Disallow them by default, but make it configurable.
They either belong in a nix shell or are taken care of by other configurations.