diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 4d7306ddf87e..2e0b2c040085 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -255,6 +255,8 @@
 
 - `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.
 
+-  zigbee2mqtt is now available in version 2.x as `zigbee2mqtt_2`. In NixOS 25.11 we'll remove `zigbee2mqtt_1` and default to `zigbee2mqtt_2`. See the [breaking changes](https://github.com/Koenkk/zigbee2mqtt/discussions/24198) announcement for 2.0.0.
+
 - `nodePackages.vls` has been deprecated, as the upstream consumer of it, vetur, has been deprecated by upstream. Upstream suggests migrating to Volar for Vue LSP tooling instead.
 
 - `nodePackages.create-react-native-app` has been removed, as it is deprecated. Upstream suggests using a framework for React Native apps instead.
diff --git a/nixos/modules/services/home-automation/zigbee2mqtt.nix b/nixos/modules/services/home-automation/zigbee2mqtt.nix
index 42c3214ef4f3..678942950ca1 100644
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@@ -125,6 +125,7 @@ in
         SystemCallFilter = [
           "@system-service @pkey"
           "~@privileged @resources"
+          "@chown"
         ];
         UMask = "0077";
       };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fbe68565de82..1779dc065904 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1218,7 +1218,14 @@ in {
   zenohd = handleTest ./zenohd.nix {};
   zeronet-conservancy = handleTest ./zeronet-conservancy.nix {};
   zfs = handleTest ./zfs.nix {};
-  zigbee2mqtt = handleTest ./zigbee2mqtt.nix {};
+  zigbee2mqtt_1 = runTest {
+    imports = [ ./zigbee2mqtt.nix ];
+    _module.args.package = pkgs.zigbee2mqtt_1;
+  };
+  zigbee2mqtt_2 = runTest {
+    imports = [ ./zigbee2mqtt.nix ];
+    _module.args.package = pkgs.zigbee2mqtt_2;
+  };
   zipline = handleTest ./zipline.nix {};
   zoneminder = handleTest ./zoneminder.nix {};
   zookeeper = handleTest ./zookeeper.nix {};
diff --git a/nixos/tests/zigbee2mqtt.nix b/nixos/tests/zigbee2mqtt.nix
index 3b7b6a8033b0..bcc1f4ea45f7 100644
--- a/nixos/tests/zigbee2mqtt.nix
+++ b/nixos/tests/zigbee2mqtt.nix
@@ -1,34 +1,44 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "zigbee2mqtt";
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        systemd.services.dummy-serial = {
-          wantedBy = [
-            "multi-user.target"
-          ];
-          serviceConfig = {
-            ExecStart = "${pkgs.socat}/bin/socat pty,link=/dev/ttyACM0,mode=666 pty,link=/dev/ttyACM1";
-          };
-        };
+{
+  lib,
+  package,
+  pkgs,
+  ...
+}:
 
-        services.zigbee2mqtt = {
-          enable = true;
-        };
-
-        systemd.services.zigbee2mqtt.serviceConfig.DevicePolicy = lib.mkForce "auto";
+let
+  error =
+    if lib.versionOlder package.version "2" then
+      "Inappropriate ioctl for device, cannot set"
+    else
+      "No valid USB adapter found";
+in
+{
+  name = "zigbee2mqtt-${lib.versions.major package.version}.x";
+  nodes.machine = {
+    systemd.services.dummy-serial = {
+      wantedBy = [
+        "multi-user.target"
+      ];
+      serviceConfig = {
+        ExecStart = "${pkgs.socat}/bin/socat pty,link=/dev/ttyACM0,mode=666 pty,link=/dev/ttyACM1";
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_until_fails("systemctl status zigbee2mqtt.service")
-      machine.succeed(
-          "journalctl -eu zigbee2mqtt | grep 'Error: Inappropriate ioctl for device, cannot set'"
-      )
+    services.zigbee2mqtt = {
+      enable = true;
+      inherit package;
+    };
 
-      machine.log(machine.succeed("systemd-analyze security zigbee2mqtt.service"))
-    '';
-  }
-)
+    systemd.services.zigbee2mqtt.serviceConfig.DevicePolicy = lib.mkForce "auto";
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_fails("systemctl status zigbee2mqtt.service")
+    machine.succeed(
+        "journalctl -eu zigbee2mqtt | grep '${error}'"
+    )
+
+    machine.log(machine.succeed("systemd-analyze security zigbee2mqtt.service"))
+  '';
+}
diff --git a/pkgs/by-name/zi/zigbee2mqtt_1/package.nix b/pkgs/by-name/zi/zigbee2mqtt_1/package.nix
index 71d7e9501db8..91485153133b 100644
--- a/pkgs/by-name/zi/zigbee2mqtt_1/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt_1/package.nix
@@ -28,7 +28,7 @@ buildNpmPackage rec {
 
   npmFlags = lib.optionals (!withSystemd) [ "--omit=optional" ];
 
-  passthru.tests.zigbee2mqtt = nixosTests.zigbee2mqtt;
+  passthru.tests.zigbee2mqtt = nixosTests.zigbee2mqtt_1;
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
new file mode 100644
index 000000000000..a650ac2522d6
--- /dev/null
+++ b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nodejs,
+  npmHooks,
+  pnpm_9,
+  systemdMinimal,
+  nixosTests,
+  nix-update-script,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdMinimal,
+}:
+
+let
+  pnpm = pnpm_9;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zigbee2mqtt";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Koenkk";
+    repo = "zigbee2mqtt";
+    tag = finalAttrs.version;
+    hash = "sha256-YVsQ4Zo0nlIb9m4wiK7xcqB7eE/h2ZvTTqEYLDagoHM=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Wr7FngKfedUrtOLpaTxvAdJZfCXo1/+oLMIJMOCgafk=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmInstallHook
+    pnpm.configHook
+  ];
+
+  buildInputs = lib.optionals withSystemd [
+    systemdMinimal
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  dontNpmPrune = true;
+
+  passthru.tests.zigbee2mqtt = nixosTests.zigbee2mqtt_2;
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    changelog = "https://github.com/Koenkk/zigbee2mqtt/releases/tag/${finalAttrs.version}";
+    description = "Zigbee to MQTT bridge using zigbee-shepherd";
+    homepage = "https://github.com/Koenkk/zigbee2mqtt";
+    license = licenses.gpl3;
+    longDescription = ''
+      Allows you to use your Zigbee devices without the vendor's bridge or gateway.
+
+      It bridges events and allows you to control your Zigbee devices via MQTT.
+      In this way you can integrate your Zigbee devices with whatever smart home infrastructure you are using.
+    '';
+    maintainers = with maintainers; [
+      sweber
+      hexa
+    ];
+    mainProgram = "zigbee2mqtt";
+  };
+})