diff --git a/packages/goose-cli/package.nix b/packages/goose-cli/package.nix
index e4f6c33..4063ba4 100644
--- a/packages/goose-cli/package.nix
+++ b/packages/goose-cli/package.nix
@@ -1,8 +1,11 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
+  cmake,
+  cacert,
   openssl,
   libxcb,
   dbus,
@@ -26,6 +29,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    cmake
     llvmPackages.libclang
   ];
 
@@ -39,8 +43,12 @@ rustPlatform.buildRustPackage rec {
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
   env.RUSTY_V8_ARCHIVE = librusty_v8;
 
-  # bindgen (used by llama-cpp-sys-2) needs libclang
+  # bindgen (used by llama-cpp-sys-2) needs libclang and C headers
   env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${lib.getDev stdenv.cc.libc}/include";
+
+  # reqwest needs CA certificates in the sandbox
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   # Build only the CLI package
   cargoBuildFlags = [