diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 7bdbf9e199f..a957996d1f1 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nspr, perl, zlib, sqlite
+{ stdenv, fetchurl, fetchgit, nspr, perl, zlib, sqlite
 , includeTools ? false
 }:
 
@@ -9,6 +9,12 @@ let
     sha256 = "1ck9q68fxkjq16nflixbqi4xc6bmylmj994h3f1j42g8mp0xf0vd";
   };
 
+  nssPEM = fetchgit {
+    url = "git://git.fedorahosted.org/git/nss-pem.git";
+    rev = "07a683505d4a0a1113c4085c1ce117425d0afd80";
+    sha256 = "e4a9396d90e50e8b3cceff45f312eda9aaf356423f4eddd354a0e1afbbfd4cf8";
+  };
+
 in
 
 stdenv.mkDerivation rec {
@@ -25,12 +31,19 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ nspr perl zlib sqlite ];
 
+  postUnpack = ''
+    cp -rdv "${nssPEM}/mozilla/security/nss/lib/ckfw/pem" \
+            "$sourceRoot/mozilla/security/nss/lib/ckfw/"
+    chmod -R u+w "$sourceRoot/mozilla/security/nss/lib/ckfw/pem"
+  '';
+
   patches = [ ./nss-3.12.5-gentoo-fixups.diff ];
 
   # Based on the build instructions at
   # http://www.mozilla.org/projects/security/pki/nss/nss-3.11.4/nss-3.11.4-build.html
 
   postPatch = ''
+    sed -i -e 's/^DIRS.*$/& pem/' mozilla/security/nss/lib/ckfw/manifest.mn
     sed -i -e "/^PREFIX =/s:= /usr:= $out:" mozilla/security/nss/config/Makefile
   '';