diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 2aaf6600dcda..d54c9e709267 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -102,24 +102,35 @@ stdenv.mkDerivation rec {
           platform.parsed.cpu.name;
       # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
       target = getArch stdenv.hostPlatform;
+      target_system = stdenv.hostPlatform.uname.system;
       host = getArch stdenv.buildPlatform;
+
+      buildFlags =
+        [
+          "-v"
+          "--opt"
+          "--with-nspr=${nspr.dev}/include:${nspr.out}/lib"
+          "--system-sqlite"
+          "--enable-legacy-db"
+          "--target ${target}"
+          "-Dhost_arch=${host}"
+          "-Duse_system_zlib=1"
+          "--enable-libpkix"
+          "-j"
+          "$NIX_BUILD_CORES"
+        ]
+        ++ lib.optional enableFIPS "--enable-fips"
+        ++ lib.optional stdenv.hostPlatform.isDarwin "--clang"
+        ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+          "-DOS=${target_system}"
+          "--disable-tests"
+        ];
     in
     ''
       runHook preBuild
 
       sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
-      ./build.sh -v --opt \
-        --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
-        --system-sqlite \
-        --enable-legacy-db \
-        --target ${target} \
-        -Dhost_arch=${host} \
-        -Duse_system_zlib=1 \
-        --enable-libpkix \
-        -j $NIX_BUILD_CORES \
-        ${lib.optionalString enableFIPS "--enable-fips"} \
-        ${lib.optionalString stdenv.hostPlatform.isDarwin "--clang"} \
-        ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
+      ./build.sh ${lib.concatStringsSep " " buildFlags}
 
       runHook postBuild
     '';
@@ -135,6 +146,14 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isILP32 [
       "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
     ]
+    ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
+      "-D_XOPEN_SOURCE=700"
+      "-D__BSD_VISIBLE"
+      # uses compiler intrinsics gated behind runtime checks for cpu feature flags
+      "-mavx2"
+      "-maes"
+      "-mpclmul"
+    ]
   );
 
   installPhase = ''