diff --git a/.bazelrc b/.bazelrc
index 9734f97..18253f1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -3,11 +3,22 @@
 build --incompatible_strict_action_env=true
 
 # Run all spawns in our own hermetic sandbox sysroot.
-#build --experimental_use_hermetic_linux_sandbox
-# TODO: https://github.com/bazelbuild/rules_go/issues/1910
+build --experimental_use_hermetic_linux_sandbox
 build --action_env=MONOGON_SANDBOX_DIGEST
 import %workspace%/.bazelrc.sandbox
 
+# Hardwire all action envs to just use /usr/bin from the above sandbox. This is
+# necessary on NixOS Bazel builds, as they really like to inject /nix/store/*
+# paths otherwise. We also explicitly set it to /usr/bin only (no /bin) as
+# otherwise calling gcc from /bin/gcc breaks its own resolution of subordinate
+# commands (like cc1, as, etc.).
+build --action_env=PATH=/usr/bin
+build --host_action_env=PATH=/usr/bin
+
+# Make all shell run actions use /bin/bash instead of whatever the host might
+# have set. Again, looking at you, Bazel-on-NixOS.
+build --shell_executable=/bin/bash
+
 # No local CPP toolchain resolution. In our sandbox root, it doesn't make sense -
 # anything auto-detected during analysis stage is on the host instead of the sandbox.
 # Sysroot rebuild is pure Go and doesn't need it either.