo-fixups.patch
index 7948fc07150a..33819821c193 100644
--- a/pkgs/development/libraries/nss/nss-3.17-gentoo-fixups.patch
+++ b/pkgs/development/libraries/nss/nss-3.21-gentoo-fixups.patch
@@ -1,5 +1,6 @@
---- nss-3.17.1/nss/config/Makefile
-+++ nss-3.17.1/nss/config/Makefile
+diff -urN a/nss/config/Makefile b/nss/config/Makefile
+--- a/nss/config/Makefile	1969-12-31 18:00:00.000000000 -0600
++++ b/nss/config/Makefile	2015-11-15 10:42:46.249578304 -0600
 @@ -0,0 +1,40 @@
 +CORE_DEPTH = ..
 +DEPTH      = ..
@@ -41,8 +42,9 @@
 +
 +dummy: all export libs
 +
---- nss-3.17.1/nss/config/nss-config.in
-+++ nss-3.17.1/nss/config/nss-config.in
+diff -urN a/nss/config/nss-config.in b/nss/config/nss-config.in
+--- a/nss/config/nss-config.in	1969-12-31 18:00:00.000000000 -0600
++++ b/nss/config/nss-config.in	2015-11-15 10:42:46.250578304 -0600
 @@ -0,0 +1,145 @@
 +#!/bin/sh
 +
@@ -189,8 +191,9 @@
 +      echo $libdirs
 +fi      
 +
---- nss-3.17.1/nss/config/nss.pc.in
-+++ nss-3.17.1/nss/config/nss.pc.in
+diff -urN a/nss/config/nss.pc.in b/nss/config/nss.pc.in
+--- a/nss/config/nss.pc.in	1969-12-31 18:00:00.000000000 -0600
++++ b/nss/config/nss.pc.in	2015-11-15 10:42:46.251578304 -0600
 @@ -0,0 +1,12 @@
 +prefix=@prefix@
 +exec_prefix=@exec_prefix@
@@ -201,12 +204,13 @@
 +Description: Network Security Services
 +Version: @NSS_MAJOR_VERSION@.@NSS_MINOR_VERSION@.@NSS_PATCH_VERSION@
 +Requires: nspr >= 4.8
-+Libs: -L${libdir} -lssl3 -lsmime3 -lnss3 -lnssutil3
++Libs: -lssl3 -lsmime3 -lnss3 -lnssutil3
 +Cflags: -I${includedir}
 +
---- nss-3.17.1/nss/Makefile
-+++ nss-3.17.1/nss/Makefile
-@@ -44,7 +44,7 @@
+diff -urN a/nss/Makefile b/nss/Makefile
+--- a/nss/Makefile	2015-11-15 09:25:06.410786060 -0600
++++ b/nss/Makefile	2015-11-15 10:42:46.252578304 -0600
+@@ -46,7 +46,7 @@
  # (7) Execute "local" rules. (OPTIONAL).                              #
  #######################################################################
  
@@ -215,7 +219,7 @@
  
  nss_clean_all: clobber_nspr clobber
  
-@@ -109,12 +109,6 @@
+@@ -115,12 +115,6 @@
  	--with-dist-prefix='$(NSPR_PREFIX)' \
  	--with-dist-includedir='$(NSPR_PREFIX)/include'
  
@@ -228,14 +232,12 @@
  build_docs:
  	$(MAKE) -C $(CORE_DEPTH)/doc
  
---- nss-3.17.1/nss/manifest.mn
-+++ nss-3.17.1/nss/manifest.mn
-@@ -10,7 +10,7 @@
+diff -urN a/nss/manifest.mn b/nss/manifest.mn
+--- a/nss/manifest.mn	2015-11-15 09:25:06.411786060 -0600
++++ b/nss/manifest.mn	2015-11-15 10:43:15.633576994 -0600
+@@ -10,4 +10,4 @@
  
  RELEASE = nss
  
--DIRS = coreconf lib cmd
+-DIRS = coreconf lib cmd external_tests
 +DIRS = coreconf lib cmd config
- 
- ifdef NSS_BUILD_GTESTS
- DIRS += external_tests