Might as well use the to-be-upstreamed alternative build: https://github.com/NixOS/nixpkgs/pull/259275 As a bonus, this doesn't require the sandbox any more.