diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh
index 704150e77d7..946897b1c43 100644
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@@ -141,6 +141,11 @@ if [ -n "@useHostResolvConf@" -a -e /etc/resolv.conf ]; then
     cat /etc/resolv.conf | resolvconf -m 1000 -a host
 fi
 
+# Create /var/permissions-wrappers as a tmpfs.
+rm -rf /var/permissions-wrappers
+mkdir -m 0755 -p /var/permissions-wrappers
+mount -t tmpfs -o "mode=0755" tmpfs /var/permissions-wrappers
+
 # Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
 # Only at this point are all the necessary prerequisites ready for these commands.
 exec {logOutFd}>&1 {logErrFd}>&2