diff --git a/pkgs/by-name/ne/nebula/package.nix b/pkgs/by-name/ne/nebula/package.nix
index a14f18fa80be..602a71348a75 100644
--- a/pkgs/by-name/ne/nebula/package.nix
+++ b/pkgs/by-name/ne/nebula/package.nix
@@ -3,16 +3,17 @@
   buildGoModule,
   fetchFromGitHub,
   nixosTests,
+  withPkcs11 ? true,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "nebula";
   version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "slackhq";
     repo = "nebula";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-p/2A1ZTBUPvrA8eAgLxjR7NSAfiIEkDcjX0Db8dCmfQ=";
   };
 
@@ -23,9 +24,33 @@ buildGoModule rec {
     "cmd/nebula-cert"
   ];
 
-  ldflags = [ "-X main.Build=${version}" ];
+  tags = lib.optional withPkcs11 "pkcs11";
+
+  ldflags = [ "-X main.Build=${finalAttrs.version}" ];
+
+  checkFlags = [
+    "-v"
+  ]
+  ++ lib.optionals withPkcs11 [
+    "-tags"
+    "pkcs11"
+  ];
+
+  env = lib.optionalAttrs (!withPkcs11) {
+    CGO_ENABLED = 0;
+  };
 
   passthru.tests = {
+    e2e = finalAttrs.finalPackage.overrideAttrs (prev: {
+      # go test picks up all the tests if we do not limit the subpackages built
+      subPackages = [ ];
+
+      # Also run the e2e tests.
+      postCheck = ''
+        make e2ev
+      '';
+    });
+
     inherit (nixosTests.nebula)
       connectivity
       reload
@@ -50,11 +75,11 @@ buildGoModule rec {
       parts.
     '';
     homepage = "https://github.com/slackhq/nebula";
-    changelog = "https://github.com/slackhq/nebula/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/slackhq/nebula/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       Br1ght0ne
       numinit
     ];
   };
-}
+})