diff --git a/lix/libexec/launch-builder-linux.cc b/lix/libexec/launch-builder-linux.cc
index 1413d79e8..c12e414af 100644
--- a/lix/libexec/launch-builder-linux.cc
+++ b/lix/libexec/launch-builder-linux.cc
@@ -3,6 +3,7 @@
 #include "lix/libutil/rpc.hh"
 #include <cassert>
 #include <csignal>
+#include <fcntl.h>
 #include <filesystem>
 #include <format>
 #include <kj/io.h>
@@ -224,7 +225,11 @@ bool prepareChildSetup(build::Request::Reader request)
                     };
             const fs::path dst = chrootRootDir / target.relative_path();
             fs::create_directories(dst.parent_path());
-            writeFile(dst, std::string_view((const char *) sh, sizeof(sh)));
+            kj::AutoCloseFd fd(open(dst.c_str(), O_RDWR | O_CREAT, 0755));
+            if (fd == nullptr) {
+                throw SysError("cannot create sandbox shell");
+            }
+            writeFull(fd.get(), std::string_view((const char *) sh, sizeof(sh)));
             fs::permissions(dst, fs::perms(0555));
         } else
 #endif
diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index a95384201..b1db178d6 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -1348,7 +1348,10 @@ Pid LinuxLocalDerivationGoal::startChild(AutoCloseFD setupFD, AutoCloseFD logPTY
             (wantUserNS ? CLONE_NEWUSER : 0) | (wantNetNS ? CLONE_NEWNET : 0) | CLONE_VM | CLONE_FILES,
             []() -> int {
                 for (;;) {
-                    raise(SIGSTOP);
+                    // NOTE: musl apparently caches the pid of the process, which fucks with raise().
+                    // we must explicitly use getpid() to bypass this cache instead of using raise; a
+                    // raise(SIGSTOP) would stop the *daemon* process, and this breaks sandbox setup.
+                    kill(getpid(), SIGSTOP);
                 }
             }
         )};
diff --git a/package.nix b/package.nix
index 733c33111..0d8c25b0c 100644
--- a/package.nix
+++ b/package.nix
@@ -366,7 +366,10 @@ stdenv.mkDerivation (finalAttrs: {
       "-Dc_link_args=-fuse-ld=lld"
       "-Dcpp_link_args=-fuse-ld=lld"
     ]
-    ++ lib.optional hostPlatform.isStatic "-Denable-embedded-sandbox-shell=true"
+    ++ lib.optionals hostPlatform.isStatic [
+      "-Denable-embedded-sandbox-shell=true"
+      "-Denable-contrib-plugins=false"
+    ]
     ++ lib.optional ciBuildAndDeleteBothLibraries "-Ddefault_library=both"
     # musl doesn't support fibers, and we can't detect this with meson alone.
     ++ lib.optional hostPlatform.isMusl "-Ddisable-fibers=true"