diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix
index 3b29d73675f8..9e6fe6ff56d9 100644
--- a/pkgs/applications/networking/mullvad/mullvad.nix
+++ b/pkgs/applications/networking/mullvad/mullvad.nix
@@ -16,6 +16,7 @@
 , shadowsocks-rust
 , installShellFiles
 , writeShellScriptBin
+, versionCheckHook,
 }:
 let
   # NOTE(cole-h): This is necessary because wireguard-go-rs executes go in its build.rs (whose goal
@@ -33,7 +34,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "mullvad";
     repo = "mullvadvpn-app";
-    rev = version;
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-5GcYiyvulsOFepguBcBec98juw22YTbT7yvZJUOJUwc=";
   };
@@ -101,15 +102,25 @@ rustPlatform.buildRustPackage rec {
         --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad"
     '';
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
   passthru = {
     inherit libwg;
     inherit openvpn-mullvad;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Mullvad VPN command-line client tools";
     homepage = "https://github.com/mullvad/mullvadvpn-app";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ cole-h ];
+    changelog = "https://github.com/mullvad/mullvadvpn-app/blob/2025.2/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ cole-h ];
+    mainProgram = "mullvad";
   };
 }