{pkgs, ...}: let
  inherit
    (pkgs)
    lib
    makeWrapper
    rustPlatform
    fetchFromGitHub
    nix-update-script
    ;
in
  rustPlatform.buildRustPackage (finalAttrs: {
    pname = "bwsandbox";
    version = "0.5.6";
    __structuredAttrs = true;

    src = fetchFromGitHub {
      owner = "a-liashenko";
      repo = "bwsandbox";
      tag = "v${finalAttrs.version}";
      hash = "sha256-4jYWDiFnmr8y5v2smMQR9LEFNnbFTe+bO27s0v024Bc=";
    };

    cargoHash = "sha256-DfQELMOqHS0McQN4H+LnMeQScMh2OrqEd/IOVrZGJao=";

    nativeBuildInputs = [makeWrapper];
    buildInputs = with pkgs; [libseccomp];
    doCheck = false; # Upstream tests require env vars, external binaries, DBus, and network access.
    postFixup = ''
      wrapProgram $out/bin/bwsandbox \
        --prefix PATH : ${lib.makeBinPath [pkgs.xdg-dbus-proxy pkgs.bubblewrap]}
    '';
    passthru.updateScript = nix-update-script {};

    meta = {
      description = "Simple helper to run applications inside bwrap with batteries";
      homepage = "https://github.com/a-liashenko/bwsandbox";
      changelog = "https://github.com/a-liashenko/bwsandbox/releases/tag/${finalAttrs.src.tag}";
      license = lib.licenses.gpl3Only;
      # maintainers = with lib.maintainers; [];
      mainProgram = "bwsandbox";
    };
  })