diff --git a/pkgs/build-support/dotnet/build-dotnet-module/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
index 7b88b16064bc..9dd36b03fc48 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@@ -1,6 +1,8 @@
 { lib
+, runtimeShell
 , stdenvNoCC
 , callPackage
+, substituteAll
 , writeShellScript
 , srcOnly
 , linkFarmFromDrvs
@@ -202,131 +204,48 @@ stdenvNoCC.mkDerivation (args // {
   passthru = {
     inherit nuget-source;
   } // lib.optionalAttrs (!lib.isDerivation nugetDeps) {
-    fetch-deps =
-      let
-        flags = dotnetFlags ++ dotnetRestoreFlags;
-        runtimeIds =
-          if runtimeId != null
-          then [ runtimeId ]
-          else map (system: dotnetCorePackages.systemToDotnetRid system) platforms;
-        defaultDepsFile =
-          # Wire in the nugetDeps file such that running the script with no args
-          # runs it agains the correct deps file by default.
-          # Note that toString is necessary here as it results in the path at
-          # eval time (i.e. to the file in your local Nixpkgs checkout) rather
-          # than the Nix store path of the path after it's been imported.
-          if lib.isPath nugetDepsFile && !lib.hasPrefix "${builtins.storeDir}/" (toString nugetDepsFile)
-          then toString nugetDepsFile
-          else ''$(mktemp -t "${pname}-deps-XXXXXX.nix")'';
-      in
-      writeShellScript "fetch-${pname}-deps" ''
-        set -euo pipefail
-
-        export PATH="${lib.makeBinPath [ coreutils runtimeShellPackage dotnet-sdk (nuget-to-nix.override { inherit dotnet-sdk; }) ]}"
-
-        for arg in "$@"; do
-            case "$arg" in
-                --keep-sources|-k)
-                    keepSources=1
-                    shift
-                    ;;
-                --help|-h)
-                    echo "usage: $0 [--keep-sources] [--help] <output path>"
-                    echo "    <output path>   The path to write the lockfile to. A temporary file is used if this is not set"
-                    echo "    --keep-sources  Dont remove temporary directories upon exit, useful for debugging"
-                    echo "    --help          Show this help message"
-                    exit
-                    ;;
-            esac
-        done
-
-        if [[ ''${TMPDIR:-} == /run/user/* ]]; then
-           # /run/user is usually a tmpfs in RAM, which may be too small
-           # to store all downloaded dotnet packages
-           unset TMPDIR
-        fi
-
-        export tmp=$(mktemp -td "deps-${pname}-XXXXXX")
-        HOME=$tmp/home
-
-        exitTrap() {
-            test -n "''${ranTrap-}" && return
-            ranTrap=1
-
-            if test -n "''${keepSources-}"; then
-                echo -e "Path to the source: $tmp/src\nPath to the fake home: $tmp/home"
-            else
-                rm -rf "$tmp"
-            fi
-
-            # Since mktemp is used this will be empty if the script didnt succesfully complete
-            if ! test -s "$depsFile"; then
-              rm -rf "$depsFile"
-            fi
-        }
-
-        trap exitTrap EXIT INT TERM
-
-        dotnetRestore() {
-            local -r project="''${1-}"
-            local -r rid="$2"
-
-            dotnet restore ''${project-} \
-                -p:ContinuousIntegrationBuild=true \
-                -p:Deterministic=true \
-                --packages "$tmp/nuget_pkgs" \
-                --runtime "$rid" \
-                --no-cache \
-                --force \
-                ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
-                ${lib.escapeShellArgs flags}
-        }
-
-        declare -a projectFiles=( ${lib.escapeShellArgs projectFiles} )
-        declare -a testProjectFiles=( ${lib.escapeShellArgs testProjectFiles} )
-
-        export DOTNET_NOLOGO=1
-        export DOTNET_CLI_TELEMETRY_OPTOUT=1
-
-        depsFile=$(realpath "''${1:-${defaultDepsFile}}")
-        echo Will write lockfile to "$depsFile"
-        mkdir -p "$tmp/nuget_pkgs"
-
-        storeSrc="${srcOnly args}"
-        src=$tmp/src
-        cp -rT "$storeSrc" "$src"
-        chmod -R +w "$src"
-
-        cd "$src"
-        echo "Restoring project..."
-
-        ${dotnet-sdk}/bin/dotnet tool restore
-        cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
-
-        for rid in "${lib.concatStringsSep "\" \"" runtimeIds}"; do
-            (( ''${#projectFiles[@]} == 0 )) && dotnetRestore "" "$rid"
-
-            for project in ''${projectFiles[@]-} ''${testProjectFiles[@]-}; do
-                dotnetRestore "$project" "$rid"
-            done
-        done
-        # Second copy, makes sure packages restored by ie. paket are included
-        cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
-
-        echo "Succesfully restored project"
-
-        echo "Writing lockfile..."
-
-        excluded_sources="${lib.concatStringsSep " " sdkDeps}"
-        for excluded_source in ''${excluded_sources[@]}; do
-          ls "$excluded_source" >> "$tmp/excluded_list"
-        done
-        tmpFile="$tmp"/deps.nix
-        echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n" > "$tmpFile"
-        nuget-to-nix "$tmp/nuget_pkgs" "$tmp/excluded_list" >> "$tmpFile"
-        mv "$tmpFile" "$depsFile"
-        echo "Succesfully wrote lockfile to $depsFile"
-      '';
+    fetch-deps = let
+      flagsList = dotnetFlags ++ dotnetRestoreFlags;
+      flags = lib.concatStringsSep " " (map lib.escapeShellArg flagsList);
+      disableParallel =
+        lib.optionalString (!enableParallelBuilding) "--disable-parallel";
+      runtimeIdsList = if runtimeId != null then
+        [ runtimeId ]
+      else
+        map (system: dotnetCorePackages.systemToDotnetRid system) platforms;
+      runtimeIds =
+        lib.concatStringsSep " " (map lib.escapeShellArg runtimeIdsList);
+      defaultDepsFile =
+        # Wire in the nugetDeps file such that running the script with no args
+        # runs it agains the correct deps file by default.
