diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix
index 56bcb13e68bf..c62bcfeb4540 100644
--- a/nixos/modules/virtualisation/nspawn-container/default.nix
+++ b/nixos/modules/virtualisation/nspawn-container/default.nix
@@ -71,6 +71,14 @@ in
     boot.isNspawnContainer = true;
 
     assertions = [
+      {
+        assertion = config.specialisation == { };
+        message = ''
+          Setting 'specialisation' is disallowed for systemd-nspawn container configurations.
+          Activating a specialisation requires creating SUID wrappers (e.g., for 'sudo'),
+          which is prohibited within the Nix build sandbox where the test is run.
+        '';
+      }
       {
         # Check every interface defined in allInterfaces.
         # Containers try to create a bridge "${config.system.name}-${interfaceName}"