diff --git a/WORKSPACE b/WORKSPACE
index b2fb63566..f37ab6cf9 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -151,9 +151,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
     name = "rules_sh",
-    sha256 = "2613156e96b41fe0f91ac86a65edaea7da910b7130f2392ca02e8270f674a734",
-    strip_prefix = "rules_sh-0.1.0",
-    urls = ["https://github.com/tweag/rules_sh/archive/v0.1.0.tar.gz"],
+    sha256 = "83a065ba6469135a35786eb741e17d50f360ca92ab2897857475ab17c0d29931",
+    strip_prefix = "rules_sh-0.2.0",
+    urls = ["https://github.com/tweag/rules_sh/archive/v0.2.0.tar.gz"],
 )
 
 load("@rules_sh//sh:repositories.bzl", "rules_sh_dependencies")
diff --git a/nixpkgs/nixpkgs.bzl b/nixpkgs/nixpkgs.bzl
index a1e6fafe5..2c3d004fe 100644
--- a/nixpkgs/nixpkgs.bzl
+++ b/nixpkgs/nixpkgs.bzl
@@ -504,7 +504,7 @@ runCommand "bazel-nixpkgs-posix-toolchain"
     def create_posix_toolchain():
         sh_posix_toolchain(
             name = "nixpkgs_sh_posix",
-            **{{
+            cmds = {{
                 cmd: discovered[cmd]
                 for cmd in posix.commands
                 if cmd in discovered