diff --git a/modules/programs/bash/bash.nix b/modules/programs/bash/bash.nix
index 31a14663aa0..626ed722536 100644
--- a/modules/programs/bash/bash.nix
+++ b/modules/programs/bash/bash.nix
@@ -56,7 +56,8 @@ in
       # Create the required /bin/sh symlink; otherwise lots of things
       # (notably the system() function) won't work.
       mkdir -m 0755 -p /bin
-      ln -sfn ${config.system.build.binsh}/bin/sh /bin/sh
+      ln -sfn ${config.system.build.binsh}/bin/sh /bin/.sh.tmp
+      mv /bin/.sh.tmp /bin/sh # atomically replace /bin/sh
     '';
 
 }