diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 90fd6bf50185..48788537a660 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -24,6 +24,13 @@ buildPythonPackage rec {
     sha256 = "sha256-0E8eiHzqbxHbtAd97MbvFMRDWTu25E9x/44oNGC4mUM=";
   };
 
+  postPatch = ''
+    sed -i 's/"acme.*"/"acme"/' setup.py
+    substituteInPlace setup.py \
+      --replace "cryptography>=2.8,<4.0" "cryptography" \
+      --replace "snitun==" "snitun>="
+  '';
+
   propagatedBuildInputs = [
     acme
     aiohttp
@@ -40,12 +47,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    sed -i 's/"acme.*"/"acme"/' setup.py
-    substituteInPlace setup.py \
-      --replace "snitun==" "snitun>="
-  '';
-
   pythonImportsCheck = [ "hass_nabucasa" ];
 
   meta = with lib; {