diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 632c8427e4db..db23009b8fa9 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, openldap, libkrb5, db, gettext
+{ lib, stdenv, fetchurl, fetchpatch, openssl, openldap, libkrb5, db, gettext
 , pam, libxcrypt, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
 , buildPackages, pruneLibtoolFiles, nixosTests }:
 
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix cross-compilation
     ./cyrus-sasl-ac-try-run-fix.patch
+    # make compatible with openssl3. can probably be dropped with any release after 2.1.28
+    (fetchpatch {
+      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...c2bd3afbca57f176d8c650670ce371444bb7fcc0.patch";
+      hash = "sha256-bYeIkvle1Ms7Lnoob4eLd4RbPFHtPkKRZvfHNCBJY/s=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];