diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
index 41073e8cc839..362a7432ff49 100644
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap
 , expat, libxml2, openssl, pkg-config, systemd
+, cppunit
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,22 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (stdenv.isLinux && !stdenv.hostPlatform.isMusl)
     "--enable-linux-netfilter";
 
+  doCheck = true;
+  checkInputs = [ cppunit ];
+  preCheck = ''
+    # tests attempt to copy around "/bin/true" to make some things
+    # no-ops but this doesn't work if our "true" is a multi-call
+    # binary, so make our own fake "true" which will work when used
+    # this way
+    echo "#!$SHELL" > fake-true
+    chmod +x fake-true
+    grep -rlF '/bin/true' test-suite/ | while read -r filename ; do
+      substituteInPlace "$filename" \
+        --replace "$(type -P true)" "$(realpath fake-true)" \
+        --replace "/bin/true" "$(realpath fake-true)"
+    done
+  '';
+
   meta = with lib; {
     description = "A caching proxy for the Web supporting HTTP, HTTPS, FTP, and more";
     homepage = "http://www.squid-cache.org";