diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 5756d53a9da3..f318607f304c 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [
     wirelesstools
-    liboqs
+    (finalAttrs.passthru.liboqs)
   ];
   nativeBuildInputs = [ makeWrapper ];
 
@@ -108,6 +108,35 @@ buildGoModule (finalAttrs: {
       }
   '';
 
+  # IVPN pins this to an older incompatible version, so we vendor it at that
+  # Lives in passthru so end-users can override it
+  passthru.liboqs = liboqs.overrideAttrs (
+    final: prev: {
+      version = "0.10.0";
+      src = fetchFromGitHub {
+        owner = "open-quantum-safe";
+        repo = "liboqs";
+        tag = "${final.version}";
+        hash = "sha256-BFDa5NUr02lFPcT4Hnb2rjGAi+2cXvh1SHLfqX/zLlI=";
+      };
+      # the main derivations patches don't apply onto the older version
+      patches = [ ];
+      # manually do what the main derivations pkg-config patch does (unbreak invalid path)
+      postPatch = ''
+        substituteInPlace src/liboqs.pc.in \
+          --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' \
+          'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+          --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+          'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+      '';
+      # This matches IVPNs build script at $src/daemon/References/common/kem-helper/build.sh
+      cmakeFlags = (prev.cmakeFlags or [ ]) ++ [
+        "-DOQS_USE_OPENSSL=OFF"
+        "-DOQS_MINIMAL_BUILD=KEM_kyber_1024;KEM_classic_mceliece_348864"
+      ];
+    }
+  );
+
   meta = {
     description = "Official IVPN Desktop app service daemon";
     homepage = "https://www.ivpn.net/apps";