diff --git a/modules/system/applications.nix b/modules/system/applications.nix
index 3cd60c6d..84be7ba3 100644
--- a/modules/system/applications.nix
+++ b/modules/system/applications.nix
@@ -38,12 +38,33 @@ in
         rm ~/Applications/'Nix Apps'
       fi
 
-      if [ ! -e '/Applications/Nix Apps' ] \
-         || ourLink '/Applications/Nix Apps'; then
-        ln -sfn ${cfg.build.applications}/Applications '/Applications/Nix Apps'
-      else
-        echo "warning: /Applications/Nix Apps is not owned by nix-darwin, skipping App linking..." >&2
+      targetFolder='/Applications/Nix Apps'
+
+      # Clean up old style symlink to nix store
+      if [ -e "$targetFolder" ] && ourLink "$targetFolder"; then
+        rm "$targetFolder"
       fi
+
+      mkdir -p "$targetFolder"
+
+      rsyncFlags=(
+        # mtime is standardized in the nix store, which would leave only file size to distinguish files.
+        # Thus we need checksums, despite the speed penalty.
+        --checksum
+        # Converts all symlinks pointing outside of the copied tree (thus unsafe) into real files and directories.
+        # This neatly converts all the symlinks pointing to application bundles in the nix store into
+        # real directories, without breaking any relative symlinks inside of application bundles.
+        # This is good enough, because the make-symlinks-relative.sh setup hook converts all $out internal
+        # symlinks to relative ones.
+        --copy-unsafe-links
+        --archive
+        --delete
+        --chmod=-w
+        --no-group
+        --no-owner
+      )
+
+      ${lib.getExe pkgs.rsync} "''${rsyncFlags[@]}" ${cfg.build.applications}/Applications/ "$targetFolder"
     '';
 
   };