diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index 65ab7ae..ee6a81f 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -2,8 +2,10 @@
   lib,
   buildDubPackage,
   fetchFromGitHub,
+  makeWrapper,
   zlib,
   openssl_1_1,
+  libplist,
 }:
 
 buildDubPackage rec {
@@ -19,14 +21,20 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
-  # TEMP diagnostic: log the swallowed provisioning exception to find the real
-  # cause of the silent provisioning failure.
-  postPatch = ''
-    patch -p1 < ${./log-provisioning-error.patch}
-  '';
+  nativeBuildInputs = [ makeWrapper ];
 
   buildInputs = [ zlib openssl_1_1 ];
 
+  # libplist is dlopen'd at runtime by the plist-d C binding via dynamic-loader
+  # (libplist-2.0.so.3). It is NOT linked, so it does not land in the closure
+  # via buildInputs. Without it the ADI provisioning step throws
+  # LibraryLoadingException and the server serves unprovisioned data, so Apple
+  # rejects the login. Wrap the binary with LD_LIBRARY_PATH so dlopen finds it.
+  postFixup = ''
+    wrapProgram $out/bin/anisette-v3-server \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libplist ]}
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
diff --git a/pkgs/anisette-v3-server/log-provisioning-error.patch b/pkgs/anisette-v3-server/log-provisioning-error.patch
deleted file mode 100644
index 6d29acc..0000000
--- a/pkgs/anisette-v3-server/log-provisioning-error.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/source/app.d
-+++ b/source/app.d
-@@ -156,7 +156,9 @@
- 			ProvisioningSession provisioningSession = new ProvisioningSession(v1Adi, v1Device);
- 			provisioningSession.provision(dsId);
- 			log.info("Provisioning done!");
--		} catch (Exception) {}
-+		} catch (Exception e) {
-+			log.error(e);
-+		}
- 	}