diff --git a/doc/manual/change-authors.yml b/doc/manual/change-authors.yml
index 308366bd1..2f9fddf33 100644
--- a/doc/manual/change-authors.yml
+++ b/doc/manual/change-authors.yml
@@ -155,6 +155,10 @@ midnightveil:
 ncfavier:
   github: ncfavier
 
+p-e-meunier:
+  display_name: Pierre-Etienne Meunier
+  github: P-E-Meunier
+
 pamplemousse:
   display_name: Xavier Maso
   github: pamplemousse
@@ -164,6 +168,10 @@ piegames:
   forgejo: piegames
   github: piegamesde
 
+poliorcetics:
+  display_name: Poliorcetics
+  github: poliorcetics
+
 puck:
   display_name: puck
   forgejo: puck
diff --git a/doc/manual/rl-next/macos-sandbox-fix.md b/doc/manual/rl-next/macos-sandbox-fix.md
new file mode 100644
index 000000000..80aeb1344
--- /dev/null
+++ b/doc/manual/rl-next/macos-sandbox-fix.md
@@ -0,0 +1,17 @@
+---
+synopsis: "Fix macOS sandbox profile size errors"
+issues: [fj#752, fj#718]
+cls: [2861]
+category: Fixes
+credits: ["p-e-meunier", "poliorcetics"]
+---
+
+Fixed an issue on macOS where the sandbox profile could exceed size limits when building derivations with many dependencies. The profile is now split into multiple allowed sections to stay under the interpreter's limits.
+
+This resolves errors like
+
+```
+error: (failed with exit code 1, previous messages: sandbox initialization failed: data object length 65730 exceeds maximum (65535)|failed to configure sandbox)
+
+       error: unexpected EOF reading a line
+```
diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc
index ab066790b..869cecec3 100644
--- a/lix/libstore/build/local-derivation-goal.cc
+++ b/lix/libstore/build/local-derivation-goal.cc
@@ -25,6 +25,7 @@
 #include "lix/libutil/strings.hh"
 #include "lix/libutil/thread-name.hh"
 
+#include <cstddef>
 #include <regex>
 #include <queue>
 
@@ -1847,7 +1848,16 @@ void LocalDerivationGoal::runChild()
                without file-write* allowed, access() incorrectly returns EPERM
              */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";
+
+            // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
+            // See https://github.com/NixOS/nix/issues/4119
+            // We split our allow groups approximately at half the actual limit, 1 << 16
+            const size_t breakpoint = sandboxProfile.length() + (1 << 14);
             for (auto & i : pathsInChroot) {
+                if (sandboxProfile.length() >= breakpoint) {
+                    debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
+                    sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
+                }
                 if (i.first != i.second.source)
                     throw Error(
                         "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",