diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh
index 6dc22651c..7c25c2727 100644
--- a/lix/libstore/build/local-derivation-goal.hh
+++ b/lix/libstore/build/local-derivation-goal.hh
@@ -278,12 +278,6 @@ struct LocalDerivationGoal : public DerivationGoal
 protected:
     using DerivationGoal::DerivationGoal;
 
-    /**
-     * Whether to run pasta for network-endowed derivations. Running pasta
-     * currently requires actively waiting for its net-ns setup to finish.
-     */
-    bool runPasta = false;
-
     /**
      * Setup dependencies outside the sandbox.
      * Called in the parent nix process.
diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index aa6966e3d..e8398b130 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -904,7 +904,7 @@ void LinuxLocalDerivationGoal::prepareSandbox()
 
 std::string LinuxLocalDerivationGoal::rewriteResolvConf(std::string fromHost)
 {
-    if (!runPasta) {
+    if (!runPasta()) {
         return fromHost;
     }
 
@@ -1211,7 +1211,7 @@ bool LinuxLocalDerivationGoal::prepareChildSetup()
         throw SysError("setuid failed");
     }
 
-    if (runPasta) {
+    if (runPasta()) {
         // wait for the pasta interface to appear. pasta can't signal us when
         // it's done setting up the namespace, so we have to wait for a while
         AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
@@ -1299,10 +1299,6 @@ Pid LinuxLocalDerivationGoal::startChild(
        us.
     */
 
-    // don't launch pasta unless we have a tun device. in a build sandbox we
-    // commonly do not, and trying to run pasta anyway naturally won't work.
-    runPasta = !privateNetwork() && settings.pastaPath != "" && pathExists("/dev/net/tun");
-
     userNamespaceSync.create();
 
     Pipe sendPid;
@@ -1408,7 +1404,7 @@ Pid LinuxLocalDerivationGoal::startChild(
     /* Signal the builder that we've updated its user namespace. */
     writeFull(userNamespaceSync.writeSide.get(), "1");
 
-    if (runPasta) {
+    if (runPasta()) {
         // Bring up pasta, for handling FOD networking. We don't let it daemonize
         // itself for process managements reasons and kill it manually when done.
 
diff --git a/lix/libstore/platform/linux.hh b/lix/libstore/platform/linux.hh
index 8976a7a8d..4f60f6ce4 100644
--- a/lix/libstore/platform/linux.hh
+++ b/lix/libstore/platform/linux.hh
@@ -109,5 +109,20 @@ private:
     {
         return derivationType.value().isSandboxed();
     }
+
+    /**
+     * Whether to run pasta for network-endowed derivations. Running pasta
+     * currently requires actively waiting for its net-ns setup to finish.
+     */
+    bool runPasta()
+    {
+        if (!_runPasta) {
+            // don't launch pasta unless we have a tun device. in a build sandbox we
+            // commonly do not, and trying to run pasta anyway naturally won't work.
+            _runPasta = !privateNetwork() && settings.pastaPath != "" && pathExists("/dev/net/tun");
+        }
+        return *_runPasta;
+    }
+    std::optional<bool> _runPasta;
 };
 }