{ lib, pkgs, ... }:
let
  # ./cpucap.sh goes into the store verbatim rather than through readFile or a
  # generated wrapper script, because `cpucap --help` sed's the comment header
  # back out of "$0" - only an unaltered copy of the file keeps that working.
  cpucap = pkgs.runCommandLocal "cpucap" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
    install -Dm755 ${./cpucap.sh} $out/bin/cpucap
    # Only line 1 changes, so the comment header --help prints stays put.
    patchShebangs $out/bin/cpucap
    wrapProgram $out/bin/cpucap \
      --prefix PATH : ${
        lib.makeBinPath [
          pkgs.gawk
          pkgs.gnused
        ]
      } \
      --set CPUCAP_SELF $out/bin/cpucap
  '';
in
{
  # PATH is prefixed, not set: the script re-execs itself through
  # /run/wrappers/bin/sudo for the writing subcommands, and sudo's own env
  # handling plus the inherited system PATH have to survive that round trip.
  home.packages = [ cpucap ];
}