From fb5b3c5c30f3d3adb0b8d0e59d79ddf5198770a5 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 5 Mar 2026 02:58:30 -0700
Subject: [PATCH] libvirt: fix virt-secret-init-encryption

---
 pkgs/by-name/li/libvirt/package.nix | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libvirt/package.nix b/pkgs/by-name/li/libvirt/package.nix
index e8544e5204b6..b1b7ef54b02b 100644
--- a/pkgs/by-name/li/libvirt/package.nix
+++ b/pkgs/by-name/li/libvirt/package.nix
@@ -33,11 +33,13 @@
   python3,
   readline,
   rpcsvc-proto,
+  runtimeShell,
   stdenv,
   replaceVars,
   xhtml1,
   json_c,
   writeScript,
+  writeShellApplication,
   nixosTests,
 
   # Linux
@@ -179,7 +181,23 @@ stdenv.mkDerivation rec {
     sed -i '/libxlxml2domconfigtest/d' tests/meson.build
     substituteInPlace src/libxl/libxl_capabilities.h \
      --replace-fail /usr/lib/xen ${xen}/libexec/xen
-  '';
+  ''
+  + lib.optionalString isLinux (
+    let
+      script = writeShellApplication {
+        name = "virt-secret-init-encryption-sh";
+        runtimeInputs = [
+          coreutils
+          systemd
+        ];
+        text = ''exec ${runtimeShell} "$@"'';
+      };
+    in
+    ''
+      substituteInPlace src/secret/virt-secret-init-encryption.service.in \
+        --replace-fail /usr/bin/sh ${lib.getExe script}
+    ''
+  );
 
   strictDeps = true;