diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index 9af77d72cbd5..a32d9bcb62f1 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -3,17 +3,16 @@
   fetchFromGitHub,
   lib,
   nixosTests,
-  ghostunnel,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "ghostunnel";
   version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BntQCauAgnaiNn31nrVEsHFvQv7zK6D0z/rInbCVTr0=";
   };
 
@@ -41,13 +40,13 @@ buildGoModule rec {
     imports = [
       (lib.modules.importApply ./service.nix { })
     ];
-    ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
+    ghostunnel.package = finalAttrs.finalPackage;
   };
 
   meta = {
     description = "TLS proxy with mutual authentication support for securing non-TLS backend applications";
     homepage = "https://github.com/ghostunnel/ghostunnel#readme";
-    changelog = "https://github.com/ghostunnel/ghostunnel/releases/tag/v${version}";
+    changelog = "https://github.com/ghostunnel/ghostunnel/releases/tag/${finalAttrs.src.rev}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       roberth
@@ -55,4 +54,4 @@ buildGoModule rec {
     ];
     mainProgram = "ghostunnel";
   };
-}
+})
diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
index 52a2f4016e79..67e2ba60add4 100644
--- a/pkgs/by-name/gh/ghostunnel/service.nix
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -187,6 +187,9 @@ in
     process = {
       argv = [
         (getExe cfg.package)
+        # ghostunnel's landlock rules don't like reading the CA certs from /etc
+        # because they are links to /nix/store, which isn't part of its rules
+        "--disable-landlock"
         "server"
         "--listen"
         cfg.listen