diff --git a/nix/gyp-darwin-sandbox-fix.patch b/nix/gyp-darwin-sandbox-fix.patch
new file mode 100644
index 0000000..85f5d91
--- /dev/null
+++ b/nix/gyp-darwin-sandbox-fix.patch
@@ -0,0 +1,325 @@
+Fixes gyp trying to execute a file with /usr/bin/env shebang in Darwin
+sandbox. This is an upstream gyp-next PR backported for Node.js 14.
+
+See https://github.com/nodejs/gyp-next/pull/216
+
+diff --git a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/make.py b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/make.py
+index 1960536794..7edba87602 100644
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/make.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/make.py
+@@ -27,6 +27,7 @@ import os
+ import re
+ import sys
+ import subprocess
++import sys
+ import gyp
+ import gyp.common
+ import gyp.xcode_emulation
+@@ -176,7 +177,7 @@ cmd_solink_module = $(LINK.$(TOOLSET)) -shared $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSE
+ 
+ LINK_COMMANDS_MAC = """\
+ quiet_cmd_alink = LIBTOOL-STATIC $@
+-cmd_alink = rm -f $@ && ./gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %.o,$^)
++cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
+ 
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+ cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o "$@" $(LD_INPUTS) $(LIBS)
+@@ -186,7 +187,7 @@ cmd_solink = $(LINK.$(TOOLSET)) -shared $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o
+ 
+ quiet_cmd_solink_module = SOLINK_MODULE($(TOOLSET)) $@
+ cmd_solink_module = $(LINK.$(TOOLSET)) -bundle $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ $(filter-out FORCE_DO_CMD, $^) $(LIBS)
+-"""
++""" % {'python': sys.executable}
+ 
+ LINK_COMMANDS_ANDROID = """\
+ quiet_cmd_alink = AR($(TOOLSET)) $@
+@@ -514,14 +515,14 @@ cmd_pch_mm = $(CC.$(TOOLSET)) $(GYP_PCH_OBJCXXFLAGS) $(DEPFLAGS) -c -o $@ $<
+ # Use $(4) for the command, since $(2) and $(3) are used as flag by do_cmd
+ # already.
+ quiet_cmd_mac_tool = MACTOOL $(4) $<
+-cmd_mac_tool = ./gyp-mac-tool $(4) $< "$@"
++cmd_mac_tool = %(python)s gyp-mac-tool $(4) $< "$@"
+ 
+ quiet_cmd_mac_package_framework = PACKAGE FRAMEWORK $@
+-cmd_mac_package_framework = ./gyp-mac-tool package-framework "$@" $(4)
++cmd_mac_package_framework = %(python)s gyp-mac-tool package-framework "$@" $(4)
+ 
+ quiet_cmd_infoplist = INFOPLIST $@
+ cmd_infoplist = $(CC.$(TOOLSET)) -E -P -Wno-trigraphs -x c $(INFOPLIST_DEFINES) "$<" -o "$@"
+-"""
++""" % {'python': sys.executable}
+ 
+ 
+ def WriteRootHeaderSuffixRules(writer):
+@@ -2069,7 +2070,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+       'LINK.host':   GetEnvironFallback(('LINK_host', 'LINK'), '$(CXX.host)'),
+     }
+   if flavor == 'mac':
+-    flock_command = './gyp-mac-tool flock'
++    flock_command = '%s gyp-mac-tool flock' % sys.executable
+     header_params.update({
+         'flock': flock_command,
+         'flock_index': 2,
+@@ -2094,7 +2095,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+     })
+   elif flavor == 'solaris':
+     header_params.update({
+-        'flock': './gyp-flock-tool flock',
++        'flock': '%s gyp-flock-tool flock' % sys.executable,
+         'flock_index': 2,
+     })
+   elif flavor == 'freebsd':
+@@ -2112,7 +2113,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+     header_params.update({
+         'copy_archive_args': copy_archive_arguments,
+         'link_commands': LINK_COMMANDS_AIX,
+-        'flock': './gyp-flock-tool flock',
++        'flock': '%s gyp-flock-tool flock' % sys.executable,
+         'flock_index': 2,
+     })
+ 
+diff --git a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/ninja.py b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/ninja.py
+index 33cc253aba..cfcae03eeb 100644
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/ninja.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/generator/ninja.py
+@@ -2133,9 +2133,9 @@ def GenerateOutputForConfig(target_list, target_dicts, data, params,
+       'alink',
+       description='LIBTOOL-STATIC $out, POSTBUILDS',
