In reply to @ma27:nicht-so.sexy
the queue runner can write build products to a different store that can be configured with store_uri in hydra.conf.

i've applied the following patch:

diff --git a/src/hydra-eval-jobs/hydra-eval-jobs.cc b/src/hydra-eval-jobs/hydra-eval-jobs.cc
index 30ab9740..ffb8c748 100644
--- a/src/hydra-eval-jobs/hydra-eval-jobs.cc
+++ b/src/hydra-eval-jobs/hydra-eval-jobs.cc
@@ -310,10 +310,6 @@ int main(int argc, char * * argv)
         /* FIXME: The build hook in conjunction with import-from-derivation is causing "unexpected EOF" during eval */
         settings.builders = "";
 
-        /* Prevent access to paths outside of the Nix search path and
-           to the environment. */
-        evalSettings.restrictEval = true;
-
         /* When building a flake, use pure evaluation (no access to
            'getEnv', 'currentSystem' etc. */
         evalSettings.pureEval = pureEval;

however, for some reason my repo is still being evaluated in restricted mode. I've tried removing the eval cache, but nothing helped, I'm still getting the error access to canonical path '...' is forbidden in restricted mode. What could be the reason behind this?