+        # Note that toString is necessary here as it results in the path at
+        # eval time (i.e. to the file in your local Nixpkgs checkout) rather
+        # than the Nix store path of the path after it's been imported.
+        if lib.isPath nugetDepsFile
+        && !lib.hasPrefix "${builtins.storeDir}/" (toString nugetDepsFile) then
+          toString nugetDepsFile
+        else
+          ''$(mktemp -t "${pname}-deps-XXXXXX.nix")'';
+      storeSrc = srcOnly args;
+      projectFileStr = lib.escapeShellArg projectFiles;
+      testProjectFileStr = lib.escapeShellArg testProjectFiles;
+      path = lib.makeBinPath [
+        coreutils
+        runtimeShellPackage
+        dotnet-sdk
+        (nuget-to-nix.override { inherit dotnet-sdk; })
+      ];
+      dotnetSdkPath = toString dotnet-sdk;
+      excludedSources =
+        lib.concatStringsSep " " (map lib.escapeShellArg sdkDeps);
+    in substituteAll {
+      name = "fetch-deps";
+      src = ./fetch-deps.sh;
+      isExecutable = true;
+      inherit pname defaultDepsFile runtimeIds storeSrc flags disableParallel
+      projectFileStr testProjectFileStr path dotnetSdkPath excludedSources
+      runtimeShell;
+    };
   } // args.passthru or { };
 
   meta = (args.meta or { }) // { inherit platforms; };
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh b/pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh
new file mode 100644
index 000000000000..de134162dc84
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/fetch-deps.sh
@@ -0,0 +1,111 @@
+#! @runtimeShell@
+# shellcheck shell=bash
+set -euo pipefail
+
+export PATH="@path@"
+
+for arg in "$@"; do
+    case "$arg" in
+        --keep-sources|-k)
+            keepSources=1
+            shift
+            ;;
+        --help|-h)
+            echo "usage: $0 [--keep-sources] [--help] <output path>"
+            echo "    <output path>   The path to write the lockfile to. A temporary file is used if this is not set"
+            echo "    --keep-sources  Dont remove temporary directories upon exit, useful for debugging"
+            echo "    --help          Show this help message"
+            exit
+            ;;
+    esac
+done
+
+if [[ ${TMPDIR:-} == /run/user/* ]]; then
+   # /run/user is usually a tmpfs in RAM, which may be too small
+   # to store all downloaded dotnet packages
+   unset TMPDIR
+fi
+
+export tmp=$(mktemp -td "deps-@pname@-XXXXXX")
+HOME=$tmp/home
+
+exitTrap() {
+    test -n "${ranTrap-}" && return
+    ranTrap=1
+
+    if test -n "${keepSources-}"; then
+        echo -e "Path to the source: $tmp/src\nPath to the fake home: $tmp/home"
+    else
+        rm -rf "$tmp"
+    fi
+
+    # Since mktemp is used this will be empty if the script didnt succesfully complete
+    if ! test -s "$depsFile"; then
+      rm -rf "$depsFile"
+    fi
+}
+
+trap exitTrap EXIT INT TERM
+
+dotnetRestore() {
+    local -r project="${1-}"
+    local -r rid="$2"
+
+    dotnet restore ${project-} \
+        -p:ContinuousIntegrationBuild=true \
+        -p:Deterministic=true \
+        --packages "$tmp/nuget_pkgs" \
+        --runtime "$rid" \
+        --no-cache \
+        --force \
+        @disableParallel@ \
+        @flags@
+}
+
+declare -a projectFiles=( @projectFileStr@ )
+declare -a testProjectFiles=( @testProjectFileStr@ )
+
+export DOTNET_NOLOGO=1
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+
+depsFile=$(realpath "${1:-@defaultDepsFile@}")
+echo Will write lockfile to "$depsFile"
+mkdir -p "$tmp/nuget_pkgs"
+
+storeSrc="@storeSrc@"
+src=$tmp/src
+cp -rT "$storeSrc" "$src"
+chmod -R +w "$src"
+
+cd "$src"
+echo "Restoring project..."
+
+"@dotnetSdkPath@/bin/dotnet" tool restore
+cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
+
+runtimeIds=(@runtimeIds@)
+
+for rid in "${runtimeIds[@]}"; do
+    (( ${#projectFiles[@]} == 0 )) && dotnetRestore "" "$rid"
+
+    for project in ${projectFiles[@]-} ${testProjectFiles[@]-}; do
+        dotnetRestore "$project" "$rid"
+    done
+done
+# Second copy, makes sure packages restored by ie. paket are included
+cp -r $HOME/.nuget/packages/* $tmp/nuget_pkgs || true
+
+echo "Succesfully restored project"
+
+echo "Writing lockfile..."
+
+excluded_sources=( @excludedSources@ )
+for excluded_source in ${excluded_sources[@]}; do
+  ls "$excluded_source" >> "$tmp/excluded_list"
+done
+tmpFile="$tmp"/deps.nix
+echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n" > "$tmpFile"
+nuget-to-nix "$tmp/nuget_pkgs" "$tmp/excluded_list" >> "$tmpFile"
+mv "$tmpFile" "$depsFile"
+echo "Succesfully wrote lockfile to $depsFile"
+