diff --git a/ci/niv-cron.nix b/ci/niv-cron.nix
index ccabc5d7..4a98a093 100644
--- a/ci/niv-cron.nix
+++ b/ci/niv-cron.nix
@@ -7,7 +7,7 @@ with lib; {
 
   nix.config = {
     extra-platforms = "aarch64-linux";
-    #extra-sandbox-paths = with channels.cipkgs; map (package: builtins.unsafeDiscardStringContext package) [bash qemu "/run/binfmt"];
+    extra-sandbox-paths = with channels.cipkgs; map (package: builtins.unsafeDiscardStringContext "${package}?") [bash qemu "/run/binfmt"];
   };
 
   gh-actions.env.OPENSSH_PRIVATE_KEY = "\${{ secrets.OPENSSH_PRIVATE_KEY }}";
@@ -28,7 +28,6 @@ with lib; {
         ''; in
       channels.cipkgs.writeShellScriptBin "aarch64binfmt" ''
         ${makeQemuWrapper "aarch64"}
-        echo 'extra-sandbox-paths = ${channels.cipkgs.bash} ${channels.cipkgs.qemu} /run/binfmt' >> /etc/nix/nix.conf
         echo ':aarch64-linux:M::\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\x00\xff\xfe\xff\xff\xff:/run/binfmt/aarch64:' > /proc/sys/fs/binfmt_misc/register
       '';
   };
diff --git a/ci/nodes.nix b/ci/nodes.nix
index 79b335c4..232616b6 100644
--- a/ci/nodes.nix
+++ b/ci/nodes.nix
@@ -6,7 +6,7 @@
 
   nix.config = {
     extra-platforms = "aarch64-linux";
-    #extra-sandbox-paths = with channels.cipkgs; map (package: builtins.unsafeDiscardStringContext package) [bash qemu "/run/binfmt"];
+    extra-sandbox-paths = with channels.cipkgs; map (package: builtins.unsafeDiscardStringContext "${package}?") [bash qemu "/run/binfmt"];
   };
 
   gh-actions = {
@@ -36,7 +36,6 @@
         ''; in
       channels.cipkgs.writeShellScriptBin "aarch64binfmt" ''
         ${makeQemuWrapper "aarch64"}
-        echo 'extra-sandbox-paths = ${channels.cipkgs.bash} ${channels.cipkgs.qemu} /run/binfmt' >> /etc/nix/nix.conf
         echo ':aarch64-linux:M::\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\x00\xff\xfe\xff\xff\xff:/run/binfmt/aarch64:' > /proc/sys/fs/binfmt_misc/register
       '';
     sourceCache = channels.cipkgs.runCommand "sources"