diff --git a/debian/changelog b/debian/changelog
index 6b411fa..055035b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,8 @@ propellor (2.7.0) UNRELEASED; urgency=medium
   * Ssh.permitRootLogin type changed to allow configuring WithoutPassword
     and ForcedCommandsOnly (API change)
   * setSshdConfig type changed, and setSshdConfigBool added with old type.
+  * Fix a bug in shim generation code for docker and chroots, that
+    sometimes prevented deployment of docker containers.
 
  -- Joey Hess <id@joeyh.name>  Mon, 20 Jul 2015 12:01:38 -0400
 
diff --git a/src/Propellor/Shim.hs b/src/Propellor/Shim.hs
index ecf9f36..7cdecef 100644
--- a/src/Propellor/Shim.hs
+++ b/src/Propellor/Shim.hs
@@ -20,7 +20,7 @@ import System.Posix.Files
 -- Propellor may be running from an existing shim, in which case it's
 -- simply reused.
 setup :: FilePath -> Maybe FilePath -> FilePath -> IO FilePath
-setup propellorbin propellorbinpath dest = checkAlreadyShimmed propellorbin $ do
+setup propellorbin propellorbinpath dest = checkAlreadyShimmed shim $ do
 	createDirectoryIfMissing True dest
 
 	libs <- parseLdd <$> readProcess "ldd" [propellorbin]
@@ -39,7 +39,6 @@ setup propellorbin propellorbinpath dest = checkAlreadyShimmed propellorbin $ do
 		fromMaybe (error "cannot find gconv directory") $
 			headMaybe $ filter ("/gconv/" `isInfixOf`) glibclibs
 	let linkerparams = ["--library-path", intercalate ":" libdirs ]
-	let shim = file propellorbin dest
 	writeFile shim $ unlines
 		[ shebang
 		, "GCONV_PATH=" ++ shellEscape gconvdir
@@ -49,6 +48,8 @@ setup propellorbin propellorbinpath dest = checkAlreadyShimmed propellorbin $ do
 		]
 	modifyFileMode shim (addModes executeModes)
 	return shim
+  where
+	shim = file propellorbin dest
 
 shebang :: String
 shebang = "#!/bin/sh"