diff --git a/modules/programs/make-sandboxed.nix b/modules/programs/make-sandboxed.nix
index 8649eb2b5..f9ccfbd13 100644
--- a/modules/programs/make-sandboxed.nix
+++ b/modules/programs/make-sandboxed.nix
@@ -500,12 +500,16 @@ let
       '';
     };
     packageWrapped = sandboxedBy."${wrapperType}";
-  in
-    fixupMetaAndPassthru pkgName packageWrapped (passthru // {
+    packageWithMeta = fixupMetaAndPassthru pkgName packageWrapped (passthru // {
       # allow the user to build this package, but sandboxed in a different manner.
       # e.g. `<pkg>.sandboxedBy.inplace`.
       # e.g. `<pkg>.sandboxedBy.wrappedDerivation.sandboxedNonBin`
       inherit sandboxedBy;
-    })
+    });
+  in if package.outputSpecified or false then
+    # packages like `dig` are actually aliases to `bind.dnsutils`, so preserve that
+    packageWithMeta."${package.outputName}"
+  else
+    packageWithMeta
   ;
 in make-sandboxed