diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index a13eec71eb84..c91a83c0a0d7 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -5,20 +5,27 @@
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.15.16";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-/HqCG3LscwogLXvZlL2CVo2Pj1hVRnOMPCmG1hxrG/I=";
+    sha256 = "sha256-gMXvHPqWvaZmzWiWrxlknaMkUraS64yrKl+RzAF7c4I=";
   };
 
+  ldflags = [
+    "-w"
+    "-s"
+    "-X main.Version=${version}"
+  ];
+
   preCheck = ''
     # Tries to connect to smallstep.com
     rm command/certificate/remote_test.go
   '';
-  vendorSha256 = "sha256-plQgIqs6QUbzndn8C0ByKceGtz/JxZ1Rx0fXWHNJ0kM=";
+
+  vendorSha256 = "sha256-WF2UD0LwzCMkoW1EfcjV+9ZboPp1oWhmsSEryj13Kg0=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";