diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index a64ba54..ee6a81f 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -2,8 +2,10 @@
   lib,
   buildDubPackage,
   fetchFromGitHub,
+  makeWrapper,
   zlib,
   openssl_1_1,
+  libplist,
 }:
 
 buildDubPackage rec {
@@ -19,8 +21,20 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
+  nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [ zlib openssl_1_1 ];
 
+  # libplist is dlopen'd at runtime by the plist-d C binding via dynamic-loader
+  # (libplist-2.0.so.3). It is NOT linked, so it does not land in the closure
+  # via buildInputs. Without it the ADI provisioning step throws
+  # LibraryLoadingException and the server serves unprovisioned data, so Apple
+  # rejects the login. Wrap the binary with LD_LIBRARY_PATH so dlopen finds it.
+  postFixup = ''
+    wrapProgram $out/bin/anisette-v3-server \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libplist ]}
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin