diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 67ece3c907f4..3b35bc6ab2cf 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,11 +1,8 @@
-{ stdenv, fetchurl, zlib, openssl, perl, libedit, pkgconfig
-, pamSupport ? false, pam ? null
+{ stdenv, fetchurl, zlib, openssl, perl, libedit, pkgconfig, pam
 , etcDir ? null
 , hpnSupport ? false
 }:
 
-assert pamSupport -> pam != null;
-
 let
 
   hpnSrc = fetchurl {
@@ -28,16 +25,14 @@ stdenv.mkDerivation rec {
       gunzip -c ${hpnSrc} | patch -p1
     '';
   patches = [ ./locale_archive.patch ];
-  
-  buildInputs =
-    [ zlib openssl perl libedit pkgconfig ]
-    ++ stdenv.lib.optional pamSupport pam;
+
+  buildInputs = [ zlib openssl perl libedit pkgconfig pam ];
 
   configureFlags =
     ''
       --with-mantype=man
       --with-libedit=yes
-      ${if pamSupport then "--with-pam" else "--without-pam"}
+      ${if pam != null then "--with-pam" else "--without-pam"}
       ${if etcDir != null then "--sysconfdir=${etcDir}" else ""}
     '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d9606cadaaa1..5df2685fbf70 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1285,11 +1285,10 @@ let
     inherit stdenv makeWrapper ed libopensc_dnie;
   };
 
-  openssh = import ../tools/networking/openssh {
+  openssh = makeOverridable (import ../tools/networking/openssh) {
     inherit fetchurl stdenv zlib openssl pam perl libedit pkgconfig;
-    pamSupport = getPkgConfig "openssh" "pam" true;
-    hpnSupport = getPkgConfig "openssh" "hpn" false;
-    etcDir = getPkgConfig "openssh" "etcDir" "/etc/ssh";
+    hpnSupport = false;
+    etcDir = "/etc/ssh";
   };
 
   opensp = import ../tools/text/sgml/opensp {