<p>Quantum key distribution promises information-theoretic security, but practical implementations face vulnerabilities due to device imperfections. Existing security proofs typically address source and detector imperfections separately and cannot be directly combined, while the few attempts to handle both simultaneously have assumed idealized scenarios with infinitely many protocol rounds, which is insufficient to certify the security of real-world systems. Here, we close this gap by introducing a modular lifting theorem that extends any (present or future) phase-error-based security proof for active-basis-choice BB84-type protocols to incorporate detector efficiency mismatches. By applying this theorem to a state-of-the-art analysis for source imperfections, we obtain the first finite-key security proof against general coherent attacks that simultaneously addresses both source and detector imperfections.</p>