diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/3.x.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/3.x.nix
index 2ceaee5650b..e8266c2efe2 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/3.x.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/3.x.nix
@@ -1,12 +1,15 @@
-{ callPackage, fetchFromGitHub, ... } @ args:
+{ bash, callPackage, fetchFromGitHub, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "09smyrzp1xkczlmh8vqb7bmjb2b5d6yf9birjgaw36c6m44bpfvs";
+    sha256 = "0sr1rxl92d4wdipl66f1yymx5bmyj1y85v6k22v57rzr6yhyfmsf";
   };
-  version = "3.0.1";
+  version = "3.8.4";
   hasBootstrapScript = false;
+  postPatch = ''
+    substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
+  '';
 })
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
index 8aa02ac307d..ba0be89abf3 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
@@ -1,5 +1,5 @@
 { stdenv, buildGoPackage, makeWrapper, coreutils, git, openssh, bash, gnused, gnugrep
-, src, version, hasBootstrapScript
+, src, version, hasBootstrapScript, postPatch ? ""
 , ... }:
 let
   goPackagePath = "github.com/buildkite/agent";
@@ -7,14 +7,10 @@ in
 buildGoPackage {
   name = "buildkite-agent-${version}";
 
-  inherit goPackagePath src;
+  inherit goPackagePath src postPatch;
 
   nativeBuildInputs = [ makeWrapper ];
 
-  # on Linux, the TMPDIR is /build which is the same prefix as this package
-  # remove once #35068 is merged
-  noAuditTmpdir = stdenv.isLinux;
-
   postInstall = ''
     ${stdenv.lib.optionalString hasBootstrapScript ''
     # Install bootstrap.sh