--- a/src/harness/sandbox.rs
+++ b/src/harness/sandbox.rs
@@ -414,8 +414,25 @@
     }
 
     // 5. System toolchains, device nodes, runtime files (DNS /run/systemd/resolve), and binaries (Read-Only + Execute)
+    //
+    // On NixOS and Guix /bin, /usr/bin and /lib are symlink farms: every executable
+    // resolves below the package store, and Landlock matches the resolved target rather
+    // than the symlinked view, so the store has to be listed here or nothing can be exec'd
+    // at all. Store paths are world-readable by design, so read+execute there adds no
+    // reach that a local user does not already have.
     let ro_paths = [
-        "/usr", "/bin", "/lib", "/lib64", "/opt", "/etc", "/dev", "/proc", "/sys", "/run", "/var",
+        "/usr",
+        "/bin",
+        "/lib",
+        "/lib64",
+        "/opt",
+        "/etc",
+        "/dev",
+        "/proc",
+        "/sys",
+        "/run",
+        "/var",
+        "/nix/store",
     ];
     for p in ro_paths {
         if Path::new(p).exists()