diff --git a/packages/core/src/utils/paths.test.ts b/packages/core/src/utils/paths.test.ts
index 173ec637481..1e9457ec562 100644
--- a/packages/core/src/utils/paths.test.ts
+++ b/packages/core/src/utils/paths.test.ts
@@ -874,6 +874,30 @@ describe('normalizePath', () => {
       expect(isTrustedSystemPath('/Library/rg')).toBe(false);
     });
 
+    it('should allow Nix store paths on macOS and Linux', () => {
+      mockPlatform('linux');
+
+      // NixOS / nix-darwin / devenv managed binaries
+      expect(
+        isTrustedSystemPath(
+          '/nix/store/abc123def456-ripgrep-14.1.0/bin/rg',
+        ),
+      ).toBe(true);
+      expect(
+        isTrustedSystemPath(
+          '/nix/store/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-ripgrep-14.1.0/bin/rg',
+        ),
+      ).toBe(true);
+
+      mockPlatform('darwin');
+
+      expect(
+        isTrustedSystemPath(
+          '/nix/store/abc123def456-ripgrep-14.1.0/bin/rg',
+        ),
+      ).toBe(true);
+    });
+
     it('should allow 1P internal hermetic execution paths', () => {
       mockPlatform('linux');
 
diff --git a/packages/core/src/utils/paths.ts b/packages/core/src/utils/paths.ts
index 09c2bebb53e..51e7b93f957 100644
--- a/packages/core/src/utils/paths.ts
+++ b/packages/core/src/utils/paths.ts
@@ -562,6 +562,8 @@ export function isTrustedSystemPath(filePath: string): boolean {
       '/usr/local/Cellar',
       '/usr/sbin',
       '/sbin',
+      // Nix package manager (NixOS, nix-darwin, devenv)
+      '/nix/store',
       // 1P internal hermetic execution paths
       '/google/bin',
       '/google/src/cloud',