diff --git a/pkgs/by-name/tp/tpm2-pkcs11/package.nix b/pkgs/by-name/tp/tpm2-pkcs11/package.nix
index 1711ce3cd09ccf..4ae40a553a32f5 100644
--- a/pkgs/by-name/tp/tpm2-pkcs11/package.nix
+++ b/pkgs/by-name/tp/tpm2-pkcs11/package.nix
@@ -65,18 +65,14 @@ chosenStdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optional fapiSupport "--with-fapi";
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     autoconf-archive
     autoreconfHook
-    cmocka
     makeWrapper
     patchelf
     pkg-config
-  ];
-  buildInputs = lib.optional abrmdSupport tpm2-abrmd ++ [
-    libyaml
-    opensc
-    openssl
     (python3.withPackages (
       ps: with ps; [
         packaging
@@ -86,10 +82,18 @@ chosenStdenv.mkDerivation (finalAttrs: {
         tpm2-pytss
       ]
     ))
+  ];
+  buildInputs = lib.optional abrmdSupport tpm2-abrmd ++ [
+    libyaml
+    opensc
+    openssl
     sqlite
     tpm2-tools
     tpm2-tss
   ];
+  checkInputs = [
+    cmocka
+  ];
 
   enableParallelBuilding = true;
   hardeningDisable = lib.optional fuzz "all";