diff --git a/doc/manual/rl-next/fresh-cgroup-namespace.md b/doc/manual/rl-next/fresh-cgroup-namespace.md
new file mode 100644
index 000000000..7d2603c13
--- /dev/null
+++ b/doc/manual/rl-next/fresh-cgroup-namespace.md
@@ -0,0 +1,10 @@
+---
+synopsis: "Builders are always started in a fresh cgroup namespace"
+cls: [1996]
+category: Breaking Changes
+credits: raito
+---
+
+If you haven't enabled the experimental `cgroups` feature, Nix previously launched builder processes in new namespaces but did not create new cgroup namespaces. As a result, derivations could access and observe the parent cgroup namespace.
+
+Although this update introduces a breaking change, it ensures that all derivations now start in a fresh cgroup namespace by default. This reduces potential impurities observable within the sandbox, improving the likelihood of reproducible builds across different environments.
diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc
index 1bf87e6ec..03d38115d 100644
--- a/lix/libstore/build/local-derivation-goal.cc
+++ b/lix/libstore/build/local-derivation-goal.cc
@@ -1665,10 +1665,12 @@ void LocalDerivationGoal::runChild()
             if (unshare(CLONE_NEWNS) == -1)
                 throw SysError("unsharing mount namespace");
 
+            /* Creating a new cgroup namespace is independent of whether we enabled the cgroup experimental feature.
+             * We always create a new cgroup namespace from a sandboxing perspective. */
             /* Unshare the cgroup namespace. This means
                /proc/self/cgroup will show the child's cgroup as '/'
                rather than whatever it is in the parent. */
-            if (cgroup && unshare(CLONE_NEWCGROUP) == -1)
+            if (unshare(CLONE_NEWCGROUP) == -1)
                 throw SysError("unsharing cgroup namespace");
 
             /* Do the chroot(). */