diff --git a/modules/nixos/base/nix.nix b/modules/nixos/base/nix.nix
index 3c770733..35af9390 100644
--- a/modules/nixos/base/nix.nix
+++ b/modules/nixos/base/nix.nix
@@ -31,7 +31,15 @@
       "auto-allocate-uids"
       "cgroups"
     ];
-    sandbox-paths = [ "/dev/net" ];
+    # Use extra-sandbox-paths instead of sandbox-paths here. The plain
+    # sandbox-paths setting replaces Nix's compiled sandbox defaults, including
+    # the sandbox shell that provides /bin/sh for builders with legacy shebangs.
+    # extra-sandbox-paths keeps those defaults and only adds the paths we need.
+    # After deploying, verify the effective daemon config with:
+    #   nix config show | grep sandbox-paths
+    extra-sandbox-paths = [
+      "/dev/net"
+    ];
   };
 
   nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
diff --git a/outputs/aarch64-linux/tests/nix-system-features/expected.nix b/outputs/aarch64-linux/tests/nix-system-features/expected.nix
index 36454a33..8fe3ed9d 100644
--- a/outputs/aarch64-linux/tests/nix-system-features/expected.nix
+++ b/outputs/aarch64-linux/tests/nix-system-features/expected.nix
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   hasUidRange = true;
   hasAutoAllocateUidsFeature = true;
   hasCgroupsFeature = true;
-  hasDevNetSandboxPath = true;
+  hasNoExplicitSandboxPaths = true;
+  hasDevNetExtraSandboxPath = true;
 })
diff --git a/outputs/aarch64-linux/tests/nix-system-features/expr.nix b/outputs/aarch64-linux/tests/nix-system-features/expr.nix
index c21138c3..241628dc 100644
--- a/outputs/aarch64-linux/tests/nix-system-features/expr.nix
+++ b/outputs/aarch64-linux/tests/nix-system-features/expr.nix
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
       settings.experimental-features or [ ]
     );
     hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
-    hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]);
+    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
+    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
   }
 )
diff --git a/outputs/x86_64-linux/tests/nix-system-features/expected.nix b/outputs/x86_64-linux/tests/nix-system-features/expected.nix
index 36454a33..8fe3ed9d 100644
--- a/outputs/x86_64-linux/tests/nix-system-features/expected.nix
+++ b/outputs/x86_64-linux/tests/nix-system-features/expected.nix
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   hasUidRange = true;
   hasAutoAllocateUidsFeature = true;
   hasCgroupsFeature = true;
-  hasDevNetSandboxPath = true;
+  hasNoExplicitSandboxPaths = true;
+  hasDevNetExtraSandboxPath = true;
 })
diff --git a/outputs/x86_64-linux/tests/nix-system-features/expr.nix b/outputs/x86_64-linux/tests/nix-system-features/expr.nix
index c21138c3..241628dc 100644
--- a/outputs/x86_64-linux/tests/nix-system-features/expr.nix
+++ b/outputs/x86_64-linux/tests/nix-system-features/expr.nix
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
       settings.experimental-features or [ ]
     );
     hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
-    hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]);
+    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
+    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
   }
 )