+       command='rm -f $out && '
+-              './gyp-mac-tool filter-libtool libtool $libtool_flags '
++              '%s gyp-mac-tool filter-libtool libtool $libtool_flags '
+               '-static -o $out $in'
+-              '$postbuilds')
++              '$postbuilds' % sys.executable)
+     master_ninja.rule(
+       'lipo',
+       description='LIPO $out, POSTBUILDS',
+@@ -2224,24 +2224,24 @@ def GenerateOutputForConfig(target_list, target_dicts, data, params,
+     master_ninja.rule(
+       'copy_infoplist',
+       description='COPY INFOPLIST $in',
+-      command='$env ./gyp-mac-tool copy-info-plist $in $out $binary $keys')
++      command='$env %s gyp-mac-tool copy-info-plist $in $out $binary $keys' % sys.executable)
+     master_ninja.rule(
+       'merge_infoplist',
+       description='MERGE INFOPLISTS $in',
+-      command='$env ./gyp-mac-tool merge-info-plist $out $in')
++      command='$env %s gyp-mac-tool merge-info-plist $out $in' % sys.executable)
+     master_ninja.rule(
+       'compile_xcassets',
+       description='COMPILE XCASSETS $in',
+-      command='$env ./gyp-mac-tool compile-xcassets $keys $in')
++      command='$env %s gyp-mac-tool compile-xcassets $keys $in' % sys.executable)
+     master_ninja.rule(
+       'mac_tool',
+       description='MACTOOL $mactool_cmd $in',
+-      command='$env ./gyp-mac-tool $mactool_cmd $in $out $binary')
++      command='$env %s gyp-mac-tool $mactool_cmd $in $out $binary' % sys.executable)
+     master_ninja.rule(
+       'package_framework',
+       description='PACKAGE FRAMEWORK $out, POSTBUILDS',
+-      command='./gyp-mac-tool package-framework $out $version$postbuilds '
+-              '&& touch $out')
++      command='%s gyp-mac-tool package-framework $out $version$postbuilds '
++              '&& touch $out' % sys.executable)
+   if flavor == 'win':
+     master_ninja.rule(
+       'stamp',
+diff --git a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+index 6017164990..9b25666983 100644
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+@@ -1005,7 +1005,8 @@ class XcodeSettings(object):
+       print('Warning: Some codesign keys not implemented, ignoring: %s' % (
+           ', '.join(sorted(unimpl))))
+ 
+-    return ['%s code-sign-bundle "%s" "%s" "%s" "%s"' % (
++    return ['%s %s code-sign-bundle "%s" "%s" "%s" "%s"' % (
++        sys.executable,
+         os.path.join('${TARGET_BUILD_DIR}', 'gyp-mac-tool'), key,
+         settings.get('CODE_SIGN_RESOURCE_RULES_PATH', ''),
+         settings.get('CODE_SIGN_ENTITLEMENTS', ''),
+diff --git a/tools/gyp/pylib/gyp/generator/make.py b/tools/gyp/pylib/gyp/generator/make.py
+index d163ae3135..9be9c50045 100644
+--- a/tools/gyp/pylib/gyp/generator/make.py
++++ b/tools/gyp/pylib/gyp/generator/make.py
+@@ -26,6 +26,7 @@ from __future__ import print_function
+ import os
+ import re
+ import subprocess
++import sys
+ import gyp
+ import gyp.common
+ import gyp.xcode_emulation
+@@ -180,7 +181,7 @@ cmd_solink_module = $(LINK.$(TOOLSET)) -o $@ -shared $(GYP_LDFLAGS) $(LDFLAGS.$(
+ 
+ LINK_COMMANDS_MAC = """\
+ quiet_cmd_alink = LIBTOOL-STATIC $@
+-cmd_alink = rm -f $@ && ./gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %.o,$^)
++cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
+ 
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+ cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o "$@" $(LD_INPUTS) $(LIBS)
+@@ -190,7 +191,7 @@ cmd_solink = $(LINK.$(TOOLSET)) -shared $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o
+ 
+ quiet_cmd_solink_module = SOLINK_MODULE($(TOOLSET)) $@
+ cmd_solink_module = $(LINK.$(TOOLSET)) -bundle $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ $(filter-out FORCE_DO_CMD, $^) $(LIBS)
+-"""  # noqa: E501
++""" % {'python': sys.executable}  # noqa: E501
+ 
+ LINK_COMMANDS_ANDROID = """\
+ quiet_cmd_alink = AR($(TOOLSET)) $@
+@@ -525,14 +526,14 @@ cmd_pch_mm = $(CC.$(TOOLSET)) $(GYP_PCH_OBJCXXFLAGS) $(DEPFLAGS) -c -o $@ $<
+ # Use $(4) for the command, since $(2) and $(3) are used as flag by do_cmd
+ # already.
