diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 178fc7d9140..2b5c3817ddf 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,8 +14,16 @@ stdenv.mkDerivation rec {
     sha256 = "0d2p9g2wqcv6l3671gvw96p16jadbgyh21ddy2bhqgi96dq3qflx";
   };
 
+  # Disable 4 test cases that fail in a sandbox
+  patches = [ ./disable-failing-tests.patch ];
+
   postPatch = ''
     patchShebangs tests
+
+    # O_DIRECT is filesystem dependent and fails in a sandbox (on tmpfs)
+    # and on several filesystem types (btrfs, zfs) without sandboxing.
+    # Remove it, see discussion in #46151
+    substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
   NIX_LDFLAGS = "-lgcc_s";
@@ -30,6 +38,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ lvm2 json_c openssl libuuid popt ]
     ++ stdenv.lib.optional enablePython python2;
 
+  doCheck = true;
+
   meta = {
     homepage = https://gitlab.com/cryptsetup/cryptsetup/;
     description = "LUKS for dm-crypt";
diff --git a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
new file mode 100644
index 00000000000..1504bf3e151
--- /dev/null
+++ b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
@@ -0,0 +1,19 @@
+diff -ur a/tests/blockwise-compat b/tests/blockwise-compat
+--- a/tests/blockwise-compat	2018-09-08 12:23:11.706555098 +0200
++++ b/tests/blockwise-compat	2018-09-08 12:24:24.444393460 +0200
+@@ -148,15 +148,11 @@
+ 	# device/file fn_name length
+ 	RUN "P" $1 read_buffer $BSIZE
+ 	RUN "P" $1 read_buffer $((2*BSIZE))
+-	RUN "F" $1 read_buffer $((BSIZE-1))
+-	RUN "F" $1 read_buffer $((BSIZE+1))
+ 	RUN "P" $1 read_buffer 0
+ 
+ 	RUN "P" $1 write_buffer $BSIZE
+ 	RUN "P" $1 write_buffer $((2*BSIZE))
+ 
+-	RUN "F" $1 write_buffer $((BSIZE-1))
+-	RUN "F" $1 write_buffer $((BSIZE+1))
+ 	RUN "F" $1 write_buffer 0
+ 
+ 	# basic blockwise functions