diff --git a/pkgs/development/tools/git-ftp/default.nix b/pkgs/development/tools/git-ftp/default.nix
index 25295ad0062d..57b5e3c46372 100644
--- a/pkgs/development/tools/git-ftp/default.nix
+++ b/pkgs/development/tools/git-ftp/default.nix
@@ -1,5 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, man }:
-stdenv.mkDerivation rec {
+{ lib
+, resholve
+, fetchFromGitHub
+, fetchpatch
+, bash
+, coreutils
+, git
+, gnugrep
+, gawk
+, curl
+, hostname
+, gnused
+, findutils
+, lftp
+, pandoc
+, man
+}:
+
+resholve.mkDerivation rec {
   pname = "git-ftp";
   version = "1.6.0";
   src = fetchFromGitHub {
@@ -11,11 +28,66 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
+  # fix bug/typo; PRed upstream @
+  # https://github.com/git-ftp/git-ftp/pull/628
+  patches = [
+    (fetchpatch {
+      name = "fix-function-invocation-typo.patch";
+      url = "https://github.com/git-ftp/git-ftp/commit/cddf7cbba80e710758f6aac0ec0d77552ea8cd75.patch";
+      sha256 = "sha256-2B0QaMJi78Bg3bA1jp41aiyql1/LCryoaDs7+xmS1HY=";
+    })
+  ];
+
   installPhase = ''
     make install-all prefix=$out
   '';
 
-  buildInputs = [pandoc man];
+  nativeBuildInputs = [ pandoc man ];
+
+  solutions = {
+    git-ftp = {
+      scripts = [ "bin/git-ftp" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = [
+        coreutils
+        git
+        gnugrep
+        gawk
+        curl
+        hostname
+        gnused
+        findutils
+        lftp
+      ];
+      fake = {
+        # don't resolve impure system macOS security
+        # caution: will still be fragile if PATH is bad
+        # TODO: fixable once we figure out how to handle
+        # this entire class of problem...
+        "external" = [ "security" ];
+      };
+      keep = {
+        # looks like run-time user/env/git-config controlled
+        "$GIT_PAGER" = true;
+        "$hook" = true; # presumably git hooks given context
+      };
+      execer = [
+        # TODO: rm when binlore/resholve handle git; manually
+        # checked and see no obvious subexec for now
+        "cannot:${git}/bin/git"
+        /*
+        Mild uncertainty here. There *are* commandlikes in
+        the arguments (especially wait & cd), but I think they are
+        fine as-is, because I'm reading them as:
+        1. ftp commands
+        2. running on the remote anyways
+
+        See https://github.com/git-ftp/git-ftp/blob/057f7d8e9f00ffc5a8c6ceaa4be30af2939df41a/git-ftp#L1214-L1221
+        */
+        "cannot:${lftp}/bin/lftp"
+      ];
+    };
+  };
 
   meta = with lib; {
     description = "Git powered FTP client written as shell script";