diff --git a/pkgs/by-name/np/npm-lockfile-fix/package.nix b/pkgs/by-name/np/npm-lockfile-fix/package.nix
index e0a3b430e1b6..1a16aaeb3b1c 100644
--- a/pkgs/by-name/np/npm-lockfile-fix/package.nix
+++ b/pkgs/by-name/np/npm-lockfile-fix/package.nix
@@ -1,8 +1,10 @@
 {
   lib,
+  stdenv,
   python3,
   fetchFromGitHub,
   nix-update-script,
+  cacert,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
@@ -27,6 +29,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   doCheck = false; # no tests
 
+  # requests resolves the CA bundle via REQUESTS_CA_BUNDLE before falling back
+  # to NIX_SSL_CERT_FILE, which on Darwin points to a host path that is not
+  # available inside a sandboxed build. Set it explicitly so the package works
+  # whenever it is invoked from a sandboxed environment.
+  makeWrapperArgs = lib.optionals stdenv.hostPlatform.isDarwin [
+    "--set"
+    "REQUESTS_CA_BUNDLE"
+    "${cacert}/etc/ssl/certs/ca-bundle.crt"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {