diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index a64ba54..653b1b2 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   zlib,
   openssl_1_1,
+  libplist,
 }:
 
 buildDubPackage rec {
@@ -19,7 +20,12 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
-  buildInputs = [ zlib openssl_1_1 ];
+  # libplist is dlopen'd at runtime by the plist-d C binding (libplist-2.0.so.3).
+  # The reference Docker image installs it explicitly (see Dadoum/anisette-v3-server#46:
+  # "Anisette did build but not run with current Dockerfile, I have added the
+  # dependencies"). Without it the ADI provisioning step fails silently and the
+  # server serves unprovisioned data, so Apple rejects the login.
+  buildInputs = [ zlib openssl_1_1 libplist ];
 
   installPhase = ''
     runHook preInstall