diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 5c224802d5bf..fd443ac773ff 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -27,6 +27,10 @@
 , # Allow a configuration attribute set to be passed in as an argument.
   config ? {}
 
+, # Temporary hack to let Nixpkgs forbid internal use of `lib.fileset`
+  # until <https://github.com/NixOS/nix/issues/11503> is fixed.
+  __allowFileset ? true
+
 , # List of overlays layers used to extend Nixpkgs.
   overlays ? []
 
@@ -47,7 +51,24 @@ let # Rename the function arguments
   crossSystem0 = crossSystem;
 
 in let
-  lib = import ../../lib;
+  pristineLib = import ../../lib;
+
+  lib =
+    if __allowFileset then
+      pristineLib
+    else
+      pristineLib.extend (_: _: {
+        fileset = abort ''
+
+          The use of `lib.fileset` is currently forbidden in Nixpkgs due to the
+          upstream Nix bug <https://github.com/NixOS/nix/issues/11503>. This
+          causes difficult‐to‐debug errors when combined with chroot stores,
+          such as in the NixOS installer.
+
+          For packages that require source to be vendored inside Nixpkgs,
+          please use a subdirectory of the package instead.
+        '';
+      });
 
   inherit (lib) throwIfNot;
 
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 1ce8f8f709e2..492a7503a03d 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -17,7 +17,10 @@
 , # Strip most of attributes when evaluating to spare memory usage
   scrubJobs ? true
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-  nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
+  nixpkgsArgs ? {
+    config = { allowUnfree = false; inHydra = true; };
+    __allowFileset = false;
+  }
 }:
 
 let
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index 945f0e6d2954..a19bc6f8ecaa 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -43,6 +43,8 @@ in
       "${variant}Support" = true;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
   ...
 }@args:
diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index c7581c47d341..a2821386ce3e 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -3,7 +3,10 @@
 , packageSet ? (import ../..)
 , scrubJobs ? true
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-  nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
+  nixpkgsArgs ? {
+    config = { allowUnfree = false; inHydra = true; };
+    __allowFileset = false;
+  }
 }:
 
 let
diff --git a/pkgs/top-level/release-outpaths.nix b/pkgs/top-level/release-outpaths.nix
index 0b70ea631244..e6caabec04e9 100644
--- a/pkgs/top-level/release-outpaths.nix
+++ b/pkgs/top-level/release-outpaths.nix
@@ -57,6 +57,8 @@ let
 
             inHydra = true;
           };
+
+          __allowFileset = false;
         };
       };
   recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index a6222acaad53..161a6ddb68c3 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -15,6 +15,8 @@
       allowUnfree = false;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
 }:
 
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 42cf6e79b732..511cef6a0d8a 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -19,6 +19,8 @@
       allowUnfree = false;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
 }:
 
diff --git a/pkgs/top-level/release-unfree-redistributable.nix b/pkgs/top-level/release-unfree-redistributable.nix
index 96384e9fb020..45940c4d02cc 100644
--- a/pkgs/top-level/release-unfree-redistributable.nix
+++ b/pkgs/top-level/release-unfree-redistributable.nix
@@ -37,6 +37,8 @@
       cudaSupport = true;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
   # We only build the full package set on infrequently releasing channels.
   full ? false,
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 0140f0bd9d6a..78bdf1491125 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -28,16 +28,20 @@
   # Strip most of attributes when evaluating to spare memory usage
 , scrubJobs ? true
   # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-, nixpkgsArgs ? { config = {
-    allowUnfree = false;
-    inHydra = true;
-    # Exceptional unsafe packages that we still build and distribute,
-    # so users choosing to allow don't have to rebuild them every time.
-    permittedInsecurePackages = [
-      "olm-3.2.16" # see PR #347899
-      "kanidm_1_3-1.3.3"
-    ];
-  }; }
+, nixpkgsArgs ? {
+    config = {
+      allowUnfree = false;
+      inHydra = true;
+      # Exceptional unsafe packages that we still build and distribute,
+      # so users choosing to allow don't have to rebuild them every time.
+      permittedInsecurePackages = [
+        "olm-3.2.16" # see PR #347899
+        "kanidm_1_3-1.3.3"
+      ];
+    };
+
+    __allowFileset = false;
+  }
 
   # This flag, if set to true, will inhibit the use of `mapTestOn`
   # and `release-lib.packagePlatforms`.  Generally, it causes the