diff --git a/flake.nix b/flake.nix
index 90c4e9c..4dc335c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -284,31 +284,32 @@
                   esac
                 done
 
-                ${pkgs.lib.getExe pkgs.nixUnstable} "''${new_args[@]}"
+                ( exec -a $0 .nix-unwrapped "''${new_args[@]}" )
 
                 post_lock_hash="$(sha256sum flake-secret.lock | cut -f1 -d' ')"
 
                 if ! [[ "$pre_lock_hash" == "$post_lock_hash" ]] ; then
                   cp flake-secret.lock flake.lock
-                  ${pkgs.lib.getExe pkgs.nixUnstable} flake lock --override-input secret path:///var/empty
+                  .nix-unwrapped flake lock --override-input secret path:///var/empty
                 fi
               '';
-              nix-unwrapped = pkgs.writeShellScriptBin "nix-unwrapped" ''
-                exec ${pkgs.lib.getExe pkgs.nixUnstable} "$@"
-              '';
               nix-with-wrapper = pkgs.symlinkJoin {
                 name = "nix";
-                paths = [ # pkgs.nixUnstable
-                  nix-unwrapped
-                          nix-wrapped ];
+                paths = [ pkgs.nixUnstable ];
+                buildInputs = [ pkgs.makeWrapper ];
+                postBuild = ''
+                  mv $out/bin/nix $out/bin/.nix-unwrapped
+                  cp ${nix-wrapped}/bin/nix $out/bin/nix
+                '';
               };
+              nixos-rebuild = pkgs.nixos-rebuild.override { nix = nix-with-wrapper; };
             in
               pkgs.mkShell {
                 nativeBuildInputs = with pkgs; [
                   (pkgs.writeShellScriptBin "update-secret" ''
                     nix flake lock --update-input secret
                   '')
-                  nil nix-with-wrapper
+                  nil nix-with-wrapper nixos-rebuild
                   nomad consul vault
 
                   haskell.compiler.ghc946