diff --git a/system/lxc.nix b/system/lxc.nix
index 6597c71..4cc9feb 100644
--- a/system/lxc.nix
+++ b/system/lxc.nix
@@ -51,7 +51,7 @@
   # labmates get dropped into their container
   services.openssh.extraConfig = ''
     Match Group labmates
-      ForceCommand /usr/local/bin/lxc-login
+      ForceCommand /run/current-system/sw/bin/lxc-login
       AllowTcpForwarding no
       X11Forwarding no
   '';
@@ -65,6 +65,7 @@
     gnupg
     debootstrap
     bridge-utils
+    (writeShellScriptBin "lxc-login" (builtins.readFile ../home/scripts/lxc/lxc-login.sh))
   ];
 
   environment.etc."lxc/default.conf".text = ''