diff --git a/default.nix b/default.nix
index b6abf02363..2adacc8093 100644
--- a/default.nix
+++ b/default.nix
@@ -115,7 +115,7 @@ let
 
     urbit = callPackage ./nix/pkgs/urbit { inherit enableStatic; };
 
-    urcrypt = callPackage ./nix/pkgs/urcrypt { };
+    urcrypt = callPackage ./nix/pkgs/urcrypt { inherit enableStatic; };
 
     docker-image = callPackage ./nix/pkgs/docker-image { };
 
diff --git a/nix/pkgs/urcrypt/default.nix b/nix/pkgs/urcrypt/default.nix
index 650d3ad670..16d4cde44a 100644
--- a/nix/pkgs/urcrypt/default.nix
+++ b/nix/pkgs/urcrypt/default.nix
@@ -1,9 +1,17 @@
-{ stdenv, autoreconfHook, pkgconfig, openssl, gmp, secp256k1, scrypt, libaes_siv }:
+{ stdenv, autoreconfHook, pkgconfig, openssl, gmp, secp256k1, scrypt, libaes_siv
+, enableStatic ? stdenv.hostPlatform.isStatic }:
 
 stdenv.mkDerivation rec {
   name = "urcrypt";
   src  = ../../../pkg/urcrypt;
 
+  # XX why are these required for darwin?
+  dontDisableStatic = enableStatic;
+
+  configureFlags = if enableStatic
+    then [ "--disable-shared" "--enable-static" ]
+    else [];
+
   nativeBuildInputs =
     [ autoreconfHook pkgconfig ];