diff --git a/os/bazelisk/setup.sh b/os/bazelisk/setup.sh
index 6077697..bf7b6f3 100644
--- a/os/bazelisk/setup.sh
+++ b/os/bazelisk/setup.sh
@@ -8,7 +8,8 @@ BASE=$(git rev-parse --show-toplevel)
 incus launch images:nixos/unstable bazelisk -c security.nesting=true
 incus config device add bazelisk nixos-common disk "source=$BASE" "path=/etc/nixos"
 sleep 10s # allow it some time to boot
-incus exec bazelisk -- nix shell --extra-experimental-features "nix-command flakes" nixpkgs#git --command git config --global --add safe.directory /etc/nixos || true
+incus exec bazelisk -- nix shell --extra-experimental-features "nix-command flakes" nixpkgs#git --command git config --global --add safe.directory /etc/nixos
+incus exec bazelisk -- nix shell --extra-experimental-features "nix-command flakes" nixpkgs#git --command git config --global --add safe.directory /etc/nixos/.git
 incus exec bazelisk -- nix shell --extra-experimental-features "nix-command flakes" nixpkgs#git --command nixos-rebuild switch --flake /etc/nixos#bazelisk || true
 bash reset.sh
 incus restart bazelisk
diff --git a/pkgs/bazelisk-env/default.nix b/pkgs/bazelisk-env/default.nix
index b503fa6..62e928b 100644
--- a/pkgs/bazelisk-env/default.nix
+++ b/pkgs/bazelisk-env/default.nix
@@ -47,6 +47,8 @@ buildFHSUserEnv {
   # everything that we need both 64bit and 32bit versions of
   multiPkgs = pkgs: with pkgs; [
     zlib
+    # for python3 build
+    libxcrypt-legacy
   ];
 
   profile = ''