diff --git a/pkgs/development/compilers/openjdk-darwin/8.nix b/pkgs/development/compilers/openjdk-darwin/8.nix
index 1d12d59998a1..2f3391f70e0d 100644
--- a/pkgs/development/compilers/openjdk-darwin/8.nix
+++ b/pkgs/development/compilers/openjdk-darwin/8.nix
@@ -1,10 +1,16 @@
 { stdenv, fetchurl, unzip, setJavaClassPath, freetype }:
 let
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url    = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
   jdk = stdenv.mkDerivation {
     name = "zulu1.8.0_66-8.11.0.1";
 
     src = fetchurl {
-      url = http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip;
+      url = "http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip";
       sha256 = "0pvbpb3vf0509xm2x1rh0p0w4wmx50zf15604p28z1k8ai1a23sz";
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
     };
@@ -15,6 +21,9 @@ let
       mkdir -p $out
       mv * $out
 
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/jre/lib/security/
+
       # jni.h expects jni_md.h to be in the header search path.
       ln -s $out/include/darwin/*_md.h $out/include/
     '';