diff --git a/pkgs/tools/security/bpb/default.nix b/pkgs/tools/security/bpb/default.nix
index 121c5674c08..4d601aac155 100644
--- a/pkgs/tools/security/bpb/default.nix
+++ b/pkgs/tools/security/bpb/default.nix
@@ -2,6 +2,7 @@
 , lib
 , rustPlatform
 , fetchFromGitHub
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,6 +21,8 @@ rustPlatform.buildRustPackage rec {
   # a nightly compiler is required unless we use this cheat code.
   RUSTC_BOOTSTRAP = 1;
 
+  buildInputs = lib.optional stdenv.isDarwin Security;
+
   meta = with lib; {
     description = "Tool to automatically sign git commits, replacing gpg for that purpose";
     homepage = "https://github.com/withoutboats/bpb";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1e3e2b65bb0..167cd3b8d2d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2228,7 +2228,7 @@ with pkgs;
   bozohttpd = callPackage ../servers/http/bozohttpd { };
   bozohttpd-minimal = callPackage ../servers/http/bozohttpd { minimal = true; };
 
-  bpb = callPackage ../tools/security/bpb { };
+  bpb = callPackage ../tools/security/bpb { inherit (darwin.apple_sdk.frameworks) Security; };
 
   bpytop = callPackage ../tools/system/bpytop { };