diff --git a/pkgs/by-name/ca/catgirl/package.nix b/pkgs/by-name/ca/catgirl/package.nix
index cd6ba40d1c4f..fbe42bbe5c8c 100644
--- a/pkgs/by-name/ca/catgirl/package.nix
+++ b/pkgs/by-name/ca/catgirl/package.nix
@@ -2,29 +2,30 @@
   ctags,
   fetchurl,
   lib,
-  libressl,
+  libretls,
+  openssl,
   ncurses,
   pkg-config,
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "catgirl";
   version = "2.2a";
 
   src = fetchurl {
-    url = "https://git.causal.agency/catgirl/snapshot/${pname}-${version}.tar.gz";
+    url = "https://git.causal.agency/catgirl/snapshot/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-xtdgqu4TTgUlht73qRA1Q/coH95lMfvLQQhkcHlCl8I=";
   };
 
   # catgirl's configure script uses pkg-config --variable exec_prefix openssl
   # to discover the install location of the openssl(1) utility. exec_prefix
-  # is the "out" output of libressl in our case (where the libraries are
+  # is the "out" output of openssl in our case (where the libraries are
   # installed), so we need to fix this up.
   postConfigure = ''
-    substituteInPlace config.mk --replace \
+    substituteInPlace config.mk --replace-fail \
       "$($PKG_CONFIG --variable exec_prefix openssl)" \
-      "${lib.getBin libressl}"
+      "${lib.getBin openssl}"
   '';
 
   nativeBuildInputs = [
@@ -32,19 +33,20 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
   buildInputs = [
-    libressl
+    libretls
+    openssl
     ncurses
   ];
   strictDeps = true;
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://git.causal.agency/catgirl/about/";
-    license = licenses.gpl3Plus;
     description = "TLS-only terminal IRC client";
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
     mainProgram = "catgirl";
-    maintainers = with maintainers; [ xfnw ];
+    maintainers = with lib.maintainers; [ xfnw ];
   };
-}
+})