diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index f819429f4deb..6f7caa8ec02c 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -8,7 +8,9 @@ let
     url    = "https://raw.githubusercontent.com/apple/swift-corelibs-foundation/9a5d8420f7793e63a8d5ec1ede516c4ebec939f0/CoreFoundation/Base.subproj/CFSystemDirectories.c";
     sha256 = "0krfyghj4f096arvvpf884ra5czqlmbrgf8yyc0b3avqmb613pcc";
   };
-in stdenv.mkDerivation {
+in
+
+stdenv.mkDerivation {
   name = "swift-corefoundation";
 
   src = fetchFromGitHub {
@@ -34,6 +36,10 @@ in stdenv.mkDerivation {
       --replace "cf.CFLAGS += '-DDEPLOYMENT" '#' \
       --replace "cf.LDFLAGS += '-ldispatch" '#'
 
+    # Fix sandbox impurities.
+    substituteInPlace ../lib/script.py \
+      --replace '/bin/cp' cp
+
     # Includes xpc for some initialization routine that they don't define anyway, so no harm here
     substituteInPlace PlugIn.subproj/CFBundlePriv.h \
       --replace '#if (TARGET_OS_MAC' '#if (0'
@@ -53,7 +59,7 @@ in stdenv.mkDerivation {
 
   BUILD_DIR = "./Build";
   CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
-  
+
   # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
   # and this version is a version from there. No idea how accurate it is.
   LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";