diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 617bbba5845..cf3d7b07a49 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -11,15 +11,13 @@ _separateDebugInfo() {
     dst="$dst/lib/debug/.build-id"
 
     # Find executables and dynamic libraries.
-    local -a files=($(find "$prefix" -type f -a \( -perm /0100 -o -name "*.so" -o -name "*.so.*" \)))
-
     local i magic
-    for i in "${files[@]}"; do
+    while IFS= read -r -d $'\0' i; do
         # Skip non-ELF files.
-        exec 10< "$i"
-        read -n 4 -u 10 magic
+        exec {fd}< "$i"
+        read -n 4 -u $fd magic
+        exec {fd}<&-
         if ! [[ "$magic" =~ ELF ]]; then continue; fi
-        exec 10<&-
 
         # Extract the Build ID. FIXME: there's probably a cleaner way.
         local id="$(readelf -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
@@ -36,7 +34,7 @@ _separateDebugInfo() {
 
         # Also a create a symlink <original-name>.debug.
         ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
-    done
+    done < <(find "$prefix" -type f -a \( -perm /0100 -o -name "*.so" -o -name "*.so.*" \) -print0)
 }
 
 # - We might prefer to compress the debug info during link-time already,