diff --git a/nix/packages/openclaw-gateway.nix b/nix/packages/openclaw-gateway.nix
index 58b6edc9..bddc649a 100644
--- a/nix/packages/openclaw-gateway.nix
+++ b/nix/packages/openclaw-gateway.nix
@@ -83,6 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = "${../scripts/gateway-postpatch.sh}";
   buildPhase = "${../scripts/gateway-build.sh}";
   installPhase = "${../scripts/gateway-install.sh}";
+  dontFixup = true;
   dontStrip = true;
   dontPatchShebangs = true;
 
diff --git a/nix/scripts/gateway-install.sh b/nix/scripts/gateway-install.sh
index 3fce97d3..ee6dd139 100755
--- a/nix/scripts/gateway-install.sh
+++ b/nix/scripts/gateway-install.sh
@@ -17,9 +17,30 @@ log_step() {
   printf '>> [timing] %s: %ss\n' "$name" "$((end - start))" >&2
 }
 
+check_no_broken_symlinks() {
+  root="$1"
+  if [ ! -d "$root" ]; then
+    return 0
+  fi
+
+  broken_tmp="$(mktemp)"
+  # Portable and faster than `find ... -exec test -e {} \;` on large trees.
+  find "$root" -type l -print | while IFS= read -r link; do
+    [ -e "$link" ] || printf '%s\n' "$link"
+  done > "$broken_tmp"
+  if [ -s "$broken_tmp" ]; then
+    echo "dangling symlinks found under $root" >&2
+    cat "$broken_tmp" >&2
+    rm -f "$broken_tmp"
+    return 1
+  fi
+  rm -f "$broken_tmp"
+}
+
 mkdir -p "$out/lib/openclaw" "$out/bin"
 
-log_step "copy build outputs" cp -r dist node_modules package.json "$out/lib/openclaw/"
+# Build dir is ephemeral in Nix; moving avoids an expensive deep copy of node_modules.
+log_step "move build outputs" mv dist node_modules package.json "$out/lib/openclaw/"
 if [ -d extensions ]; then
   log_step "copy extensions" cp -r extensions "$out/lib/openclaw/"
 fi
@@ -94,4 +115,6 @@ if [ -n "$hasown_src" ]; then
   fi
 fi
 
+log_step "validate node_modules symlinks" check_no_broken_symlinks "$out/lib/openclaw/node_modules"
+
 bash -e -c '. "$STDENV_SETUP"; makeWrapper "$NODE_BIN" "$out/bin/openclaw" --add-flags "$out/lib/openclaw/dist/index.js" --set-default OPENCLAW_NIX_MODE "1"'