diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 4e7fd04acb84..617d1f30f6d0 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -11,6 +11,10 @@
   swig,
   libcap_ng,
   installShellFiles,
+  makeWrapper,
+  gawk,
+  gnugrep,
+  coreutils,
 
   enablePython ? !stdenv.hostPlatform.isStatic,
 
@@ -58,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     installShellFiles
+    makeWrapper
   ]
   ++ lib.optionals enablePython [
     python3Packages.python # for python3-config
@@ -109,6 +114,20 @@ stdenv.mkDerivation (finalAttrs: {
     installShellCompletion --bash init.d/audit.bash_completion
   '';
 
+  postFixup = ''
+    substituteInPlace $bin/bin/augenrules \
+      --replace-fail "/sbin/auditctl" "$bin/bin/auditctl" \
+      --replace-fail "/bin/ls" "ls"
+    wrapProgram $bin/bin/augenrules \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          gawk
+          gnugrep
+          coreutils
+        ]
+      }
+  '';
+
   enableParallelBuilding = true;
 
   passthru = {