diff --git a/pkgs/by-name/pk/pkcs11-provider/package.nix b/pkgs/by-name/pk/pkcs11-provider/package.nix
index 37f622bc9480..8d5704d99d7b 100644
--- a/pkgs/by-name/pk/pkcs11-provider/package.nix
+++ b/pkgs/by-name/pk/pkcs11-provider/package.nix
@@ -1,33 +1,38 @@
 { lib, stdenv, fetchFromGitHub
 , openssl, nss, p11-kit
 , opensc, gnutls, expect
-, autoreconfHook, autoconf-archive, pkg-config
+, meson, ninja, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "pkcs11-provider";
-  version = "0.3";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = "pkcs11-provider";
     rev = "v${version}";
-    hash = "sha256-jEQYsINRZ7bi2UqOXUUmGpm+1h+1qBNe18KvfAw2JzU=";
+    hash = "sha256-f4BbW2awSXS1srSkn1CTRCqNp+2pvVpc4YL79Ht0w0A=";
   };
 
   buildInputs = [ openssl nss p11-kit ];
-  nativeBuildInputs = [ autoreconfHook pkg-config autoconf-archive ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
 
   # don't add SoftHSM to here: https://github.com/openssl/openssl/issues/22508
   nativeCheckInputs = [ p11-kit.bin opensc nss.tools gnutls openssl.bin expect ];
 
   postPatch = ''
     patchShebangs --build .
+  '';
 
-    # Makefile redirects to logfiles; make sure we can catch them.
-    for name in softokn softhsm; do
-      ln -s /dev/stderr tests/setup-$name.log
+  preInstall = ''
+    # Meson tries to install to `$out/$out` and `$out/''${openssl.out}`; so join them.
+    mkdir -p "$out"
+    for dir in "$out" "${openssl.out}"; do
+      mkdir -p .install/"$(dirname -- "$dir")"
+      ln -s "$out" ".install/$dir"
     done
+    export DESTDIR="$(realpath .install)"
   '';
 
   enableParallelBuilding = true;