diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 2b0a7f76eab3..6d68a2b8b44e 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -311,7 +311,10 @@ stdenv.mkDerivation (finalAttrs: {
     # Samba does its own shebang patching, but uses build Python
     find $out/bin -type f -executable | while read file; do
       isScript "$file" || continue
-      sed -i 's^${lib.getBin buildPackages.python3Packages.python}^${lib.getBin python3Packages.python}^' "$file"
+      substituteInPlace "$file" \
+        --replace-fail \
+          ${lib.getBin buildPackages.python3Packages.python} \
+          ${lib.getBin python3Packages.python}
     done
   '';