+ quiet_cmd_mac_tool = MACTOOL $(4) $<
+-cmd_mac_tool = ./gyp-mac-tool $(4) $< "$@"
++cmd_mac_tool = %(python)s gyp-mac-tool $(4) $< "$@"
+ 
+ quiet_cmd_mac_package_framework = PACKAGE FRAMEWORK $@
+-cmd_mac_package_framework = ./gyp-mac-tool package-framework "$@" $(4)
++cmd_mac_package_framework = %(python)s gyp-mac-tool package-framework "$@" $(4)
+ 
+ quiet_cmd_infoplist = INFOPLIST $@
+ cmd_infoplist = $(CC.$(TOOLSET)) -E -P -Wno-trigraphs -x c $(INFOPLIST_DEFINES) "$<" -o "$@"
+-"""  # noqa: E501
++""" % {'python': sys.executable}  # noqa: E501
+ 
+ 
+ def WriteRootHeaderSuffixRules(writer):
+@@ -2297,7 +2298,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+         "LINK.host": GetEnvironFallback(("LINK_host", "LINK"), "$(CXX.host)"),
+     }
+     if flavor == "mac":
+-        flock_command = "./gyp-mac-tool flock"
++        flock_command = "%s gyp-mac-tool flock" % sys.executable
+         header_params.update(
+             {
+                 "flock": flock_command,
+@@ -2327,7 +2328,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+         header_params.update(
+             {
+                 "copy_archive_args": copy_archive_arguments,
+-                "flock": "./gyp-flock-tool flock",
++                "flock": "%s gyp-flock-tool flock" % sys.executable,
+                 "flock_index": 2
+             }
+         )
+@@ -2343,7 +2344,7 @@ def GenerateOutput(target_list, target_dicts, data, params):
+             {
+                 "copy_archive_args": copy_archive_arguments,
+                 "link_commands": LINK_COMMANDS_AIX,
+-                "flock": "./gyp-flock-tool flock",
++                "flock": "%s gyp-flock-tool flock" % sys.executable,
+                 "flock_index": 2,
+             }
+         )
+diff --git a/tools/gyp/pylib/gyp/generator/ninja.py b/tools/gyp/pylib/gyp/generator/ninja.py
+index e064bad7ed..e54aa9f993 100644
+--- a/tools/gyp/pylib/gyp/generator/ninja.py
++++ b/tools/gyp/pylib/gyp/generator/ninja.py
+@@ -2600,9 +2600,9 @@ def GenerateOutputForConfig(target_list, target_dicts, data, params, config_name
+             "alink",
+             description="LIBTOOL-STATIC $out, POSTBUILDS",
+             command="rm -f $out && "
+-            "./gyp-mac-tool filter-libtool libtool $libtool_flags "
++            "%s gyp-mac-tool filter-libtool libtool $libtool_flags "
+             "-static -o $out $in"
+-            "$postbuilds",
++            "$postbuilds" % sys.executable,
+         )
+         master_ninja.rule(
+             "lipo",
+@@ -2703,41 +2703,44 @@ def GenerateOutputForConfig(target_list, target_dicts, data, params, config_name
+         master_ninja.rule(
+             "copy_infoplist",
+             description="COPY INFOPLIST $in",
+-            command="$env ./gyp-mac-tool copy-info-plist $in $out $binary $keys",
++            command="$env %s gyp-mac-tool copy-info-plist $in $out $binary $keys"
++            % sys.executable,
+         )
+         master_ninja.rule(
+             "merge_infoplist",
+             description="MERGE INFOPLISTS $in",
+-            command="$env ./gyp-mac-tool merge-info-plist $out $in",
++            command="$env %s gyp-mac-tool merge-info-plist $out $in" % sys.executable,
+         )
+         master_ninja.rule(
+             "compile_xcassets",
+             description="COMPILE XCASSETS $in",
+-            command="$env ./gyp-mac-tool compile-xcassets $keys $in",
++            command="$env %s gyp-mac-tool compile-xcassets $keys $in" % sys.executable,
+         )
+         master_ninja.rule(
+             "compile_ios_framework_headers",
+             description="COMPILE HEADER MAPS AND COPY FRAMEWORK HEADERS $in",
+-            command="$env ./gyp-mac-tool compile-ios-framework-header-map $out "
