diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index 456ea0890ca..f3c1745321e 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoconf, automake, openssl, libgsf, gmp }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, autoconf, automake, openssl, libgsf, gmp }:
 
 stdenv.mkDerivation rec {
 
@@ -12,9 +12,22 @@ stdenv.mkDerivation rec {
     sha256 = "0q5jl7hcds3f0rhly3iy4fhhbyh9cdrfaw7zdrazzf1wswwhyssz";
   };
 
+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common support:
+    #   https://github.com/GavinSmith0123/crackxls2003/pull/3
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/GavinSmith0123/crackxls2003/commit/613d6c1844f76c7b67671aaa265375fed56c2a56.patch";
+      sha256 = "1pk67x67d9wji576mc57z5bzqlf9ygvn9m1z47w12mad7qmj9h1n";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config autoconf automake ];
   buildInputs = [ openssl libgsf gmp ];
 
+  # Avoid "-O5 -march=native"
+  makeFlags = [ "OPTIM_FLAGS=" ];
+
   installPhase =
   ''
     mkdir -p $out/bin