diff --git a/pkgs/tools/networking/xh/default.nix b/pkgs/tools/networking/xh/default.nix
index 75eaa8774df2..fda4c30ccedc 100644
--- a/pkgs/tools/networking/xh/default.nix
+++ b/pkgs/tools/networking/xh/default.nix
@@ -1,22 +1,33 @@
-{ stdenv, lib, openssl, pkg-config, rustPlatform, fetchFromGitHub, Security
-, libiconv, installShellFiles }:
+{ stdenv
+, lib
+, pkg-config
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, withNativeTls ? true
+, Security
+, libiconv
+, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    sha256 = "sha256-fTd4VSUUj9Im+kCEuFgDsA7eofM1xQfrRzigr1vyJ3I=";
+    sha256 = "sha256-G6uAHpptX+hvh0ND+mqgR3AG0GT/qily6Y8Pt5yVbxg=";
   };
 
-  cargoSha256 = "sha256-yZdGw/6iVg8PaUyjTrxj6h/2yhBtqEqvMhdRHhMwDZc=";
+  cargoSha256 = "sha256-W2l1kiD2yY6FFA29WYPlWCjxKzuSgCdPN8M8bE4QGMU=";
+
+  buildFeatures = lib.optional withNativeTls "native-tls";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
-  buildInputs = if stdenv.isDarwin then [ Security libiconv ] else [ openssl ];
+  buildInputs = lib.optionals withNativeTls
+    (if stdenv.isDarwin then [ Security libiconv ] else [ openssl ]);
 
   # Get openssl-sys to use pkg-config
   OPENSSL_NO_VENDOR = 1;