diff --git a/pkgs/tools/networking/onetun/default.nix b/pkgs/tools/networking/onetun/default.nix
index 77b6a7dedf0..9fe30faaf5c 100644
--- a/pkgs/tools/networking/onetun/default.nix
+++ b/pkgs/tools/networking/onetun/default.nix
@@ -1,8 +1,10 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , rustPlatform
+, fetchFromGitHub
+, stdenv
+, Security
 }:
+
 rustPlatform.buildRustPackage rec {
   pname = "onetun";
   version = "0.3.4";
@@ -11,12 +13,15 @@ rustPlatform.buildRustPackage rec {
     owner = "aramperes";
     repo = pname;
     rev = "v${version}";
-
     sha256 = "sha256-gVw1aVbYjDPYTtMYIXq3k+LN0gUBAbQm275sxzwoYw8=";
   };
 
   cargoSha256 = "sha256-/sOjd0JKk3MNNXYpTEXteFYtqDWYfyVItZrkX4uzjtc=";
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
   meta = with lib; {
     description = "A cross-platform, user-space WireGuard port-forwarder that requires no root-access or system network configurations";
     homepage = "https://github.com/aramperes/onetun";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 873581e37c8..48e0e0d196c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9535,7 +9535,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  onetun = callPackage ../tools/networking/onetun { };
+  onetun = callPackage ../tools/networking/onetun {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   opencorsairlink = callPackage ../tools/misc/opencorsairlink { };