`shellHook` runs twice for `nom develop`

parts of it run twice immediately upon entering the shell, like the cp command below. I know this because the second attempt at copying from the flake below fails with "permission denied" (because the file is not writable, since it comes from the nix store). i know this is ugly (copying files from the store to the home directory, it's just for illustration purposes).

{
  description = "hey";

  inputs = {
    nixpkgs.url = github:nixos/nixpkgs/nixpkgs-unstable;
    flake-utils.url = github:numtide/flake-utils;
  };

  outputs = { self, nixpkgs, flake-utils, ... }:
    flake-utils.lib.eachSystem [ "aarch64-darwin" ] (system:
      let
        pkgs = import nixpkgs { inherit system; };
      in
      {
        devShell = pkgs.mkShell {
          src = [ ./. ];
          packages = [ pkgs.hello ];
          shellHook = ''
            cp ${hello}/bin/hello .
            whoami
          '';
        };
      });
}

the output is

nom develop
warning: Git tree '/Users/deco/work/banksy' is dirty
copying path '/nix/store/566f5isbvw014h7knmzmxa5l6hshx43k-hello-2.12.1' from 'https://cache.nixos.org'
nix-shell-env> building '/nix/store/ipdk9liiaglzgjarf06bzrmc5fhpf15a-nix-shell-env.drv'

warning: Git tree '/Users/deco/work/' is dirty
cp: cannot create regular file './hello': Permission denied
deco
(nix:nix-shell-env) H2TYHFDQD7: deco$ # press Ctrl-D
exit
deco

nix develop works as expected.