diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 0.3.6.2 - 2024-05-03
+
+### Fixed
+
+ - Remove most uses of `c_str()`, of which at least one exhibited undefined behavior.
+
 ## 0.3.6.1 - 2024-02-12
 
 ### Added
diff --git a/hercules-ci-cnix-expr.cabal b/hercules-ci-cnix-expr.cabal
--- a/hercules-ci-cnix-expr.cabal
+++ b/hercules-ci-cnix-expr.cabal
@@ -1,7 +1,7 @@
 cabal-version: 2.4
 
 name:           hercules-ci-cnix-expr
-version:        0.3.6.1
+version:        0.3.6.2
 synopsis:       Bindings for the Nix evaluator
 category:       Nix, CI, Testing, DevOps
 homepage:       https://docs.hercules-ci.com
diff --git a/src/Hercules/CNix/Expr.hs b/src/Hercules/CNix/Expr.hs
--- a/src/Hercules/CNix/Expr.hs
+++ b/src/Hercules/CNix/Expr.hs
@@ -133,6 +133,8 @@
 
 C.include "hercules-ci-cnix/expr.hxx"
 
+C.include "hercules-ci-cnix/string.hxx"
+
 C.include "<gc/gc.h>"
 
 C.include "<gc/gc_cpp.h>"
@@ -141,6 +143,8 @@
 
 C.using "namespace nix"
 
+C.using "namespace hercules_ci_cnix"
+
 C.verbatim "\nGC_API void GC_CALL GC_throw_bad_alloc() { throw std::bad_alloc(); }\n"
 
 init :: IO ()
@@ -464,10 +468,10 @@
         name <- unsafeMallocBS [C.block| const char *{
           EvalState &evalState = *$(EvalState *evalState);
           SymbolStr str = evalState.symbols[$(Attr *i)->name];
-          return strdup(static_cast<std::string>(str).c_str());
+          return stringdup(static_cast<std::string>(str));
         }|]
 #else
-        name <- unsafeMallocBS [C.exp| const char *{ strdup(static_cast<std::string>($(Attr *i)->name).c_str()) } |]
+        name <- unsafeMallocBS [C.exp| const char *{ stringdup(static_cast<std::string>($(Attr *i)->name)) } |]
 #endif
         value <- mkRawValue =<< [C.exp| Value *{ new (NoGC) Value(*$(Attr *i)->value) } |]
         let acc' = M.insert name value acc
@@ -587,7 +591,7 @@
 #if NIX_IS_AT_LEAST(2,19,0)
       r->mkPath(state.rootPath(CanonPath(s)));
 #else
-      r->mkPath(s.c_str());
+      r->mkPath(stringdup(s));
 #endif
       return r;
   }|]