diff --git a/pkgs/development/compilers/rustc/grsec.HEAD.patch b/pkgs/development/compilers/rustc/grsec.HEAD.patch
new file mode 100644
index 000000000000..84582ab7d70f
--- /dev/null
+++ b/pkgs/development/compilers/rustc/grsec.HEAD.patch
@@ -0,0 +1,16 @@
+diff --git a/src/test/run-make/relocation-model/Makefile b/src/test/run-make/relocation-model/Makefile
+index 2fcdd32..2d9ddb0 100644
+--- a/src/test/run-make/relocation-model/Makefile
++++ b/src/test/run-make/relocation-model/Makefile
+@@ -5,9 +5,11 @@ all:
+ 	$(call RUN,foo)
+ 
+ 	$(RUSTC) -C relocation-model=default foo.rs
++	paxctl -czexm $(TMPDIR)/foo
+ 	$(call RUN,foo)
+ 
+ 	$(RUSTC) -C relocation-model=static foo.rs
++	paxctl -czexm $(TMPDIR)/foo
+ 	$(call RUN,foo)
+ 
+ 	$(RUSTC) -C relocation-model=default --crate-type=dylib foo.rs
diff --git a/pkgs/development/compilers/rustc/head.nix b/pkgs/development/compilers/rustc/head.nix
index 8d8075d6c479..707cfe42d1e3 100644
--- a/pkgs/development/compilers/rustc/head.nix
+++ b/pkgs/development/compilers/rustc/head.nix
@@ -65,7 +65,9 @@ in stdenv.mkDerivation {
   configureFlags = [ "--enable-local-rust" "--local-rust-root=$snapshot" ];
 
   # The compiler requires cc, so we patch the source to tell it where to find it
-  patches = [ ./hardcode_paths.HEAD.patch ./local_stage0.HEAD.patch ];
+  patches = [ ./hardcode_paths.HEAD.patch ./local_stage0.HEAD.patch ]
+            ++ stdenv.lib.optional stdenv.needsPax ./grsec.HEAD.patch;
+
   postPatch = ''
     substituteInPlace src/librustc/back/link.rs \
       --subst-var-by "ccPath" "${stdenv.gcc}/bin/cc"