diff --git a/pkgs/tools/system/collectd/plugins.nix b/pkgs/tools/system/collectd/plugins.nix
index de8948db6c9..1455feb1c32 100644
--- a/pkgs/tools/system/collectd/plugins.nix
+++ b/pkgs/tools/system/collectd/plugins.nix
@@ -41,8 +41,8 @@
 , xen
 , yajl
 , IOKit
-# Defaults to `null` for all supported plugins,
-# list of plugin names for a custom build
+# Defaults to `null` for all supported plugins (except xen, which is marked as
+# insecure), otherwise a list of plugin names for a custom build
 , enabledPlugins ? null
 , ...
 }:
@@ -136,7 +136,7 @@ let
   buildInputs =
     if enabledPlugins == null
     then builtins.concatMap pluginBuildInputs
-      (builtins.attrNames plugins)
+      (builtins.attrNames (builtins.removeAttrs plugins ["xencpu"]))
     else builtins.concatMap pluginBuildInputs enabledPlugins;
 in {
   inherit configureFlags buildInputs;