diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index 2156214db6b01..c31f0cc06cb91 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -1,9 +1,16 @@
-{ lib, stdenv, fetchurl, writeText, conf ? null }:
+{ lib, stdenv, fetchurl, writeText, jq, conf ? {} }:
 
 # Note for maintainers:
 # Versions of `riot-web` and `riot-desktop` should be kept in sync.
 
-stdenv.mkDerivation rec {
+let
+  noPhoningHome = {
+    disable_guests = true; # disable automatic guest account registration at matrix.org
+    piwik = false; # disable analytics
+  };
+  configOverrides = writeText "riot-config-overrides.json" (builtins.toJSON (noPhoningHome // conf));
+
+in stdenv.mkDerivation rec {
   pname = "riot-web";
   version = "1.5.8";
 
@@ -12,16 +19,12 @@ stdenv.mkDerivation rec {
     sha256 = "112zjlmxy2s8qcd227laf1lfvbbwwcipn51xb779hy2dci48kpkx";
   };
 
-  installPhase = let
-    configFile = if (conf != null)
-      then writeText "riot-config.json" conf
-      else "$out/config.sample.json";
-  in ''
+  installPhase = ''
     runHook preInstall
 
     mkdir -p $out/
     cp -R . $out/
-    ln -s ${configFile} $out/config.json
+    ${jq}/bin/jq -s '.[0] * .[1]' "config.sample.json" "${configOverrides}" > "$out/config.json"
 
     runHook postInstall
   '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e0827c15d33c7..8eb15a3afd170 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2119,7 +2119,7 @@ in
   riot-desktop = callPackage ../applications/networking/instant-messengers/riot/riot-desktop.nix { };
 
   riot-web = callPackage ../applications/networking/instant-messengers/riot/riot-web.nix {
-    conf = config.riot-web.conf or null;
+    conf = config.riot-web.conf or {};
   };
 
   ripasso-cursive = callPackage ../tools/security/ripasso/cursive.nix {