diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index e7176ba90b3..e780865ab3b 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -3,11 +3,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "openvpn-2.3.7";
+  name = "openvpn-2.3.8";
 
   src = fetchurl {
     url = "http://swupdate.openvpn.net/community/releases/${name}.tar.gz";
-    sha256 = "0vhl0ddpxqfibc0ah0ci7ix9bs0cn5shhmhijg550qpbdb6s80hz";
+    sha256 = "0lbw22qv3m0axhs13razr6b4x1p7jcpvf9rzb15b850wyvpka92k";
   };
 
   patches = optional stdenv.isLinux ./systemd-notify.patch;
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     --enable-systemd
     --enable-iproute2
     IPROUTE=${iproute}/sbin/ip
+  '' + optionalString stdenv.isDarwin ''
+    --disable-plugin-auth-pam
   '';
 
   postInstall = ''