diff --git a/doc/manual/rl-next/libexpr-fix-stdout.md b/doc/manual/rl-next/libexpr-fix-stdout.md
new file mode 100644
index 000000000..b52490972
--- /dev/null
+++ b/doc/manual/rl-next/libexpr-fix-stdout.md
@@ -0,0 +1,9 @@
+---
+synopsis: "flake config warnings are now printed to stderr"
+issues: [1155]
+cls: [5379]
+category: "Fixes"
+credits: [lheckemann]
+---
+
+The settings listed in a flake-config confirmation prompt are now printed to stderr rather than stdout, which allows `nix print-dev-env` to emit valid bash again even in the presence of untrusted settings.
diff --git a/lix/libexpr/flake/config.cc b/lix/libexpr/flake/config.cc
index fa32c747a..6d66c6fac 100644
--- a/lix/libexpr/flake/config.cc
+++ b/lix/libexpr/flake/config.cc
@@ -35,12 +35,14 @@ static bool batchAskForSetting(
     TrustedList & trustedList,
     std::map<std::string, std::string> & untrustedSettings)
 {
-    printWarning("The following settings require your decision:");
+    std::string warning("The following settings require your decision:");
     for (const auto & [name, valueS] : untrustedSettings) {
         // FIXME: filter ANSI escapes, newlines, \r, etc.
-        logger->cout("- %s = %s", name, valueS);
+        warning += fmt("\n- %s = %s", name, valueS);
     }
 
+    printWarning("%s", warning);
+
     auto reply = logger
                      ->ask(
                          fmt("Do you want to allow configuration settings to be applied?\nThis may allow the "