--- a/tests/libtest.sh
+++ b/tests/libtest.sh
@@ -322,7 +322,7 @@
         # running installed-tests: assume we know what we're doing
         :
     elif ! "$FLATPAK_BWRAP" --unshare-ipc --unshare-net --unshare-pid \
-            --ro-bind / / /bin/true > bwrap-result 2>&1; then
+            --ro-bind / / @coreutils@/bin/true > bwrap-result 2>&1; then
         sed -e 's/^/# /' < bwrap-result
         echo "1..0 # SKIP Cannot run bwrap"
         exit 0
@@ -330,7 +330,7 @@
 }
 
 skip_without_python2 () {
-    if ! test -f /usr/bin/python2 || ! /usr/bin/python2 -c "import sys; sys.exit(0 if sys.version_info >= (2, 7) else 1)" ; then
+    if ! test -f @python2@/bin/python2 || ! @python2@/bin/python2 -c "import sys; sys.exit(0 if sys.version_info >= (2, 7) else 1)" ; then
         echo "1..0 # SKIP this test requires /usr/bin/python2 (2.7) support"
         exit 0
     fi
@@ -350,12 +350,12 @@
 export DBUS_SESSION_BUS_ADDRESS="$(cat dbus-session-bus-address)"
 DBUS_SESSION_BUS_PID="$(cat dbus-session-bus-pid)"
 
-if ! /bin/kill -0 "$DBUS_SESSION_BUS_PID"; then
+if ! @coreutils@/bin/kill -0 "$DBUS_SESSION_BUS_PID"; then
     assert_not_reached "Failed to start dbus-daemon"
 fi
 
 cleanup () {
-    /bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
+    @coreutils@/bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
     gpg-connect-agent --homedir "${FL_GPG_HOMEDIR}" killagent /bye || true
     fusermount -u $XDG_RUNTIME_DIR/doc || :
     if test -n "${TEST_SKIP_CLEANUP:-}"; then
--- a/tests/make-test-runtime.sh
+++ b/tests/make-test-runtime.sh
@@ -21,6 +21,7 @@
 cat ${DIR}/metadata
 
 # Add bash and dependencies
+mkdir -p ${DIR}/nix/store
 mkdir -p ${DIR}/usr/bin
 mkdir -p ${DIR}/usr/lib
 ln -s ../lib ${DIR}/usr/lib64
@@ -30,47 +31,27 @@
 else
     cp `which ldconfig` ${DIR}/usr/bin
 fi
-T=`mktemp`
-for i in $@; do
-    I=`which $i`
-    cp $I ${DIR}/usr/bin
-    ldd $I | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | grep ^/ >> $T
-    if test $i == python2; then
-        mkdir -p ${DIR}/usr/lib/python2.7/lib-dynload
-        # This is a hardcoded minimal set of modules we need in the current tests.
-        # Pretty hacky stuff. Add modules as needed.
-        PYDIR=/usr/lib/python2.7
-        if test -d /usr/lib64/python2.7; then PYDIR=/usr/lib64/python2.7; fi
-        for py in site os stat posixpath genericpath warnings \
-                       linecache types UserDict abc _abcoll \
-                       _weakrefset copy_reg traceback sysconfig \
-                       re sre_compile sre_parse sre_constants \
-                       _sysconfigdata ; do
-            cp ${PYDIR}/$py.py ${DIR}/usr/lib/python2.7
-        done
-        # These might not exist, depending how Python was configured; and the
-        # part after ${so} might be "module" or ".x86_64-linux-gnu" or
-        # something else
-        for so in _locale strop ; do
-            cp ${PYDIR}/lib-dynload/${so}*.so ${DIR}/usr/lib/python2.7/lib-dynload || :
-        done
-        for plat in $( cd ${PYDIR} && echo plat-* ); do
-            test -e ${PYDIR}/${plat} || continue
-            mkdir -p ${DIR}/usr/lib/python2.7/${plat}
-            cp ${PYDIR}/${plat}/*.py ${DIR}/usr/lib/python2.7/${plat}/
-        done
-    fi
-done
 ln -s bash ${DIR}/usr/bin/sh
-for i in `sort -u $T`; do
-    cp "$i" ${DIR}/usr/lib/
+for i in $@; do
+    I=$(readlink -f $(which $i))
+    requisites=$(nix-store --query --requisites "$I")
+    for r in $requisites; do
+        # a single store item can be needed by multiple paths, no need to copy it again
+        if [ ! -e ${DIR}/$r ]; then
+            cp -r $r ${DIR}/$r
+        fi
+    done
+    ln -s $I ${DIR}/usr/bin/$i
 done
 
-# We copy the C.UTF8 locale and call it en_US. Its a bit of a lie, but
-# the real en_US locale is often not available, because its in the
-# local archive.
+mv ${DIR}/nix/store ${DIR}/usr/store # files outside /usr are not permitted, we will have to replace /nix/store with /usr/store
+chmod -R u+w ${DIR} # nix store has read-only directories which would cause problems during clean-up, files need to be writable for sed
+find ${DIR} -type f -print0 | xargs -0 sed -i 's~/nix/store/~/usr/store/~g' # replace hardcoded paths
+find ${DIR} -type l | xargs -I '{}' sh -c 'tg="$(readlink "$1")"; newtg="${tg#/nix/store/}"; if [ "$tg" != "$newtg" ]; then ln -fs "/usr/store/$newtg" "$1"; fi' -- '{}' # replace symlink targets
+
+# We copy the whole locale archive because we do not have C.UTF8 locale
 mkdir -p ${DIR}/usr/lib/locale/
-cp -r /usr/lib/locale/C.* ${DIR}/usr/lib/locale/en_US
+cp @glibcLocales@/lib/locale/locale-archive ${DIR}/usr/lib/locale/locale-archive
 
 if [ x$COLLECTION_ID != x ]; then
     collection_args=--collection-id=${COLLECTION_ID}
--- a/tests/testlibrary.c
+++ b/tests/testlibrary.c
@@ -378,7 +378,7 @@
     {
       gint exit_code = 0;
       char *argv[] = { (char *)bwrap, "--unshare-ipc", "--unshare-net",
-          "--unshare-pid", "--ro-bind", "/", "/", "/bin/true", NULL };
+          "--unshare-pid", "--ro-bind", "/", "/", "@coreutils@/bin/true", NULL };
       g_autofree char *argv_str = g_strjoinv (" ", argv);
       g_test_message ("Spawning %s", argv_str);
       g_spawn_sync (NULL, argv, NULL, G_SPAWN_SEARCH_PATH, NULL, NULL, NULL, NULL, &exit_code, &error);
--- a/triggers/gtk-icon-cache.trigger
+++ b/triggers/gtk-icon-cache.trigger
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 if test \( -x "$(which gtk-update-icon-cache 2>/dev/null)" \) -a \( -d $1/exports/share/icons/hicolor \); then
-    cp /usr/share/icons/hicolor/index.theme $1/exports/share/icons/hicolor/
+    cp @hicolorIconTheme@/share/icons/hicolor/index.theme $1/exports/share/icons/hicolor/
     for dir in $1/exports/share/icons/*; do
         if test -f $dir/index.theme; then
             if ! gtk-update-icon-cache --quiet $dir; then