diff --git a/.bazelrc b/.bazelrc
index 56e5428..f41b267 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -8,7 +8,7 @@ common --action_env="BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1"
 common --announce_rc
 common --color=yes
 common --curses=yes
-common --incompatible_strict_action_env
+#common --incompatible_strict_action_env
 common --ui_actions_shown=20
 common --progress_in_terminal_title
 common --enable_platform_specific_config
@@ -37,4 +37,5 @@ test --test_output=errors
 test --test_summary=detailed
 test --test_verbose_timeout_warnings
 
+import %workspace%/tools/shell_executable.bazelrc
 try-import %workspace%/user.bazelrc
diff --git a/tools/BUILD.bazel b/tools/BUILD.bazel
index 4984881..be636fb 100644
--- a/tools/BUILD.bazel
+++ b/tools/BUILD.bazel
@@ -3,6 +3,7 @@ load("@hedron_compile_commands//:refresh_compile_commands.bzl", "refresh_compile
 load("@platforms//host:constraints.bzl", "HOST_CONSTRAINTS")
 load("@rules_multirun//:defs.bzl", "multirun")
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+load("@bazel_skylib//rules:diff_test.bzl", "diff_test")
 
 buildifier(
     name = "buildifier.check",
@@ -20,7 +21,7 @@ genrule(
     name = "gen-clang-format",
     outs = ["clang-format.bash"],
     cmd = """
-echo "#!/bin/bash" > $@
+echo "#!/usr/bin/env bash" > $@
 echo "cd \\$$BUILD_WORKSPACE_DIRECTORY" >> $@
 echo "exec bazelisk build \\$$@ //..." >> $@
 """,
@@ -67,7 +68,7 @@ genrule(
     name = "gen-clang-tidy",
     outs = ["clang-tidy.bash"],
     cmd = """
-echo "#!/bin/bash" > $@
+echo "#!/usr/bin/env bash" > $@
 echo "cd \\$$BUILD_WORKSPACE_DIRECTORY" >> $@
 echo "exec bazelisk build {options} \\$${{@:-//...}}" >> $@
 """.format(
@@ -106,3 +107,24 @@ refresh_compile_commands(
         "//...": "--extra_toolchains=@llvm_toolchain//:all",
     },
 )
+
+genrule(
+    name = "actual_bazelrc",
+    outs = ["actual.bazelrc"],
+    srcs = [
+      "bazel-wrapper/flake.nix",
+      "bazel-wrapper/flake.lock",
+    ],
+    cmd = """
+      mkdir nix
+      cp -L ./tools/bazel-wrapper/flake.nix ./tools/bazel-wrapper/flake.lock ./nix
+      file=$$(nix build ./nix#shellExecutable --print-out-paths)
+      cp "$$file" $@
+    """,
+)
+
+diff_test(
+    name = "shell_executable.bazelrc_diff_test",
+    file1 = "shell_executable.bazelrc",
+    file2 = ":actual_bazelrc",
+)
diff --git a/tools/bazel-wrapper/flake.nix b/tools/bazel-wrapper/flake.nix
index 0661851..1f540d4 100644
--- a/tools/bazel-wrapper/flake.nix
+++ b/tools/bazel-wrapper/flake.nix
@@ -20,14 +20,19 @@
             bash
             bazelisk
             coreutils
+            diffutils
             findutils
             gnugrep
+            gnused
             nix
           ]
           ++ lib.optionals stdenv.isDarwin [
             darwin.cctools
           ];
       in {
+        shellExecutable = pkgs.writeText
+          "shell_executable.bazelrc"
+          "common --shell_executable ${pkgs.lib.getExe pkgs.bash}";
         default = pkgs.writeShellApplication {
           name = "bazel-wrapper";
           runtimeInputs = tools;
diff --git a/tools/shell_executable.bazelrc b/tools/shell_executable.bazelrc
new file mode 100644
index 0000000..0451672
--- /dev/null
+++ b/tools/shell_executable.bazelrc
@@ -0,0 +1 @@
+common --shell_executable /nix/store/0nxvi9r5ymdlr2p24rjj9qzyms72zld1-bash-interactive-5.2p37/bin/bash
\ No newline at end of file