diff --git a/hive-bash-mcp/src/runner.rs b/hive-bash-mcp/src/runner.rs
index bc816d6f..a4fd2719 100644
--- a/hive-bash-mcp/src/runner.rs
+++ b/hive-bash-mcp/src/runner.rs
@@ -405,7 +405,8 @@ async fn run_task(mut task: TaskFile, socket: &Path) {
 ///
 /// Tasks run under `bash`, not `sh`: on NixOS `/bin/sh` is bash in POSIX
 /// mode, which disables bashisms (arrays, `[[ … ]]`, `local`, process
-/// substitution, …). Agents write bash, so we invoke `bash` directly.
+/// substitution, …). Agents write bash, so we invoke `bash` (via
+/// `/usr/bin/env bash`).
 async fn exec_cmd(
     cmd: &str,
     out_path: &Path,
@@ -415,8 +416,13 @@ async fn exec_cmd(
     use tokio::process::Command;
     // SAFETY: `nice` is async-signal-safe and modifies only the calling
     // process's scheduling priority before exec. No allocations, no locks.
-    let mut cmd_builder = Command::new("bash");
+    // `/usr/bin/env bash` rather than a bare `bash`: `/usr/bin/env` is at a
+    // fixed absolute path (coreutils, present on NixOS), and it resolves
+    // `bash` via PATH — the same controlled PATH the daemon's systemd unit
+    // sets. Avoids hardcoding a nix store / generation path in the binary.
+    let mut cmd_builder = Command::new("/usr/bin/env");
     cmd_builder
+        .arg("bash")
         .arg("-c")
         .arg(cmd)
         .stdout(std::process::Stdio::piped())