diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index 7a6d82cd28eb..a6189da7ee3e 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -14,9 +14,10 @@
 , swig
 , gettext
 , fetchpatch
+, coreutils
 }:
 let
-  preConfigure = (import ./script.nix);
+  preConfigure = (import ./script.nix {inherit coreutils;});
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
diff --git a/pkgs/applications/networking/ids/zeek/script.nix b/pkgs/applications/networking/ids/zeek/script.nix
index 10a2d11a1489..4c8bbcf22c03 100644
--- a/pkgs/applications/networking/ids/zeek/script.nix
+++ b/pkgs/applications/networking/ids/zeek/script.nix
@@ -1,4 +1,10 @@
+{coreutils}:
 ''
+   sed -i 's|/bin/mv|${coreutils}/bin/mv|' scripts/base/frameworks/logging/writers/ascii.zeek
+   sed -i 's|/bin/mv|${coreutils}/bin/mv|' scripts/policy/misc/trim-trace-file.zeek
+   sed -i 's|/bin/cat|${coreutils}/bin/cat|' scripts/base/frameworks/notice/actions/pp-alarms.zeek
+   sed -i 's|/bin/cat|${coreutils}/bin/cat|' scripts/base/frameworks/notice/main.zeek
+
    sed -i "1i##! test dpd" $PWD/scripts/base/frameworks/dpd/__load__.zeek
    sed -i "1i##! test x509" $PWD/scripts/base/files/x509/__load__.zeek
    sed -i "1i##! test files-extract" $PWD/scripts/base/files/extract/__load__.zeek
@@ -32,6 +38,7 @@
    sed -i "1i##! test dns" $PWD/scripts/base/protocols/dns/__load__.zeek
    sed -i "1i##! test ftp" $PWD/scripts/base/protocols/ftp/__load__.zeek
    sed -i "1i##! test http" $PWD/scripts/base/protocols/http/__load__.zeek
+   sed -i "1i##! test tunnels" $PWD/scripts/base/protocols/tunnels/__load__.zeek
    sed -i "1i##! test imap" $PWD/scripts/base/protocols/imap/__load__.zeek
    sed -i "1i##! test irc" $PWD/scripts/base/protocols/irc/__load__.zeek
    sed -i "1i##! test krb" $PWD/scripts/base/protocols/krb/__load__.zeek