diff --git a/nixos/tests/nextflow.nix b/nixos/tests/nextflow.nix
index 62ce7d3ea571..0839c2188bb4 100644
--- a/nixos/tests/nextflow.nix
+++ b/nixos/tests/nextflow.nix
@@ -1,5 +1,7 @@
 { pkgs, ... }:
 let
+  # This is the default image used by Nextflow if docker.enabled=true and no
+  # process.container is defined.
   bash = pkgs.dockerTools.pullImage {
     imageName = "quay.io/nextflow/bash";
     imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
@@ -21,13 +23,17 @@ let
   };
   run-nextflow-pipeline = pkgs.writeShellApplication {
     name = "run-nextflow-pipeline";
-    runtimeInputs = [ pkgs.nextflow ];
     text = ''
       export NXF_OFFLINE=true
-      for b in false true; do
-        echo "docker.enabled = $b" > nextflow.config
-        cat nextflow.config
-        nextflow run -ansi-log false ${hello}
+      for d in true false; do
+        for t in true false; do
+          rm -f nextflow.config; touch nextflow.config
+          echo "docker.enabled = $d" >> nextflow.config
+          echo "trace.enabled = $t" >> nextflow.config
+          echo "Testing docker=$d trace=$t"
+          nextflow run -ansi-log false ${hello}
+          echo "PASSED docker=$d trace=$t"
+        done
       done
     '';
   };
diff --git a/pkgs/by-name/ne/nextflow/package.nix b/pkgs/by-name/ne/nextflow/package.nix
index d3215d58f43b..948c0dd2f5e7 100644
--- a/pkgs/by-name/ne/nextflow/package.nix
+++ b/pkgs/by-name/ne/nextflow/package.nix
@@ -39,11 +39,21 @@ stdenv.mkDerivation (finalAttrs: {
     # several locations so we fix that globally. However, when running inside
     # a container, we actually *want* "/bin/bash". Thus the global fix needs
     # to be reverted for this specific use case.
+    #
+    # Two code paths need the revert:
+    #   1. launcher (the command that invokes .command.run)
+    #   2. trace_cmd (the command inside .command.run's nxf_trace function
+    #      that invokes .command.sh — see command-trace.txt template)
+    # Without the trace_cmd revert, trace+docker fails because the trace
+    # function tries to call /nix/store/.../bash inside the container.
+    # See https://github.com/NixOS/nixpkgs/issues/350183
     substituteInPlace modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy \
       --replace-fail "['/bin/bash'," "['${bash}/bin/bash'," \
       --replace-fail '? "/bin/bash"' '? "'${bash}'/bin/bash"' \
       --replace-fail "if( containerBuilder ) {" "if( containerBuilder ) {
-                launcher = launcher.replaceFirst(\"/nix/store/.*/bin/bash\", \"/bin/bash\")"
+                launcher = launcher.replaceFirst(\"/nix/store/.*/bin/bash\", \"/bin/bash\")" \
+      --replace-fail "binding.trace_cmd = getTraceCommand(interpreter)" \
+        "binding.trace_cmd = containerBuilder != null ? getTraceCommand(interpreter).replaceFirst(\"/nix/store/.*/bin/bash\", \"/bin/bash\") : getTraceCommand(interpreter)"
   '';
 
   mitmCache = gradle.fetchDeps {