diff --git a/pkgs/by-name/sa/sanitiseHeaderPathsHook/package.nix b/pkgs/by-name/sa/sanitiseHeaderPathsHook/package.nix
new file mode 100644
index 000000000000..6e6bd00ebf2f
--- /dev/null
+++ b/pkgs/by-name/sa/sanitiseHeaderPathsHook/package.nix
@@ -0,0 +1,18 @@
+{
+  lib,
+  makeSetupHook,
+  removeReferencesTo,
+}:
+
+makeSetupHook {
+  name = "sanitise-header-paths-hook";
+
+  substitutions = {
+    removeReferencesTo = lib.getExe removeReferencesTo;
+  };
+
+  meta = {
+    description = "Setup hook to sanitise header file paths to avoid leaked references through `__FILE__`";
+    maintainers = [ lib.maintainers.emily ];
+  };
+} ./sanitise-header-paths-hook.bash
diff --git a/pkgs/by-name/sa/sanitiseHeaderPathsHook/sanitise-header-paths-hook.bash b/pkgs/by-name/sa/sanitiseHeaderPathsHook/sanitise-header-paths-hook.bash
new file mode 100644
index 000000000000..60e311e12a84
--- /dev/null
+++ b/pkgs/by-name/sa/sanitiseHeaderPathsHook/sanitise-header-paths-hook.bash
@@ -0,0 +1,10 @@
+sanitiseHeaderPaths() {
+  local header
+  while IFS= read -r -d '' header; do
+    nixLog "sanitising header path in $header"
+    sed -i "1i#line 1 \"$header\"" "$header"
+    @removeReferencesTo@ -t "${!outputInclude}" "$header"
+  done < <(find "${!outputInclude}/include" -type f -print0)
+}
+
+preFixupHooks+=(sanitiseHeaderPaths)