diff --git a/AppDir/AppRun b/AppDir/AppRun
deleted file mode 100755
index 6e3cecf..0000000
--- a/AppDir/AppRun
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-export PATH=$APPDIR/bin
-exec entrypoint "$@"
diff --git a/default.nix b/default.nix
index 12f7858..7ebdd3c 100644
--- a/default.nix
+++ b/default.nix
@@ -91,19 +91,32 @@ in rec {
     '';
   };
 
-  appDir = pkgs.buildEnv {
+  appDir = pkgs.stdenv.mkDerivation {
     name = "cryptic-net-AppDir";
-    paths = [
 
-      ./AppDir
-      version
-      dnsmasq
-      nebula
-      garage
-      pkgs.minio-client
-      entrypoint
+    src = pkgs.buildEnv {
+      name = "cryptic-net-AppDir-base";
+      paths = [
 
-    ] ++ (if bootstrap != null then [ rootedBootstrap ] else []);
+        ./AppDir
+        version
+        dnsmasq
+        nebula
+        garage
+        pkgs.minio-client
+        entrypoint
+
+      ] ++ (if bootstrap != null then [ rootedBootstrap ] else []);
+    };
+
+    builder = builtins.toFile "build.sh" ''
+      source $stdenv/setup
+      cp -rL "$src" "$out"
+      chmod +w "$out" -R
+
+      cd "$out"
+      cp ./bin/entrypoint ./AppRun
+    '';
   };
 
   appimagetool = pkgs.callPackage ./nix/appimagetool.nix {};
diff --git a/entrypoint/src/cmd/entrypoint/dnsmasq_util.go b/entrypoint/src/cmd/entrypoint/dnsmasq_util.go
index 871366b..4ee2a3e 100644
--- a/entrypoint/src/cmd/entrypoint/dnsmasq_util.go
+++ b/entrypoint/src/cmd/entrypoint/dnsmasq_util.go
@@ -45,7 +45,7 @@ func dnsmasqPmuxProcConfig(
 
 	return pmuxlib.ProcessConfig{
 		Name: "dnsmasq",
-		Cmd:  "dnsmasq",
+		Cmd:  binPath("dnsmasq"),
 		Args: []string{"-d", "-C", confPath},
 	}, nil
 }
diff --git a/entrypoint/src/cmd/entrypoint/garage.go b/entrypoint/src/cmd/entrypoint/garage.go
index 4401ded..ef446d3 100644
--- a/entrypoint/src/cmd/entrypoint/garage.go
+++ b/entrypoint/src/cmd/entrypoint/garage.go
@@ -50,7 +50,7 @@ var subCmdGarageMC = subCmd{
 			args = args[i:]
 		}
 
-		args = append([]string{"mc"}, args...)
+		args = append([]string{binPath("mc")}, args...)
 
 		var (
 			mcHostVar = fmt.Sprintf(
@@ -92,7 +92,7 @@ var subCmdGarageCLI = subCmd{
 		}
 
 		var (
-			binPath = filepath.Join(envAppDirPath, "bin/garage")
+			binPath = binPath("garage")
 			args    = append([]string{"garage"}, subCmdCtx.args...)
 			cliEnv  = append(
 				os.Environ(),
diff --git a/entrypoint/src/cmd/entrypoint/garage_util.go b/entrypoint/src/cmd/entrypoint/garage_util.go
index 85d8b99..addc7c7 100644
--- a/entrypoint/src/cmd/entrypoint/garage_util.go
+++ b/entrypoint/src/cmd/entrypoint/garage_util.go
@@ -168,7 +168,7 @@ func garagePmuxProcConfigs(
 
 		pmuxProcConfigs = append(pmuxProcConfigs, pmuxlib.ProcessConfig{
 			Name: fmt.Sprintf("garage-%d", alloc.RPCPort),
-			Cmd:  "garage",
+			Cmd:  binPath("garage"),
 			Args: []string{"-c", childConfigPath, "server"},
 			StartAfterFunc: func(ctx context.Context) error {
 				return waitForNebula(ctx, hostBootstrap)
diff --git a/entrypoint/src/cmd/entrypoint/main.go b/entrypoint/src/cmd/entrypoint/main.go
index 5cdbf17..6b473d8 100644
--- a/entrypoint/src/cmd/entrypoint/main.go
+++ b/entrypoint/src/cmd/entrypoint/main.go
@@ -31,6 +31,10 @@ var (
 	envDataDirPath    = filepath.Join(xdg.DataHome, "cryptic-net")
 )
 
+func binPath(name string) string {
+	return filepath.Join(envAppDirPath, "bin", name)
+}
+
 func main() {
 
 	logger := mlog.NewLogger(&mlog.LoggerOpts{
diff --git a/entrypoint/src/cmd/entrypoint/nebula_util.go b/entrypoint/src/cmd/entrypoint/nebula_util.go
index d0f58bf..7ba0b64 100644
--- a/entrypoint/src/cmd/entrypoint/nebula_util.go
+++ b/entrypoint/src/cmd/entrypoint/nebula_util.go
@@ -111,7 +111,7 @@ func nebulaPmuxProcConfig(
 
 	return pmuxlib.ProcessConfig{
 		Name: "nebula",
-		Cmd:  "nebula",
+		Cmd:  binPath("nebula"),
 		Args: []string{"-config", nebulaYmlPath},
 	}, nil
 }