diff --git a/pkgs/by-name/co/composefs/package.nix b/pkgs/by-name/co/composefs/package.nix
index 3a08789beffb3..6d9e0eb45321f 100644
--- a/pkgs/by-name/co/composefs/package.nix
+++ b/pkgs/by-name/co/composefs/package.nix
@@ -23,22 +23,30 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "composefs";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "composefs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9YEY7oTjWwVT2KbzTOOc6sJIGEAkdLSKDf1noF1cYuA=";
+    hash = "sha256-kbXmDdyRrtsERkUomjZUWP3QC2q27AWUTc/J2jCSXg4=";
   };
 
   strictDeps = true;
   outputs = [ "out" "lib" "dev" ];
 
-  postPatch = lib.optionalString installExperimentalTools ''
-    substituteInPlace tools/meson.build \
-      --replace-fail "install : false" "install : true"
-  '';
+  postPatch =
+    # 'both_libraries' as an install target always builds both versions.
+    #  This results in double disk usage for normal builds and broken static builds,
+    #  so we replace it with the regular library target.
+    ''
+      substituteInPlace libcomposefs/meson.build \
+        --replace-fail "both_libraries" "library"
+    ''
+    + lib.optionalString installExperimentalTools ''
+      substituteInPlace tools/meson.build \
+        --replace-fail "install : false" "install : true"
+    '';
 
   nativeBuildInputs = [ meson ninja go-md2man pkg-config ];
   buildInputs = [ openssl ]
@@ -74,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "File system for mounting container images";
     homepage = "https://github.com/containers/composefs";
     changelog = "https://github.com/containers/composefs/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [ gpl3Plus lgpl21Plus ];
+    license = with lib.licenses; [ gpl2Only asl20 ];
     maintainers = with lib.maintainers; [ kiskae ];
     mainProgram = "mkcomposefs";
     pkgConfigModules = [ "composefs" ];