diff --git a/pkgs/development/libraries/gnutls/3.5.10.nix b/pkgs/development/libraries/gnutls/3.5.10.nix
new file mode 100644
index 000000000000..a1eab1a84c11
--- /dev/null
+++ b/pkgs/development/libraries/gnutls/3.5.10.nix
@@ -0,0 +1,10 @@
+{ callPackage, fetchurl, libunistring, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "3.5.10";
+
+  src = fetchurl {
+    url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
+    sha256 = "17apwvdkkazh5w8z8mbanpj2yj8s2002qwy46wz4v3akpa33wi5g";
+  };
+})
diff --git a/pkgs/development/libraries/gnutls/3.5.nix b/pkgs/development/libraries/gnutls/3.5.nix
index c3560c43e475..77ecd4957f75 100644
--- a/pkgs/development/libraries/gnutls/3.5.nix
+++ b/pkgs/development/libraries/gnutls/3.5.nix
@@ -1,4 +1,4 @@
-{ callPackage, stdenv, fetchurl, libunistring, darwin, ... } @ args:
+{ callPackage, fetchurl, libunistring, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
   version = "3.5.11";
@@ -15,6 +15,4 @@ callPackage ./generic.nix (args // rec {
     sed '2iexit 77' -i tests/pkgconfig.sh
     sed '/^void doit(void)/,$s/{/{ exit(77);/; t' -i tests/trust-store.c
   '';
-
-  buildInputs = stdenv.lib.optional stdenv.isDarwin darwin.Security;
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 29caabbda57f..f362efa1d01d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7735,9 +7735,15 @@ with pkgs;
 
   gnutls = gnutls35;
 
-  gnutls35 = callPackage ../development/libraries/gnutls/3.5.nix {
-    guileBindings = config.gnutls.guile or false;
-  };
+  gnutls35 = callPackage
+    (if stdenv.isDarwin
+      # Avoid > 3.5.10 due to frameworks for now; see discussion on:
+      # https://github.com/NixOS/nixpkgs/commit/d6454e6a1
+      then ../development/libraries/gnutls/3.5.10.nix
+      else ../development/libraries/gnutls/3.5.nix)
+    {
+      guileBindings = config.gnutls.guile or false;
+    };
 
   gnutls-kdh = callPackage ../development/libraries/gnutls-kdh/3.5.nix {
     guileBindings = config.gnutls.guile or false;