diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 3546e1aa119..93d423a7283 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper,
   pkg-config, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
-  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python,
+  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python3,
   docs ? false, xmlto, libselinux, ldns
   }:
 
 let
   binPath = lib.makeBinPath [
-    bash iproute iptables procps coreutils gnused gawk nss.tools which python
+    bash iproute iptables procps coreutils gnused gawk nss.tools which python3
   ];
 in
 
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "0bj3g6qwd3ir3gk6hdl9npy3k44shf56vcgjahn30qpmx3z5fsr3";
   };
 
+  strictDeps = true;
+
   # These flags were added to compile v3.18. Try to lift them when updating.
   NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
@@ -35,9 +37,15 @@ stdenv.mkDerivation rec {
     "-DNSS_PKCS11_2_0_COMPAT=1"
   ];
 
-  nativeBuildInputs = [ makeWrapper pkg-config ];
-  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
-                  libcap_ng curl nspr nss python ldns ]
+  nativeBuildInputs = [
+    bison
+    flex
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound pam libevent
+                  libcap_ng curl nspr nss python3 ldns ]
                 ++ lib.optional docs xmlto
                 ++ lib.optional stdenv.isLinux libselinux;