diff --git a/nixos/modules/security/audit.nix b/nixos/modules/security/audit.nix
index 849ff57c662c..8ef3505952bf 100644
--- a/nixos/modules/security/audit.nix
+++ b/nixos/modules/security/audit.nix
@@ -41,6 +41,8 @@ in
         '';
       };
 
+      package = lib.mkPackageOption pkgs "audit" { };
+
       failureMode = lib.mkOption {
         type = lib.types.enum [
           "silent"
@@ -93,7 +95,7 @@ in
       "audit_backlog_limit=${toString cfg.backlogLimit}"
     ];
 
-    environment.systemPackages = [ pkgs.audit ];
+    environment.systemPackages = [ cfg.package ];
 
     # upstream contains a audit-rules.service, which uses augenrules.
     # That script does not handle cleanup correctly and insists on loading from /etc/audit.
@@ -119,12 +121,12 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = "${lib.getExe' pkgs.audit "auditctl"} -R ${rules}/audit.rules";
+        ExecStart = "${lib.getExe' cfg.package "auditctl"} -R ${rules}/audit.rules";
         ExecStopPost = [
           # Disable auditing
-          "${lib.getExe' pkgs.audit "auditctl"} -e 0"
+          "${lib.getExe' cfg.package "auditctl"} -e 0"
           # Delete all rules
-          "${lib.getExe' pkgs.audit "auditctl"} -D"
+          "${lib.getExe' cfg.package "auditctl"} -D"
         ];
       };
     };