diff --git a/pkgs/development/tools/osslsigncode/default.nix b/pkgs/development/tools/osslsigncode/default.nix
index 212a710de6e2..4738ccd74a9c 100644
--- a/pkgs/development/tools/osslsigncode/default.nix
+++ b/pkgs/development/tools/osslsigncode/default.nix
@@ -1,7 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
+, cmake
+, fetchpatch
 , pkg-config
 , curl
 , openssl
@@ -9,16 +10,29 @@
 
 stdenv.mkDerivation rec {
   pname = "osslsigncode";
-  version = "2.3";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "mtrojnar";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KJyGDrT3dr8DfjfRrWIENoBFuiWrgQx4qz1V+mT8/yI=";
+    sha256 = "sha256-33uT9PFD1YEIMzifZkpbl2EAoC98IsM72K4rRjDfh8g=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  patches = [
+    # Cygwin patch is prereq for Darwin fix applying -- committed to master after 2.5 release
+    (fetchpatch {
+      url = "https://github.com/mtrojnar/osslsigncode/commit/1c678bf926b78c947b14c46c3ce88e06268c738e.patch";
+      sha256 = "sha256-vOBMGIJ3PHJTvmsXRRfAUJRi7P929PcfmrUiRuM0pf4=";
+    })
+    # Fix build on Darwin when clang not identified as Apple (https://github.com/mtrojnar/osslsigncode/pull/247)
+    (fetchpatch {
+      url = "https://github.com/charles-dyfis-net/osslsigncode/commit/b2ed89b35c8a26faa7eb6515fecaff3c4c5f7fed.patch";
+      sha256 = "sha256-FGKZK/IzHbbkTzSoAtpC75z79d5+qQvvJrjEDY31WJ0=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ curl openssl ];