diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 45dc36e32402..05a78d1c4486 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -472,6 +472,7 @@ in {
     systemd.tmpfiles.rules = [
       "d /etc/NetworkManager/system-connections 0700 root root -"
       "d /etc/ipsec.d 0700 root root -"
+      "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
 
       "d /var/lib/dhclient 0755 root root -"
       "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
diff --git a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
index dbf175d20c95..53d6ab2fbcf5 100644
--- a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
@@ -32,10 +32,14 @@ in stdenv.mkDerivation {
   configureFlags = [
     "--without-libnm-glib"
     "--with-gnome=${if withGnome then "yes" else "no"}"
-    "--localstatedir=/tmp"
+    "--localstatedir=/var"
     "--enable-absolute-paths"
   ];
 
+  # the installer only create an empty directory in localstatedir, so
+  # we can drop it
+  installFlags = [ "localstatedir=." ];
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;