diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index b2fb6925abac..979a658ac022 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles, Security }:
 
 buildGoModule rec {
   pname = "chezmoi";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0gh314d3mspqmz2z3m05bgsp62mrhb48m4mwhfy5h62fs7aqymr8";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [
     "-ldflags=-s -w -X github.com/twpayne/chezmoi/cmd.VersionStr=${version}"
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5902ea72da70..bda4cd5c76df 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -843,7 +843,9 @@ in
 
   certigo = callPackage ../tools/admin/certigo { };
 
-  chezmoi = callPackage ../tools/misc/chezmoi { };
+  chezmoi = callPackage ../tools/misc/chezmoi {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   chipsec = callPackage ../tools/security/chipsec {
     kernel = null;