diff --git a/pkgs/tools/filesystems/gocryptfs/default.nix b/pkgs/tools/filesystems/gocryptfs/default.nix
index 8cb9d58bc4ea..2211d0e3103e 100644
--- a/pkgs/tools/filesystems/gocryptfs/default.nix
+++ b/pkgs/tools/filesystems/gocryptfs/default.nix
@@ -51,9 +51,11 @@ buildGoModule rec {
     popd
   '';
 
+  # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
+  # as the setuid wrapper is required to use gocryptfs as non-root on NixOS
   postInstall = ''
     wrapProgram $out/bin/gocryptfs \
-      --prefix PATH : ${lib.makeBinPath [ fuse ]}
+      --suffix PATH : ${lib.makeBinPath [ fuse ]}
     ln -s $out/bin/gocryptfs $out/bin/mount.fuse.gocryptfs
   '';