diff --git a/lib/discourse/safe_exec.rb b/lib/discourse/safe_exec.rb
index dc32954245c..a89d9afac97 100644
--- a/lib/discourse/safe_exec.rb
+++ b/lib/discourse/safe_exec.rb
@@ -4,8 +4,8 @@ require "landlock"
 
 module Discourse
   class SafeExec
-    DEFAULT_READ_PATHS = %w[/bin /lib /lib64 /usr].freeze
-    DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr].freeze
+    DEFAULT_READ_PATHS = %w[/bin /lib /lib64 /usr /nix/store].freeze
+    DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr /nix/store].freeze
 
     def self.capture(
       *command,