diff --git a/pkgs/tools/misc/open-pdf-sign/default.nix b/pkgs/tools/misc/open-pdf-sign/default.nix
index fb87bcb11065..1a8b647933a0 100644
--- a/pkgs/tools/misc/open-pdf-sign/default.nix
+++ b/pkgs/tools/misc/open-pdf-sign/default.nix
@@ -1,21 +1,29 @@
-{ lib, stdenv, fetchurl, makeWrapper, jre, nix-update-script }:
+{ fetchurl
+, jre
+, lib
+, makeBinaryWrapper
+, nix-update-script
+, stdenv
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "0.1.6";
   pname = "open-pdf-sign";
 
   src = fetchurl {
-    url = "https://github.com/open-pdf-sign/open-pdf-sign/releases/download/v${version}/open-pdf-sign.jar";
-    sha256 = "sha256-GpMDgN4P8neHOQsXtg2AKXNeCMnv3nEHH50ZVU0uVvY=";
+    url = "https://github.com/open-pdf-sign/open-pdf-sign/releases/download/v${finalAttrs.version}/open-pdf-sign.jar";
+    hash = "sha256-GpMDgN4P8neHOQsXtg2AKXNeCMnv3nEHH50ZVU0uVvY=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
 
   buildCommand = ''
     install -Dm644 $src $out/lib/open-pdf-sign.jar
 
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/open-pdf-sign \
+    makeWrapper ${lib.getExe jre} $out/bin/open-pdf-sign \
       --add-flags "-jar $out/lib/open-pdf-sign.jar"
   '';
 
@@ -23,12 +31,12 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Digitally sign PDF files from your commandline";
     homepage = "https://github.com/open-pdf-sign/open-pdf-sign";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.asl20;
-    maintainers = with maintainers; [ drupol ];
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.unix;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
-}
+})