diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 14f5fbeca252..493d75cc760a 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -423,10 +423,21 @@ let
           # Maybe related to how omni.ja file is mmapped into memory. See:
           # https://github.com/mozilla/gecko-dev/blob/b1662b447f306e6554647914090d4b73ac8e1664/modules/libjar/nsZipArchive.cpp#L204
           #
-          # The *.dylib files are copied, otherwise some basic functionality, e.g. Crypto API, is broken.
-          for file in $(find . -name "omni.ja" -o -name "*.dylib"); do
+          # Mach-O shared libraries must be copied, not symlinked, otherwise some
+          # functionality like the Crypto API and audio decoding is broken.
+          find . -type l -print0 |
+          while IFS= read -r -d "" file; do
+            case "$(basename "$file")" in
+              omni.ja)
+                ;;
+              *)
+                # Copy if the symlink resolves to a Mach-O dylib
+                otool -l "$file" 2>/dev/null | grep -q 'LC_ID_DYLIB' || continue
+                ;;
+            esac
+
             rm "$file"
-            cp "${browser}/${appPath}/$file" "$file"
+            cp "${browser}/${appPath}/''${file#./}" "$file"
           done
 
           # Copy any embedded .app directories; plugin-container fails to start otherwise.