Apple introduced a new security feature called Local Network Privacy in macOS 15 Sequoia that blocks apps from accessing the local network by default until the user manually allows them. The limit applies to both prebuilt binaries and anything built locally.

This is particularly annoying with Nix, since it’s very easy to end up with many custom binaries and launchd agents, and macOS doesn’t show the “allow LAN access” dialog for them. Furthermore, every time the derivation changes, the custom binaries end up in a different path that needs to be allowlisted again. Fortunately, we can overcome this limitation with a simple proxy script.