diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index c6c5f758dfc8..cd24ce5ba03c 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -393,6 +393,10 @@ buildGoModule (finalAttrs: {
       --replace-fail '"$LDFLAGS $STATIC" -o' \
                 '"$LDFLAGS" -o'
 
+    # Ensure the embedded tarball is reproducible: sort file order and clamp timestamps
+    substituteInPlace scripts/package-cli \
+      --replace-fail 'tar cvf' 'tar c --sort=name --mtime=@0 -vf'
+
     # Add the -e flag to process "errornous" packages. We need to modify this because the upstream
     # build-time version detection doesn't work with a vendor directory.
     substituteInPlace scripts/version.sh \