diff --git a/pkgs/by-name/su/sudo/package.nix b/pkgs/by-name/su/sudo/package.nix
index f916f8d53377..781761698db3 100644
--- a/pkgs/by-name/su/sudo/package.nix
+++ b/pkgs/by-name/su/sudo/package.nix
@@ -54,6 +54,18 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-sssd-lib=${sssd}/lib"
   ];
 
+  outputs = [
+    "out"
+    "man"
+    "doc"
+    "dev"
+  ];
+  # The default stdenv ./configure flags for some reason cause the upstream's
+  # Makefile to `mkdir /var/db`, which fails in the sandbox. Since we split
+  # only trivial outputs - a single header and documentation, we can safely set
+  # the following:
+  setOutputFlags = false;
+
   postConfigure = ''
     cat >> pathnames.h <<'EOF'
       #undef _PATH_MV