diff --git a/pkgs/development/libraries/git2/0.25.nix b/pkgs/development/libraries/git2/0.25.nix
index 679049a0e13e..9743b82a14ab 100644
--- a/pkgs/development/libraries/git2/0.25.nix
+++ b/pkgs/development/libraries/git2/0.25.nix
@@ -1,8 +1,9 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, python
-, zlib, libssh2, openssl, http-parser, curl, libiconv
+, zlib, libssh2, openssl, http-parser, curl
+, libiconv, Security
 }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   version = "0.25.1";
   name = "libgit2-${version}";
 
@@ -13,11 +14,14 @@ stdenv.mkDerivation (rec {
     sha256 = "1jhikg0gqpdzfzhgv44ybdpm24lvgkc7ki4306lc5lvmj1s2nylj";
   };
 
-  cmakeFlags = "-DTHREADSAFE=ON";
+  cmakeFlags = [ "-DTHREADSAFE=ON" ];
 
   nativeBuildInputs = [ cmake python pkgconfig ];
 
-  buildInputs = [ zlib libssh2 openssl http-parser curl ];
+  buildInputs = [ zlib libssh2 openssl http-parser curl ]
+    ++ stdenv.lib.optional stdenv.isDarwin Security;
+
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
   enableParallelBuilding = true;
 
@@ -27,7 +31,4 @@ stdenv.mkDerivation (rec {
     license = stdenv.lib.licenses.gpl2;
     platforms = with stdenv.lib.platforms; all;
   };
-} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-  NIX_LDFLAGS = "-liconv";
-  propagatedBuildInputs = [ libiconv ];
-})
+}
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 42cf181f84f1..c0659a79fd34 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,4 +1,7 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, zlib, python, libssh2, openssl, curl, http-parser, libiconv }:
+{ stdenv, fetchFromGitHub, pkgconfig, cmake
+, zlib, python, libssh2, openssl, curl, http-parser
+, libiconv, Security
+}:
 
 stdenv.mkDerivation (rec {
   name = "libgit2-${version}";
@@ -12,11 +15,14 @@ stdenv.mkDerivation (rec {
     sha256 = "0zrrmfkfhd2xb4879z5khjb6xsdklrm01f1lscrs2ks68v25fk78";
   };
 
-  cmakeFlags = "-DTHREADSAFE=ON";
+  cmakeFlags = [ "-DTHREADSAFE=ON" ];
 
   nativeBuildInputs = [ cmake python pkgconfig ];
 
-  buildInputs = [ zlib libssh2 openssl http-parser curl ];
+  buildInputs = [ zlib libssh2 openssl http-parser curl ]
+    ++ stdenv.lib.optional stdenv.isDarwin Security;
+
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) [ libiconv ];
 
   enableParallelBuilding = true;
 
@@ -27,6 +33,4 @@ stdenv.mkDerivation (rec {
     platforms = with platforms; all;
   };
 } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-  NIX_LDFLAGS = "-liconv";
-  propagatedBuildInputs = [ libiconv ];
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2eea98bb7c09..160936af5ae9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8300,13 +8300,15 @@ with pkgs;
 
   icon-lang = callPackage ../development/interpreters/icon-lang { };
 
-  inherit (rec {
-    arg = stdenv.lib.optionalAttrs stdenv.isDarwin {
-      inherit (darwin) libiconv;
-    };
-    libgit2 = callPackage ../development/libraries/git2 arg;
-    libgit2_0_25 = callPackage ../development/libraries/git2/0.25.nix arg;
-  }) libgit2 libgit2_0_25;
+  libgit2 = callPackage ../development/libraries/git2 {
+    inherit (darwin) libiconv;
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  libgit2_0_25 = callPackage ../development/libraries/git2/0.25.nix {
+    inherit (darwin) libiconv;
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   gle = callPackage ../development/libraries/gle { };