diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 4dfa8657224d..37e98de2591b 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -27,6 +27,7 @@
 , tdb
 , tevent
 , libxcrypt
+, libxcrypt-legacy
 , cmocka
 , rpcsvc-proto
 , bash
@@ -49,6 +50,15 @@
 
 with lib;
 
+let
+  # samba-tool requires libxcrypt-legacy algorithms
+  python = python3Packages.python.override {
+    libxcrypt = libxcrypt-legacy;
+  };
+  wrapPython = python3Packages.wrapPython.override {
+    inherit python;
+  };
+in
 stdenv.mkDerivation rec {
   pname = "samba";
   version = "4.19.2";
@@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    python3Packages.python
+    python
     wafHook
     pkg-config
     bison
@@ -93,8 +103,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bash
-    python3Packages.wrapPython
-    python3Packages.python
+    wrapPython
+    python
     readline
     popt
     dbus
@@ -165,7 +175,7 @@ stdenv.mkDerivation rec {
   # module, which works correctly in all cases.
   PYTHON_CONFIG = "/invalid";
 
-  pythonPath = [ python3Packages.dnspython tdb ];
+  pythonPath = [ python3Packages.dnspython python3Packages.markdown tdb ];
 
   preBuild = ''
     export MAKEFLAGS="-j $NIX_BUILD_CORES"
@@ -208,12 +218,12 @@ stdenv.mkDerivation rec {
     # Samba does its own shebang patching, but uses build Python
     find $out/bin -type f -executable | while read file; do
       isScript "$file" || continue
-      sed -i 's^${lib.getBin buildPackages.python3Packages.python}/bin^${lib.getBin python3Packages.python}/bin^' "$file"
+      sed -i 's^${lib.getBin buildPackages.python3Packages.python}^${lib.getBin python}^' "$file"
     done
   '';
 
   disallowedReferences =
-    lib.optionals (buildPackages.python3Packages.python != python3Packages.python)
+    lib.optionals (buildPackages.python3Packages.python != python)
       [ buildPackages.python3Packages.python ];
 
   passthru = {