diff --git a/pkgs/by-name/hy/hyperssh/package.nix b/pkgs/by-name/hy/hyperssh/package.nix
index 55217d2e19aa..7a37467517e2 100644
--- a/pkgs/by-name/hy/hyperssh/package.nix
+++ b/pkgs/by-name/hy/hyperssh/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   fetchurl,
   lib,
+  patchelfUnstable,
 }:
 
 buildNpmPackage {
@@ -30,6 +31,23 @@ buildNpmPackage {
     })
   ];
 
+  nativeBuildInputs = [
+    patchelfUnstable # --clear-execstack is only available on 0.18
+  ];
+
+  postInstall = ''
+    # glibc 2.41+ refuses to make the stack executable if it isn't executable,
+    # but a library loaded via `dlopen()` mandates it.
+    # According to https://github.com/holepunchto/sodium-native/issues/214
+    # this isn't necessary in this case.
+    while IFS= read -r -d ''' file; do
+      # Skip PEs with the same name
+      if patchelf --print-rpath "$file" &>/dev/null; then
+        patchelf "$file" --clear-execstack
+      fi
+    done < <(find $out/lib/node_modules -name 'sodium-native.node' -print0)
+  '';
+
   meta = {
     description = "Run SSH over hyperswarm";
     homepage = "https://github.com/mafintosh/hyperssh";