diff --git a/pkgs/development/libraries/pkcs11helper/default.nix b/pkgs/development/libraries/pkcs11helper/default.nix
index fa373a7e97f..9094eca26e5 100644
--- a/pkgs/development/libraries/pkcs11helper/default.nix
+++ b/pkgs/development/libraries/pkcs11helper/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchurl, pkgconfig, openssl, autoreconfHook }:
+{ stdenv, fetchFromGitHub, pkgconfig, openssl, autoreconfHook }:
 
-let
-  rev = "5d412bad60";
-in
 stdenv.mkDerivation rec {
-  name = "pkcs11-helper-20121123-${rev}";
+  name = "pkcs11-helper-${version}";
+  version = "1.11";
 
-  src = fetchurl {
-    url = "https://github.com/alonbl/pkcs11-helper/tarball/${rev}";
-    name = "${name}.tar.gz";
-    sha256 = "1mih6mha39yr5s5m18lg4854qc105asgnwmjw7f95kgmzni62kxp";
+  src = fetchFromGitHub {
+    owner = "OpenSC";
+    repo = "pkcs11-helper";
+    rev = "${name}";
+    sha256 = "1bfsmy9w2qf7avvs3rsc1ycqczzzw0j2wsqkd2fj4dc1fqzigq2q";
   };
 
   buildInputs = [ pkgconfig openssl autoreconfHook ];
 
   meta = with stdenv.lib; {
     homepage = https://www.opensc-project.org/opensc/wiki/pkcs11-helper;
-    license = with licenses; [ "BSD" gpl2 ];
+    license = with licenses; [ bsd3 gpl2 ];
     description = "Library that simplifies the interaction with PKCS#11 providers";
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index e666cf7f605..3f4f1244e1b 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -1,4 +1,8 @@
-{ stdenv, fetchurl, iproute, lzo, openssl, pam, systemd, pkgconfig }:
+{ stdenv, fetchurl, iproute, lzo, openssl, pam, systemd, pkgconfig
+, pkcs11Support ? false, pkcs11helper ? null,
+}:
+
+assert pkcs11Support -> (pkcs11helper != null);
 
 with stdenv.lib;
 
@@ -13,13 +17,14 @@ stdenv.mkDerivation rec {
   patches = optional stdenv.isLinux ./systemd-notify.patch;
 
   buildInputs = [ lzo openssl pkgconfig ]
-                  ++ optionals stdenv.isLinux [ pam systemd iproute ];
+                  ++ optionals stdenv.isLinux [ pam systemd iproute ]
+                  ++ optional pkcs11Support pkcs11helper;
 
-  configureFlags = optionalString stdenv.isLinux ''
-    --enable-systemd
-    --enable-iproute2
-    IPROUTE=${iproute}/sbin/ip
-  '';
+  configureFlags = optionals stdenv.isLinux [
+    "--enable-systemd"
+    "--enable-iproute2"
+    "IPROUTE=${iproute}/sbin/ip" ]
+    ++ optional pkcs11Support "--enable-pkcs11";
 
   postInstall = ''
     mkdir -p $out/share/doc/openvpn/examples