diff --git a/pkgs/by-name/ba/bash-preexec/package.nix b/pkgs/by-name/ba/bash-preexec/package.nix
index 6ca0b8f337bc..57db5ef7afa0 100644
--- a/pkgs/by-name/ba/bash-preexec/package.nix
+++ b/pkgs/by-name/ba/bash-preexec/package.nix
@@ -3,10 +3,11 @@
   lib,
   fetchFromGitHub,
   bats,
+  git,
 }:
 
 let
-  version = "0.6.0";
+  version = "0.7.0";
 in
 stdenvNoCC.mkDerivation {
   pname = "bash-preexec";
@@ -16,10 +17,13 @@ stdenvNoCC.mkDerivation {
     owner = "rcaloras";
     repo = "bash-preexec";
     tag = version;
-    hash = "sha256-4DzbeIiUX7iXy2CeSvRC2X+XnjVk+/UiMbM/dLHx7zU=";
+    hash = "sha256-/3cZkVQQAcsl3bA7WfvxDxw13NwBr5iylUNybENjV80=";
   };
 
-  nativeCheckInputs = [ bats ];
+  nativeCheckInputs = [
+    bats
+    git
+  ];
 
   dontConfigure = true;
   doCheck = true;
@@ -35,6 +39,10 @@ stdenvNoCC.mkDerivation {
     # See https://github.com/rcaloras/bash-preexec/issues/121
     sed -i '/^@test.*IFS/,/^}/d' test/bash-preexec.bats
 
+    # release-script.bats executes script/release directly; its
+    # `#!/usr/bin/env bash` shebang fails in the sandbox (no /usr/bin/env).
+    patchShebangs script/release
+
     runHook postPatch
   '';