diff --git a/pkgs/tools/security/passage/darwin-getopt-path.patch b/pkgs/tools/security/passage/darwin-getopt-path.patch
new file mode 100644
index 000000000000..1fe1efde1ac1
--- /dev/null
+++ b/pkgs/tools/security/passage/darwin-getopt-path.patch
@@ -0,0 +1,12 @@
+diff --git a/src/platform/darwin.sh b/src/platform/darwin.sh
+index 9a1fda8..4f7ce3d 100644
+--- a/src/platform/darwin.sh
++++ b/src/platform/darwin.sh
+@@ -39,6 +39,6 @@ qrcode() {
+ 	fi
+ }
+ 
+-GETOPT="$({ test -x /usr/local/opt/gnu-getopt/bin/getopt && echo /usr/local/opt/gnu-getopt; } || brew --prefix gnu-getopt 2>/dev/null || { command -v port &>/dev/null && echo /opt/local; } || echo /usr/local)/bin/getopt"
++GETOPT="@GETOPT@"
+ SHRED="srm -f -z"
+ BASE64="openssl base64"
diff --git a/pkgs/tools/security/passage/default.nix b/pkgs/tools/security/passage/default.nix
index e232a3ac68d6..57e01fe39c54 100644
--- a/pkgs/tools/security/passage/default.nix
+++ b/pkgs/tools/security/passage/default.nix
@@ -2,8 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , makeBinaryWrapper
+, substituteAll
 , bash
 , age
+, getopt
 , git ? null
 , xclip ? null
 # Used to pretty-print list of all stored passwords, but is not needed to fetch
@@ -22,6 +24,13 @@ stdenv.mkDerivation {
     sha256 = "1val8wl9kzlxj4i1rrh2iiyf97w9akffvr0idvbkdb09hfzz4lz8";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./darwin-getopt-path.patch;
+      GETOPT = "${getopt}/bin/getopt";
+    })
+  ];
+
   nativeBuildInputs = [ makeBinaryWrapper ];
 
   extraPath = lib.makeBinPath [ age git xclip tree ];