diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 3f4d00736ad9..a12b8abe1206 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, rpm, xz }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, rpm, xz, Security }:
 
 buildGoModule rec {
   pname = "clair";
@@ -13,14 +13,16 @@ buildGoModule rec {
 
   modSha256 = "0rgkrid58kji39nlmiii95r8shbzr6dwalj5m7qwxy5w1rcaljr5";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/clair \
-      --prefix PATH : "${lib.makeBinPath [ rpm xz ]}"
+      --prefix PATH : "${stdenv.lib.makeBinPath [ rpm xz ]}"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Vulnerability Static Analysis for Containers";
     homepage = "https://github.com/quay/clair";
     license = licenses.asl20;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 59b92a374471..27c8314abdef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -856,7 +856,9 @@ in
     withDriver = false;
   };
 
-  clair = callPackage ../tools/admin/clair { };
+  clair = callPackage ../tools/admin/clair {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   cloud-sql-proxy = callPackage ../tools/misc/cloud-sql-proxy { };