diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index 98bf5249b62..4950e885e25 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchgit, stdenv }:
+{ buildGoModule, fetchgit, stdenv, Security }:
 
 buildGoModule rec {
   pname = "cue";
@@ -12,6 +12,8 @@ buildGoModule rec {
 
   modSha256 = "04dapx75zwi8cv1pj3c6266znrhwihv3df4izm3gjk34r2i07q6s";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/cue" ];
 
   buildFlagsArray = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2e1ba3ab82f..8346ef1a92a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -890,7 +890,9 @@ in
 
   crc32c = callPackage ../development/libraries/crc32c { };
 
-  cue = callPackage ../development/tools/cue { };
+  cue = callPackage ../development/tools/cue {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   deltachat-electron = callPackage
     ../applications/networking/instant-messengers/deltachat-electron { };