diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index 41f24a36eacc..22696f230e82 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, cmake, cacert, fetchpatch }:
+{ stdenv, fetchurl, lib, cmake, cacert, fetchpatch, buildShared ? true }:
 
 let
 
@@ -15,13 +15,12 @@ let
 
     cmakeFlags = [
       "-DENABLE_NC=ON"
-      "-DBUILD_SHARED_LIBS=ON"
       # Ensure that the output libraries do not require an executable stack.
       # Without this define, assembly files in libcrypto do not include a
       # .note.GNU-stack section, and if that section is missing from any object,
       # the linker will make the stack executable.
       "-DCMAKE_C_FLAGS=-DHAVE_GNU_STACK"
-    ];
+    ] ++ lib.optional buildShared "-DBUILD_SHARED_LIBS=ON";
 
     # The autoconf build is broken as of 2.9.1, resulting in the following error:
     # libressl-2.9.1/tls/.libs/libtls.a', needed by 'handshake_table'.
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index bc6c3525f77e..706c64c2e359 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -148,6 +148,9 @@ in {
     enableShared = false;
     enableStatic = true;
   };
+  libressl = super.libressl.override {
+    buildShared = false;
+  };
 
   darwin = super.darwin // {
     libiconv = super.darwin.libiconv.override {