diff --git a/package.nix b/package.nix
index 3dc355e..27d8cc5 100644
--- a/package.nix
+++ b/package.nix
@@ -9,6 +9,9 @@
   # 7.x in nixpkgs which doesn't ship libquery_engine.node, so we'd fail
   # at postinstall.
   prisma-engines_6,
+  bash,
+  coreutils,
+  gnused,
   openssl,
   sqlite,
   python311,
@@ -131,7 +134,22 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper ${lib.getExe nodejs_24} $out/bin/nsecbunkerd \
       --add-flags $out/share/nsecbunkerd/scripts/start.js \
       --set NODE_ENV production \
-      --prefix PATH : ${lib.makeBinPath [ openssl nodejs_24 ]} \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          openssl
+          nodejs_24
+          # scripts/start.js shells out to `npm run prisma:migrate`, and
+          # npm needs a shell to spawn at all. The pnpm-generated
+          # `node_modules/.bin/prisma` shim is itself a /bin/sh script
+          # that resolves its basedir with `dirname` + `sed`. Ship all
+          # three so the launcher works under any caller's environment
+          # (the systemd unit's PATH, docker compose, a bare shell)
+          # rather than depending on what the caller happens to export.
+          bash
+          coreutils
+          gnused
+        ]
+      } \
       ${
         lib.concatStringsSep " \\\n      " (
           lib.mapAttrsToList (n: v: "--set ${n} ${lib.escapeShellArg v}") prismaEnv