diff --git a/build/toolchain/toolchain-bundle/default.nix b/build/toolchain/toolchain-bundle/default.nix
index f59a6a8..794b6d2 100644
--- a/build/toolchain/toolchain-bundle/default.nix
+++ b/build/toolchain/toolchain-bundle/default.nix
@@ -30,6 +30,7 @@
               qemu-minimal # custom pkg
               m4
               strace
+              python3Minimal
             ];
           };
         in
@@ -44,7 +45,7 @@
 
           installPhase = ''
             mkdir $out
-            mv bundle.tar.zst $out/${name}-${platform.hostPlatform.config}-${lib.version}.tar.zst
+            mv bundle.tar.zst $out/${name}-${platform.hostPlatform.config}.tar.zst
           '';
         }
       ))
diff --git a/third_party/nix/default.nix b/third_party/nix/default.nix
index 7688b7f..d868e74 100644
--- a/third_party/nix/default.nix
+++ b/third_party/nix/default.nix
@@ -6,9 +6,10 @@
         (self: super: {
           qemu-minimal = import ./pkgs/qemu { pkgs = super; };
           diffutils = import ./pkgs/diffutils { pkgs = super; };
-          util-linux-minimal = (import ./pkgs/util-linux { pkgs = super; });
+          util-linux-minimal = import ./pkgs/util-linux { pkgs = super; };
           bazel-unwrapped = import ./pkgs/bazel { pkgs = super; };
           perl = import ./pkgs/perl { pkgs = super; };
+          python3Minimal = import ./pkgs/python3 { pkgs = super; };
         })
         (self: super: {
           vde2 = super.vde2.overrideAttrs (oldAttrs: {
diff --git a/third_party/nix/pkgs/python3/BUILD.bazel b/third_party/nix/pkgs/python3/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/nix/pkgs/python3/BUILD.bazel
diff --git a/third_party/nix/pkgs/python3/default.nix b/third_party/nix/pkgs/python3/default.nix
new file mode 100644
index 0000000..3102b88
--- /dev/null
+++ b/third_party/nix/pkgs/python3/default.nix
@@ -0,0 +1,10 @@
+{ pkgs }: with pkgs;
+# Only override for our actual build
+if (!stdenv.hostPlatform.isStatic) then python3Minimal else
+python3Minimal.overrideAttrs (old: {
+  # Revert "fixup" which hardcodes a nix path.
+  postPatch = old.postPatch + ''
+    substituteInPlace Lib/subprocess.py \
+      --replace-fail "'${bashNonInteractive}/bin/sh'" "'/bin/sh'"
+  '';
+})
diff --git a/third_party/nix/sources.json b/third_party/nix/sources.json
index 7bcb25c..cab06c9 100644
--- a/third_party/nix/sources.json
+++ b/third_party/nix/sources.json
@@ -5,10 +5,10 @@
         "homepage": null,
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1870fe4f40e480079a8382d509b6412c6540b9c3",
-        "sha256": "1qmqly3kxcdqz9gj0v1m7vvp8yxyy9av1srbpf0sm3py80cwhqyf",
+        "rev": "ffdcefdde9a4e540d1c875767da0e382e1ccf460",
+        "sha256": "1ws459m6pb07cy4n5xj5zx6i2d9xjk3xfl369s5jjvrblzlyq6mf",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/1870fe4f40e480079a8382d509b6412c6540b9c3.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/ffdcefdde9a4e540d1c875767da0e382e1ccf460.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }