{
  writeShellScript,
  symlinkJoin,
  nixUnstable,
  makeWrapper,
  nixos-rebuild,
  lib,
}:
lib.fix (self: {
  nix = symlinkJoin {
    name = "nix";
    paths = [nixUnstable];
    buildInputs = [makeWrapper];
    postBuild = ''
      mv $out/bin/nix $out/bin/.nix-unwrapped
      cp ${writeShellScript "nix" (builtins.readFile ./nix-secret-wrapper.sh)} $out/bin/nix
    '';
  };
  nixos-rebuild = nixos-rebuild.override {nix = self.nix;};
})