diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index 64ebd27001f0..9e3eeb711cb4 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchFromGitLab, cmake, ninja, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchFromGitLab, fetchpatch, cmake, ninja, pkg-config, wrapGAppsHook
+, desktopToDarwinBundle
 , glib, gtk3, gettext, libxkbfile, libX11, python3
 , freerdp, libssh, libgcrypt, gnutls, vte
 , pcre2, libdbusmenu-gtk3, libappindicator-gtk3
@@ -23,7 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-oEgpav4oQ9Sld9PY4TsutS5xEnhQgOHnpQhDesRFTeQ=";
   };
 
-  nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];
+  patches = [
+    # https://gitlab.com/Remmina/Remmina/-/merge_requests/2525
+    (fetchpatch {
+      url = "https://gitlab.com/Remmina/Remmina/-/commit/2ce153411597035d0f3db5177d703541e09eaa06.patch";
+      hash = "sha256-RV/8Ze9aN4dW49Z+y3z0jFs4dyEWu7DK2FABtmse9Hc=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ]
+    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
   buildInputs = [
     gsettings-desktop-schemas
diff --git a/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix b/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
index fde977c3636b..752cbbde2a31 100644
--- a/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
+++ b/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
@@ -1,4 +1,4 @@
-{ writeScriptBin, lib, ... }:
+{ writeScriptBin, lib, makeBinaryWrapper }:
 
 let
   pListText = lib.generators.toPlist { } {
@@ -17,23 +17,31 @@ in writeScriptBin "write-darwin-bundle" ''
 
     readonly prefix=$1
     readonly name=$2
-    readonly exec=$3
+    # TODO: support executables with spaces in their names
+    readonly execName=''${3%% *} # Before the first space
+    [[ $3 =~ " " ]] && readonly execArgs=''${3#* } # Everything after the first space
     readonly icon=$4.icns
     readonly squircle=''${5:-1}
     readonly plist=$prefix/Applications/$name.app/Contents/Info.plist
+    readonly binary=$prefix/bin/$execName
+    readonly bundleExecutable=$prefix/Applications/$name.app/Contents/MacOS/$name
 
     cat > "$plist" <<EOF
 ${pListText}
 EOF
 
-  if [[ $squircle == 0 || $squircle == "false" ]]; then
-    sed  '/CFBundleIconFiles/,\|</array>|d' -i "$plist"
-  fi
+    if [[ $squircle == 0 || $squircle == "false" ]]; then
+      sed  '/CFBundleIconFiles/,\|</array>|d' -i "$plist"
+    fi
 
-    cat > "$prefix/Applications/$name.app/Contents/MacOS/$name" <<EOF
-#!/bin/bash
-exec $prefix/bin/$exec
-EOF
-
-    chmod +x "$prefix/Applications/$name.app/Contents/MacOS/$name"
+    if [[ -n "$execArgs" ]]; then
+      (
+        source ${makeBinaryWrapper}/nix-support/setup-hook
+        # WORKAROUND: makeBinaryWrapper fails when -u is set
+        set +u
+        makeBinaryWrapper "$binary" "$bundleExecutable" --add-flags "$execArgs"
+      )
+    else
+      ln -s "$binary" "$bundleExecutable"
+    fi
 ''
diff --git a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
index e4e7fba84770..5b38f4376070 100644
--- a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
+++ b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
@@ -204,8 +204,8 @@ processExecFieldCodes() {
   local -r execNoKC="${execNoK/\%c/$(getDesktopParam "${file}" "Name")}"
   local -r icon=$(getDesktopParam "${file}" "Icon")
   local -r execNoKCI="${execNoKC/\%i/${icon:+--icon }${icon}}"
-  local -r execNoKCIfu="${execNoKCI/\%[fu]/\$1}"
-  local -r exec="${execNoKCIfu/\%[FU]/\$@}"
+  local -r execNoKCIfu="${execNoKCI/ \%[fu]/}"
+  local -r exec="${execNoKCIfu/ \%[FU]/}"
   if [[ "$exec" != "$execRaw" ]]; then
     echo 1>&2 "desktopToDarwinBundle: Application bundles do not understand desktop entry field codes. Changed '$execRaw' to '$exec'."
   fi