diff --git a/pkgs/tools/networking/globalprotect-openconnect/default.nix b/pkgs/tools/networking/globalprotect-openconnect/default.nix
index a80f06768022..fdc1814cd920 100644
--- a/pkgs/tools/networking/globalprotect-openconnect/default.nix
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ];
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.16")
+  ];
+
   buildInputs = [
     openconnect
     qtwebsockets
@@ -33,9 +37,11 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     substituteInPlace GPService/gpservice.h \
-      --replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
+      --replace-fail /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
     substituteInPlace GPService/CMakeLists.txt \
-      --replace /etc/gpservice $out/etc/gpservice;
+      --replace-fail /etc/gpservice $out/etc/gpservice;
+    # Force minimum CMake version to 3.16 to avoid policy warnings
+    find . -name "CMakeLists.txt" -exec sed -i 's/cmake_minimum_required(VERSION [^)]*)/cmake_minimum_required(VERSION 3.16)/g' {} \;
   '';
 
   meta = with lib; {