diff --git a/pkgs/additional/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
index b19b2f57..2ca84695 100644
--- a/pkgs/additional/sane-scripts/default.nix
+++ b/pkgs/additional/sane-scripts/default.nix
@@ -281,6 +281,11 @@ let
       src = ./src;
       pkgs = [ "rsync" "sane-scripts.mount-servo" ];
     };
+    vpn-down = static-nix-shell.mkBash {
+      pname = "sane-vpn-down";
+      src = ./src;
+      pkgs = [ "coreutils-full" "gnugrep" "gnused" "sane-scripts.ip-check" "systemd" ];
+    };
   };
 in
 symlinkJoin {
diff --git a/pkgs/additional/sane-scripts/src/sane-vpn-down b/pkgs/additional/sane-scripts/src/sane-vpn-down
index dd2f859b..d906aff0 100755
--- a/pkgs/additional/sane-scripts/src/sane-vpn-down
+++ b/pkgs/additional/sane-scripts/src/sane-vpn-down
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils-full -p gnugrep -p gnused -p sane-scripts.ip-check -p systemd
 
 # first arg should be the region, e.g. `us` or `ukr`