diff --git a/gnu/local.mk b/gnu/local.mk
index 0c1425a118..b3190b8bc2 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1237,8 +1237,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ghc-bloomfilter-ghc9.2.patch	\
   %D%/packages/patches/ghc-bytestring-handle-ghc9.patch	\
   %D%/packages/patches/ghc-language-haskell-extract-ghc-8.10.patch	\
-  %D%/packages/patches/ghostscript-CVE-2023-36664.patch		\
-  %D%/packages/patches/ghostscript-CVE-2023-36664-fixup.patch	\
+  %D%/packages/patches/ghostscript-leptonica-hurd.patch		\
   %D%/packages/patches/ghostscript-no-header-id.patch		\
   %D%/packages/patches/ghostscript-no-header-uuid.patch		\
   %D%/packages/patches/ghostscript-no-header-creationdate.patch \
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm
index 94807fdd94..2d7f07fb40 100644
--- a/gnu/packages/ghostscript.scm
+++ b/gnu/packages/ghostscript.scm
@@ -201,6 +201,16 @@ (define-public ghostscript
                      '()))
       #:phases
       #~(modify-phases %standard-phases
+          #$@(if (target-hurd?)
+                 #~((add-after 'unpack 'patch-leptonica
+                      (lambda _
+                        (let ((patch-file
+                               #$(local-file
+                                  (search-patch
+                                   "ghostscript-leptonica-hurd.patch"))))
+                          (with-directory-excursion "leptonica"
+                            (invoke "patch" "--force" "-p1" "-i" patch-file))))))
+                 #~())
           (add-before 'configure 'create-output-directory
             (lambda _
               ;; The configure script refuses to function if the directory
diff --git a/gnu/packages/patches/ghostscript-leptonica-hurd.patch b/gnu/packages/patches/ghostscript-leptonica-hurd.patch
new file mode 100644
index 0000000000..124365b3e6
--- /dev/null
+++ b/gnu/packages/patches/ghostscript-leptonica-hurd.patch
@@ -0,0 +1,78 @@
+Upstream status: This patch was taken from leptonica upstream.
+
+Backported to ghostscripts bundled leptonica.
+
+From f04da7c816feb1d5f689c34f3d0e7e3621edf1f5 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Wed, 1 Feb 2023 19:35:43 +0100
+Subject: [PATCH] Fix GNU/Hurd build
+
+There is no PATH_MAX limitation on GNU/Hurd, and realpath() can be
+safely be used with its second parameter set to NULL (as required by
+posix since its version 2001).
+---
+ src/sarray1.c | 29 +++++++++++++++++++++++------
+ 1 file changed, 23 insertions(+), 6 deletions(-)
+
+--- a/src/sarray1.c	2023-06-13 12:31:13.393672916 +0200
++++ a/src/sarray1.c	2023-06-13 12:34:13.574237149 +0200
+@@ -1953,7 +1953,11 @@
+ SARRAY *
+ getFilenamesInDirectory(const char  *dirname)
+ {
++#if _POSIX_VERSION >= 200112 || defined(__GLIBC__)
++char           *dir;
++#else
+ char            dir[PATH_MAX + 1];
++#endif
+ char           *realdir, *stat_path, *ignore;
+ size_t          size;
+ SARRAY         *safiles;
+@@ -1976,17 +1980,28 @@
+             * If the file or directory exists, realpath returns its path;
+               else it returns NULL.
+             * If the second arg to realpath is passed in, the canonical path
+-              is returned there.  Use a buffer of sufficient size.  If the
+-              second arg is NULL, the path is malloc'd and returned if the
+-              file or directory exists.
+-           We pass in a buffer for the second arg, and check that the canonical
+-           directory path was made.  The existence of the directory is checked
+-           later, after its actual path is returned by genPathname().  */
++              is returned there.  Use a buffer of sufficient size.
++              We pass in a buffer for the second arg, and check that the
++              canonical directory path was made.  The existence of the
++              directory is checked later, after its actual path is returned by
++              genPathname().
++              With GNU libc or Posix 2001, if the second arg is NULL, the path
++              is malloc'd and returned if the file or directory exists.
++           */
++#if _POSIX_VERSION >= 200112 || defined(__GLIBC__)
++    dir = realpath(dirname, NULL);
++    if (dir == NULL)
++        return (SARRAY *)ERROR_PTR("dir not made", __func__, NULL);
++#else
+     dir[0] = '\0';  /* init empty in case realpath() fails to write it */
+     ignore = realpath(dirname, dir);
+     if (dir[0] == '\0')
+         return (SARRAY *)ERROR_PTR("dir not made", procName, NULL);
++#endif
+     realdir = genPathname(dir, NULL);
++#if _POSIX_VERSION >= 200112 || defined(__GLIBC__)
++    LEPT_FREE(dir);
++#endif
+     if ((pdir = opendir(realdir)) == NULL) {
+         LEPT_FREE(realdir);
+         return (SARRAY *)ERROR_PTR("pdir not opened", procName, NULL);
+@@ -1998,10 +2013,12 @@
+         stat_ret = fstatat(dfd, pdirentry->d_name, &st, 0);
+ #else
+         size = strlen(realdir) + strlen(pdirentry->d_name) + 2;
++#if _POSIX_VERSION < 200112 && !defined(__GLIBC__)
+         if (size > PATH_MAX) {
+             L_ERROR("size = %zu too large; skipping\n", procName, size);
+             continue;
+         }
++#endif
+         stat_path = (char *)LEPT_CALLOC(size, 1);
+         snprintf(stat_path, size, "%s/%s", realdir, pdirentry->d_name);
+         stat_ret = stat(stat_path, &st);