diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 3264194f125..a885d40658b 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -2,6 +2,8 @@
 
 # module requires Linux >= 4.1 https://www.wireguard.io/install/#kernel-requirements
 assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "4.1";
+# module is incompatible with the PaX constification plugin
+assert kernel != null -> !(kernel.features.grsecurity or false);
 
 let
   name = "wireguard-unstable-${version}";