diff --git a/pkgs/tools/security/passage/darwin-getopt-path.patch b/pkgs/tools/security/passage/darwin-getopt-path.patch
index 1fe1efde1ac1..0225f05c19d0 100644
--- a/pkgs/tools/security/passage/darwin-getopt-path.patch
+++ b/pkgs/tools/security/passage/darwin-getopt-path.patch
@@ -7,6 +7,6 @@ index 9a1fda8..4f7ce3d 100644
  }
  
 -GETOPT="$({ test -x /usr/local/opt/gnu-getopt/bin/getopt && echo /usr/local/opt/gnu-getopt; } || brew --prefix gnu-getopt 2>/dev/null || { command -v port &>/dev/null && echo /opt/local; } || echo /usr/local)/bin/getopt"
-+GETOPT="@GETOPT@"
++GETOPT="@getopt@/bin/getopt"
  SHRED="srm -f -z"
  BASE64="openssl base64"
diff --git a/pkgs/tools/security/passage/default.nix b/pkgs/tools/security/passage/default.nix
index 57e01fe39c54..df3bd95d966b 100644
--- a/pkgs/tools/security/passage/default.nix
+++ b/pkgs/tools/security/passage/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   patches = [
     (substituteAll {
       src = ./darwin-getopt-path.patch;
-      GETOPT = "${getopt}/bin/getopt";
+      inherit getopt;
     })
   ];