diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index b0524b4121a..f8e313d660e 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -17,6 +17,20 @@ if isPyPy then null else buildPythonPackage rec {
   propagatedBuildInputs = [ libffi pycparser ];
   buildInputs = [ pytest ];
 
+  # On Darwin, the cffi tests want to hit libm a lot, and look for it in a global
+  # impure search path. It's obnoxious how much repetition there is, and how difficult
+  # it is to get it to search somewhere else (since we do actually have a libm symlink in libSystem)
+  prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace testing/cffi0/test_parsing.py \
+      --replace 'lib_m = "m"' 'lib_m = "System"' \
+      --replace '"libm" in name' '"libSystem" in name'
+    substituteInPlace testing/cffi0/test_unicode_literals.py --replace 'lib_m = "m"' 'lib_m = "System"'
+    substituteInPlace testing/cffi0/test_zdistutils.py --replace 'self.lib_m = "m"' 'self.lib_m = "System"'
+    substituteInPlace testing/cffi1/test_recompiler.py --replace 'lib_m = "m"' 'lib_m = "System"'
+    substituteInPlace testing/cffi0/test_function.py --replace "lib_m = 'm'" "lib_m = 'System'"
+    substituteInPlace testing/cffi0/test_verify.py --replace "lib_m = ['m']" "lib_m = ['System']"
+  '';
+
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
   NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.cc.isClang [ "-Wno-unused-command-line-argument" "-Wno-unreachable-code" ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5df1b630b91..2acfa029088 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14095,6 +14095,8 @@ in {
 
     propagatedBuildInputs = with self; [ cryptography pyasn1 ];
 
+    __darwinAllowLocalNetworking = true;
+
     # https://github.com/paramiko/paramiko/issues/449
     doCheck = !(isPyPy || isPy33);
     checkPhase = ''