diff --git a/modules/services/misc/nix-daemon.nix b/modules/services/misc/nix-daemon.nix
index f28a793aefc6..d3acc625a8b2 100644
--- a/modules/services/misc/nix-daemon.nix
+++ b/modules/services/misc/nix-daemon.nix
@@ -29,10 +29,12 @@ let
       # other paths in the store, we need the closure of /bin/sh
       # in `build-chroot-dirs' - otherwise any builder that uses
       # /bin/sh won't work.
-      binshDeps = pkgs.writeReferencesToFile config.system.build.binsh;
+      closureFile = pkgs.runCommand "closure" {
+        exportReferencesGraph = concatMap (pkg: [ "closure${baseNameOf pkg}" pkg ]) cfg.chrootClosures;
+      } "cat closure* | sort | uniq > $out";
     in
       pkgs.runCommand "nix.conf" {extraOptions = cfg.extraOptions; } ''
-        extraPaths=$(for i in $(cat ${binshDeps}); do if test -d $i; then echo $i; fi; done)
+        extraPaths=$(for i in $(cat ${closureFile}); do if test -e $i; then echo $i; fi; done)
         cat > $out <<END
         # WARNING: this file is generated.
         build-users-group = nixbld
@@ -95,6 +97,13 @@ in
           '';
       };
 
+      chrootClosures = mkOption {
+        default = [];
+        example = [ config.system.build.binsh pkgs.coreutils ];
+        description = "Packages whose closures should be included in the chroot";
+        type = types.listOf types.package;
+      };
+
       extraOptions = mkOption {
         default = "";
         example = "
@@ -251,6 +260,8 @@ in
 
     nix.chrootDirs = [ "/dev" "/dev/pts" "/proc" "/bin/sh=${config.system.build.binsh}/bin/bash" ];
 
+    nix.chrootClosures = [ config.system.build.binsh ];
+
     environment.etc."nix/nix.conf".source = nixConf;
 
     # List of machines for distributed Nix builds in the format