diff --git a/pkgs/servers/dns/powerdns/default.nix b/pkgs/servers/dns/powerdns/default.nix
index 4f1913e322a6..ff057b48bd54 100644
--- a/pkgs/servers/dns/powerdns/default.nix
+++ b/pkgs/servers/dns/powerdns/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.powerdns.com/releases/pdns-${version}.tar.bz2";
     sha256 = "sha256-eRKxSIfWKEUYX3zktH21gOqnuLiX3LHJVV3+D6xe+uM=";
   };
+  # redact configure flags from version output to reduce closure size
+  patches = [ ./version.patch ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
diff --git a/pkgs/servers/dns/powerdns/version.patch b/pkgs/servers/dns/powerdns/version.patch
new file mode 100644
index 000000000000..185d07028833
--- /dev/null
+++ b/pkgs/servers/dns/powerdns/version.patch
@@ -0,0 +1,13 @@
+diff --git a/pdns/version.cc b/pdns/version.cc
+index d8f5d40..1368481 100644
+--- a/pdns/version.cc
++++ b/pdns/version.cc
+@@ -155,7 +155,7 @@ void showBuildConfiguration()
+ #ifdef PDNS_CONFIG_ARGS
+ #define double_escape(s) #s
+ #define escape_quotes(s) double_escape(s)
+-  g_log<<Logger::Warning<<"Configured with: "<<escape_quotes(PDNS_CONFIG_ARGS)<<endl;
++  g_log<<Logger::Warning<<"Configured with: "<<"redacted"<<endl;
+ #undef escape_quotes
+ #undef double_escape
+ #endif