diff --git a/nix/eif.nix b/nix/eif.nix
index b1c1e64..55c84cf 100644
--- a/nix/eif.nix
+++ b/nix/eif.nix
@@ -150,7 +150,9 @@ stdenvNoCC.mkDerivation {
     # people compare artifacts by hashing them, and because it lets
     # `nix build --rebuild` be a check that passes rather than a known
     # exception.
-    faketime -f '@1970-01-01 00:00:01' \
+    # No `@`: with one, faketime starts the clock there and lets it run, and the nanoseconds it
+    # had run for by the time eif_build read it still differed between builds.
+    faketime -f '1970-01-01 00:00:01' \
     eif_build \
       --kernel ${kernel}/bzImage \
       --kernel_config ${kernel}/bzImage.config \
diff --git a/nix/kernel-zfs.nix b/nix/kernel-zfs.nix
index b49f909..2845a8e 100644
--- a/nix/kernel-zfs.nix
+++ b/nix/kernel-zfs.nix
@@ -78,7 +78,15 @@ let
     extraMakeFlags = [ "KBUILD_BUILD_USER=nixbuild" "KBUILD_BUILD_HOST=nixbuilder" ];
   };
 
-  zfsKmod = (linuxPackagesFor kernel).${zfs.kernelModuleAttribute};
+  # ZFS's assertions carry __FILE__, so its modules record where they were compiled: /build/source
+  # in a sandboxed Nix, a temporary directory in one without a sandbox. The image held them, and
+  # the same commit measured to two PCR0s. Mapped to the sandbox's path, every builder produces
+  # the modules a sandboxed one always did.
+  zfsKmod = ((linuxPackagesFor kernel).${zfs.kernelModuleAttribute}).overrideAttrs (old: {
+    preBuild = (old.preBuild or "") + ''
+      export KCFLAGS="''${KCFLAGS:-} -ffile-prefix-map=$NIX_BUILD_TOP=/build"
+    '';
+  });
 in
 assert zfsKmod.version == zfs.version;
 {