Perhaps this is cleaner:

diff --git a/default.nix b/default.nix
index 644ebb0..ed618f0 100644
--- a/default.nix
+++ b/default.nix
@@ -4,25 +4,39 @@
 }:

 let
-  pkg = pkgs.rustPlatform.buildRustPackage {
+  inherit (pkgs) lib;
+
+  pkg = pkgs.callPackage ({ lib
+  , stdenv
+  , rustPlatform
+  , pkgconfig
+  , rustPackages
+  , darwin
+  , nix-gitignore
+  , openssl
+  , nix
+  }: rustPlatform.buildRustPackage {
     name = "ofborg";
-    src = pkgs.nix-gitignore.gitignoreSource [] ./.;
+    src = nix-gitignore.gitignoreSource [] ./.;

-    nativeBuildInputs = with pkgs; [
+    nativeBuildInputs = [
       pkgconfig
       pkgs.rustPackages.clippy
     ];

-    buildInputs = with pkgs; [
+    buildInputs = [
       openssl
-    ];
+    ] ++ lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+      Security
+      CoreFoundation
+    ]);

     preBuild = ''
       cargo clippy
     '';

     doCheck = false; # Tests require access to a /nix/ and a nix daemon
-    checkInputs = with pkgs; [
+    checkInputs = [
       nix
     ];

@@ -32,7 +46,7 @@ let
         "hubcaps-0.3.16" = "1p7rn8y71fjwfag65437gz7a56pysz9n69smaknvblyxpjdzmh4d";
       };
     };
-  };
+  }) {};