diff --git a/pkgs/development/python-modules/tuf/default.nix b/pkgs/development/python-modules/tuf/default.nix
index e22c473fa5ff..69e6e86710b4 100644
--- a/pkgs/development/python-modules/tuf/default.nix
+++ b/pkgs/development/python-modules/tuf/default.nix
@@ -1,17 +1,23 @@
 {
   lib,
   buildPythonPackage,
-  ed25519,
-  freezegun,
   fetchFromGitHub,
-  hatchling,
-  pytestCheckHook,
+
+  # build-system
   flit-core,
+  hatchling,
+
+  # dependencies
   requests,
   securesystemslib,
+
+  # tests
+  ed25519,
+  freezegun,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tuf";
   version = "6.0.0";
   pyproject = true;
@@ -19,13 +25,13 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "theupdateframework";
     repo = "python-tuf";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-CPbZOpUYi7MWKLMj7kwTsmEkxLCf4wU7IOCcbzMkPlU=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail  "hatchling==1.27.0" "hatchling"
+      --replace-fail "hatchling==1.27.0" "hatchling"
   '';
 
   build-system = [
@@ -42,12 +48,9 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  checkInputs = [
-    freezegun
-  ];
-
   nativeCheckInputs = [
     ed25519
+    freezegun
     pytestCheckHook
   ];
 
@@ -60,11 +63,11 @@ buildPythonPackage rec {
   meta = {
     description = "Python reference implementation of The Update Framework (TUF)";
     homepage = "https://github.com/theupdateframework/python-tuf";
-    changelog = "https://github.com/theupdateframework/python-tuf/blob/v${version}/docs/CHANGELOG.md";
+    changelog = "https://github.com/theupdateframework/python-tuf/blob/${finalAttrs.src.tag}/docs/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
     ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})