diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index aa0229793..d61210670 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -91,7 +91,7 @@ static StorePath copyInputToStore(
 {
     auto storePath = fetchToStore(*state.store, accessor, FetchMode::Copy, input.getName());
 
-    state.allowPath(storePath);
+    state.allowPath(storePath); // FIXME: should just whitelist the entire virtual store
 
     state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);