diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index 8df8d96e6411..a4b3ac1a65aa 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -30,7 +30,9 @@ let
 
   diff-so-fancy = callPackage ./diff-so-fancy { };
 
-  gh = callPackage ./gh { };
+  gh = callPackage ./gh {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ghq = callPackage ./ghq { };
 
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index e74bd78fc59b..e655813d3403 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
+{ stdenv, fetchFromGitHub, buildGoModule, installShellFiles, Security }:
 
 buildGoModule rec {
   pname = "gh";
@@ -20,6 +20,7 @@ buildGoModule rec {
   subPackages = [ "cmd/gh" ];
 
   nativeBuildInputs = [ installShellFiles ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
   postInstall = ''
     for shell in bash fish zsh; do
       $out/bin/gh completion -s $shell > gh.$shell
@@ -27,7 +28,7 @@ buildGoModule rec {
     done
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "GitHub CLI tool";
     homepage = "https://cli.github.com/";
     license = licenses.mit;