diff --git a/pkgs/tools/security/cipherscan/default.nix b/pkgs/tools/security/cipherscan/default.nix
index eae5a5256dff..23022f92b6af 100644
--- a/pkgs/tools/security/cipherscan/default.nix
+++ b/pkgs/tools/security/cipherscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python, coreutils }:
+{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python3, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "cipherscan";
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   buildPhase = ''
     substituteInPlace cipherscan --replace '$0' 'cipherscan'