diff --git a/bob/nix-builder/nix_builder.go b/bob/nix-builder/nix_builder.go
index 3f52222b..710bf592 100644
--- a/bob/nix-builder/nix_builder.go
+++ b/bob/nix-builder/nix_builder.go
@@ -2,11 +2,11 @@ package nixbuilder
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/benchkram/bob/pkg/boblog"
 	"github.com/benchkram/bob/pkg/envutil"
 	"github.com/benchkram/bob/pkg/file"
+	"github.com/benchkram/bob/pkg/filehash"
 	"github.com/benchkram/errz"
 
 	"github.com/benchkram/bob/bob/bobfile"
@@ -101,9 +101,9 @@ func (n *NB) BuildNixDependencies(ag *bobfile.Bobfile, buildTasksInPipeline, run
 		nixShellEnv, err := nix.NixShell(ag.Shell)
 		errz.Fatal(err)
 
-		f, err := os.ReadFile(ag.Shell)
+		hash, err := filehash.Hash(ag.Shell)
 		errz.Fatal(err)
-		hash := envutil.Hash(string(f))
+
 		n.envStore[envutil.Hash(hash)] = nixShellEnv
 		for _, name := range buildTasksInPipeline {
 			t := ag.BTasks[name]
diff --git a/pkg/nix/nix.go b/pkg/nix/nix.go
index 6565a852..042859bf 100644
--- a/pkg/nix/nix.go
+++ b/pkg/nix/nix.go
@@ -349,13 +349,13 @@ func NixShell(path string) ([]string, error) {
 	args = append(args, []string{"--pure", "--command", "env"}...)
 	args = append(args, path)
 	cmd := exec.Command("nix-shell", args...)
+	boblog.Log.V(5).Info(fmt.Sprintf("Executing command:\n  %s", cmd.String()))
 
 	var out bytes.Buffer
 	var errBuf bytes.Buffer
 	cmd.Stdout = &out
 	cmd.Stderr = &errBuf
 
-	env := strings.Split(out.String(), "\n")
 	err := cmd.Run()
 	if err != nil {
 		return nil, prepareRunError(err, cmd.String(), errBuf)
@@ -363,7 +363,7 @@ func NixShell(path string) ([]string, error) {
 
 	// if NIX_SSL_CERT_FILE && SSL_CERT_FILE are set to /no-cert-file.crt unset them
 	var clearedEnv []string
-	for _, e := range env {
+	for _, e := range strings.Split(out.String(), "\n") {
 		pair := strings.SplitN(e, "=", 2)
 		if pair[0] == "NIX_SSL_CERT_FILE" && pair[1] == "/no-cert-file.crt" {
 			continue