+-            "$framework $in && $env ./gyp-mac-tool "
+-            "copy-ios-framework-headers $framework $copy_headers",
++            command="$env %(python)s gyp-mac-tool compile-ios-framework-header-map "
++            "$out $framework $in && $env %(python)s gyp-mac-tool "
++            "copy-ios-framework-headers $framework $copy_headers"
++            % {'python': sys.executable},
+         )
+         master_ninja.rule(
+             "mac_tool",
+             description="MACTOOL $mactool_cmd $in",
+-            command="$env ./gyp-mac-tool $mactool_cmd $in $out $binary",
++            command="$env %s gyp-mac-tool $mactool_cmd $in $out $binary"
++            % sys.executable,
+         )
+         master_ninja.rule(
+             "package_framework",
+             description="PACKAGE FRAMEWORK $out, POSTBUILDS",
+-            command="./gyp-mac-tool package-framework $out $version$postbuilds "
+-            "&& touch $out",
++            command="%s gyp-mac-tool package-framework $out $version$postbuilds "
++            "&& touch $out" % sys.executable,
+         )
+         master_ninja.rule(
+             "package_ios_framework",
+             description="PACKAGE IOS FRAMEWORK $out, POSTBUILDS",
+-            command="./gyp-mac-tool package-ios-framework $out $postbuilds "
+-            "&& touch $out",
++            command="%s gyp-mac-tool package-ios-framework $out $postbuilds "
++            "&& touch $out" % sys.executable,
+         )
+     if flavor == "win":
+         master_ninja.rule(
+diff --git a/tools/gyp/pylib/gyp/xcode_emulation.py b/tools/gyp/pylib/gyp/xcode_emulation.py
+index a79aaa41fb..59ef7312b6 100644
+--- a/tools/gyp/pylib/gyp/xcode_emulation.py
++++ b/tools/gyp/pylib/gyp/xcode_emulation.py
+@@ -1175,8 +1175,9 @@ class XcodeSettings(object):
+                 # Then re-sign everything with 'preserve=True'
+                 postbuilds.extend(
+                     [
+-                        '%s code-sign-bundle "%s" "%s" "%s" "%s" %s'
++                        '%s %s code-sign-bundle "%s" "%s" "%s" "%s" %s'
+                         % (
++                            sys.executable,
+                             os.path.join("${TARGET_BUILD_DIR}", "gyp-mac-tool"),
+                             key,
+                             settings.get("CODE_SIGN_ENTITLEMENTS", ""),
+@@ -1191,8 +1192,9 @@ class XcodeSettings(object):
+             for target in targets:
+                 postbuilds.extend(
+                     [
+-                        '%s code-sign-bundle "%s" "%s" "%s" "%s" %s'
++                        '%s %s code-sign-bundle "%s" "%s" "%s" "%s" %s'
+                         % (
++                            sys.executable,
+                             os.path.join("${TARGET_BUILD_DIR}", "gyp-mac-tool"),
+                             key,
+                             settings.get("CODE_SIGN_ENTITLEMENTS", ""),
+@@ -1205,8 +1207,9 @@ class XcodeSettings(object):
+ 
+         postbuilds.extend(
+             [
+-                '%s code-sign-bundle "%s" "%s" "%s" "%s" %s'
++                '%s %s code-sign-bundle "%s" "%s" "%s" "%s" %s'
+                 % (
++                    sys.executable,
+                     os.path.join("${TARGET_BUILD_DIR}", "gyp-mac-tool"),
+                     key,
+                     settings.get("CODE_SIGN_ENTITLEMENTS", ""),
diff --git a/nix/iosevka.nix b/nix/iosevka.nix
index c7991f8..028813c 100644
--- a/nix/iosevka.nix
+++ b/nix/iosevka.nix
@@ -8,7 +8,10 @@ in
     pname = "IosevkaAjaxbits";
     version = "27.3.5";
 
-    nodejs = pkgs.nodejs_20;
+    nodejs = pkgs.nodejs_20.overrideAttrs (old: {
+      patches = old.patches ++ [./gyp-darwin-sandbox-fix.patch];
+    });
+
     src = pkgs.fetchFromGitHub {
       owner = "be5invis";
       repo = "iosevka";