diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index 3bc5d4158346..ff32ba6fa251 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -2,14 +2,21 @@
 , graphicalSupport ? false
 , libX11 ? null
 , gtk2 ? null
-, pythonPackages
+, withPython ? false # required for the `ndiff` binary
+, python2Packages ? null
 , makeWrapper ? null
 }:
 
+assert withPython -> python2Packages != null;
+
 with stdenv.lib;
 
 let
-  inherit (pythonPackages) python pygtk pygobject2 pycairo pysqlite;
+
+  # Zenmap (the graphical program) also requires Python,
+  # so automatically enable pythonSupport if graphicalSupport is requested.
+  pythonSupport = withPython || graphicalSupport;
+
 in stdenv.mkDerivation rec {
   name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
   version = "7.12";
@@ -21,15 +28,19 @@ in stdenv.mkDerivation rec {
 
   patches = ./zenmap.patch;
 
-  configureFlags = optionalString (!graphicalSupport) "--without-zenmap";
+  configureFlags = []
+    ++ optional (!pythonSupport) "--without-ndiff"
+    ++ optional (!graphicalSupport) "--without-zenmap"
+    ;
 
-  postInstall = ''
+  postInstall = optionalString pythonSupport ''
       wrapProgram $out/bin/ndiff --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH"
   '' + optionalString graphicalSupport ''
-      wrapProgram $out/bin/zenmap --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH" --prefix PYTHONPATH : $(toPythonPath ${pygtk})/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath ${pygobject2})/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath ${pycairo})/gtk-2.0
+      wrapProgram $out/bin/zenmap --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH" --prefix PYTHONPATH : $(toPythonPath $pygtk)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pygobject)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pycairo)/gtk-2.0
   '';
 
-  buildInputs = [ libpcap pkgconfig openssl makeWrapper python ]
+  buildInputs = with python2Packages; [ libpcap pkgconfig openssl ]
+    ++ optionals pythonSupport [ makeWrapper python ]
     ++ optionals graphicalSupport [
       libX11 gtk2 pygtk pysqlite pygobject2 pycairo
     ];