diff --git a/artiq-fast/windows/win.nix b/artiq-fast/windows/win.nix
index 0cfc0fc..6d57a29 100644
--- a/artiq-fast/windows/win.nix
+++ b/artiq-fast/windows/win.nix
@@ -14,8 +14,15 @@ let
   qemu = pkgs.qemu_test;
   libguestfs = pkgs.libguestfs-with-appliance;
 
+  # p7zip on >20.03 has known vulns but we have no better option
+  p7zip = pkgs.p7zip.overrideAttrs(old: {
+    meta = old.meta // {
+      knownVulnerabilities = [];
+    };
+  });
+
   runQemuCommand = name: command: (
-    pkgs.runCommandNoCC name { buildInputs = [ pkgs.p7zip qemu libguestfs ]; }
+    pkgs.runCommandNoCC name { buildInputs = [ p7zip qemu libguestfs ]; }
       (
         ''
           if ! test -f; then
@@ -142,8 +149,8 @@ let
     in
       ''
         #!${pkgs.runtimeShell}
-        set -exuo pipefail
-        export PATH=${lib.makeBinPath [ pkgs.p7zip qemu libguestfs ]}:$PATH
+        set -euxo pipefail
+        export PATH=${lib.makeBinPath [ p7zip qemu libguestfs ]}:$PATH
 
         # Create a bootable "USB" image
         # Booting in USB mode circumvents the "press any key to boot from cdrom" prompt