diff --git a/pkgs/os-specific/linux/esdm/default.nix b/pkgs/os-specific/linux/esdm/default.nix
index f49f25ece6cf..e11310da7255 100644
--- a/pkgs/os-specific/linux/esdm/default.nix
+++ b/pkgs/os-specific/linux/esdm/default.nix
@@ -59,24 +59,26 @@ assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend =
 
 stdenv.mkDerivation rec {
   pname = "esdm";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${version}";
-    hash = "sha256-Z8cIjNI+Qi6O2e72vbEefbCCXyIA+lcEMDzWJReGrUs=";
+    hash = "sha256-5XctrI02pfCgK1P76AaSkMjiQqav6LX3SMjKr4F44sw=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
-  buildInputs = [ protobufc ]
-    ++ lib.optional (cryptoBackend == "botan" || botanRng) botan3
+
+  buildInputs = lib.optional (cryptoBackend == "botan" || botanRng) botan3
     ++ lib.optional (cryptoBackend == "openssl" || openSSLRandProvider) openssl
     ++ lib.optional selinux libselinux
     ++ lib.optional esJitterRng jitterentropy
     ++ lib.optional linuxDevFiles fuse3
     ++ lib.optional esJitterRngKernel libkcapi;
 
+  propagatedBuildInputs = [ protobufc ];
+
   mesonFlags = [
     (lib.mesonBool "b_lto" false)
     (lib.mesonBool "fips140" false)