Knew you'd get comments asking why nix is important to the setup. I like it for things like this as well.

Shell scripting by default has terrible isolation. But the way Nix puts shell scripts together, you can be confident that a script's own PATH only contains what it needs to, which is a nice guarantee to have.