diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
index abc0e10631e8..3948db7e4eea 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
@@ -1,3 +1,12 @@
+# Assert that FILE exists and is executable
+#
+# assertExecutable FILE
+assertExecutable() {
+    local file="$1"
+    [[ -f "$file" && -x "$file" ]] || \
+        die "Cannot wrap '$file' because it is not an executable file"
+}
+
 # Generate a binary executable wrapper for wrapping an executable.
 # The binary is compiled from generated C-code using gcc.
 # makeBinaryWrapper EXECUTABLE OUT_PATH ARGS
@@ -39,6 +48,7 @@ makeCWrapper() {
     local argv0 n params cmd main flagsBefore flags executable params length
     local uses_prefix uses_suffix uses_concat3
     executable=$(escapeStringLiteral "$1")
+    assertExecutable "$1"
     params=("$@")
     length=${#params[*]}
     for ((n = 1; n < length; n += 1)); do
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cbb01ce2c537..0e1dd457d840 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -606,7 +606,9 @@ in
   makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = targetPackages.runtimeShell; }; }
                               ../build-support/setup-hooks/make-wrapper.sh;
 
-  makeBinaryWrapper = makeSetupHook { } ../build-support/setup-hooks/make-binary-wrapper.sh;
+  makeBinaryWrapper = makeSetupHook {
+    deps = [ dieHook ];
+  } ../build-support/setup-hooks/make-binary-wrapper.sh;
 
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
     callPackage ../build-support/kernel/modules-closure.nix {