diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index ff9862e4b9..44102e836b 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -56,15 +56,14 @@
 (define-public expat
   (package
     (name "expat")
-    (version "2.2.1")
-    (replacement expat-2.2.2)
+    (version "2.2.2")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/expat/expat/"
                                  version "/expat-" version ".tar.bz2"))
              (sha256
               (base32
-               "11c8jy1wvllvlk7xdc5cm8hdhg0hvs8j0aqy6s702an8wkdcls0q"))))
+               "0ik0r39ala9c6hj4kxrk933klgwkzlkbrfhvhaykx8l1rwgr2xj3"))))
     (build-system gnu-build-system)
     (home-page "http://www.libexpat.org/")
     (synopsis "Stream-oriented XML parser library written in C")
@@ -74,18 +73,6 @@ stream-oriented parser in which an application registers handlers for
 things the parser might find in the XML document (like start tags).")
     (license license:expat)))
 
-(define expat-2.2.2  ; Fixes CVE-2017-9233, CVE-2016-9063 and other issues.
-  (package
-    (inherit expat)
-    (version "2.2.2")
-    (source (origin
-             (method url-fetch)
-             (uri (string-append "mirror://sourceforge/expat/expat/"
-                                 version "/expat-" version ".tar.bz2"))
-             (sha256
-              (base32
-               "0ik0r39ala9c6hj4kxrk933klgwkzlkbrfhvhaykx8l1rwgr2xj3"))))))
-
 (define-public libebml
   (package
     (name "libebml")