treewide: move NIX_CFLAGS_COMPILE to the env attrset

with structuredAttrs lists will be bash arrays which cannot be exported
which will be a issue with some patches and some wrappers like cc-wrapper

this makes it clearer that NIX_CFLAGS_COMPILE must be a string as lists
in env cause a eval failure

130 files changed, 130 insertions, 130 deletions

diff --git a/pkgs/tools/X11/nx-libs/default.nix b/pkgs/tools/X11/nx-libs/default.nix
index bec99dd2d3909..b5aff9271639e 100644
--- a/pkgs/tools/X11/nx-libs/default.nix
+++ b/pkgs/tools/X11/nx-libs/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     xorg.xkbcomp xorg.xkeyboardconfig libtirpc
   ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-ltirpc" ];
 
   postPatch = ''
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index 13234a8149765..e9d6d42b06892 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [ gtk ];
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 2f793e3180880..72cb79388cfcd 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -156,7 +156,7 @@ in buildPythonApplication rec {
   ]);
 
   # error: 'import_cairo' defined but not used
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/admin/adtool/default.nix b/pkgs/tools/admin/adtool/default.nix
index ac009e1b091a3..62d6fa3803e33 100644
--- a/pkgs/tools/admin/adtool/default.nix
+++ b/pkgs/tools/admin/adtool/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ../../src/lib/libactive_directory.a(active_directory.o):/build/adtool-1.3.3/src/lib/active_directory.h:31:
   #     multiple definition of `system_config_file'; adtool.o:/build/adtool-1.3.3/src/tools/../../src/lib/active_directory.h:31: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 504170174170d..d48171b195863 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "out"}/bin"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=array-bounds"
   ];
 
diff --git a/pkgs/tools/archivers/7zz/default.nix b/pkgs/tools/archivers/7zz/default.nix
index 9685a3d75824d..2e1eb6b53bd08 100644
--- a/pkgs/tools/archivers/7zz/default.nix
+++ b/pkgs/tools/archivers/7zz/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
       --replace windres.exe ${stdenv.cc.targetPrefix}windres
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-Wno-deprecated-copy-dtor"
   ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
     "-Wno-conversion"
diff --git a/pkgs/tools/archivers/bomutils/default.nix b/pkgs/tools/archivers/bomutils/default.nix
index dc251a7249619..1b147d10ec284 100644
--- a/pkgs/tools/archivers/bomutils/default.nix
+++ b/pkgs/tools/archivers/bomutils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   # fix
   # src/lsbom.cpp:70:10: error: reference to 'data' is ambiguous
   # which refers to std::data from C++17
-  NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   meta = with lib; {
     homepage = "https://github.com/hogliux/bomutils";
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index b38a9aa185a08..43be673ca2c91 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   passthru.updateScript = ./update.sh;
 
diff --git a/pkgs/tools/audio/darkice/default.nix b/pkgs/tools/audio/darkice/default.nix
index 73c71ee6f1a15..2c9143d51f895 100644
--- a/pkgs/tools/audio/darkice/default.nix
+++ b/pkgs/tools/audio/darkice/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     libopus libvorbis libogg libpulseaudio alsa-lib libsamplerate libjack2 lame
   ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   configureFlags = [
     "--with-faac-prefix=${faac}"
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index fb9ef49c548e0..e15a048b991ce 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 0e621b32e10ab..13128367d3af5 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=address"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 3d881717e792e..0a82f37e04d32 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   '';
 
   # work around a problem related to gtk3 updates
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postInstall = "";
 
diff --git a/pkgs/tools/backup/btar/default.nix b/pkgs/tools/backup/btar/default.nix
index 00fee9414765e..f1033d275aab8 100644
--- a/pkgs/tools/backup/btar/default.nix
+++ b/pkgs/tools/backup/btar/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: listindex.o:/build/btar-1.1.1/loadindex.h:12: multiple definition of
   #     `ptr'; main.o:/build/btar-1.1.1/loadindex.h:12: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildInputs = [ librsync ];
 
diff --git a/pkgs/tools/backup/zbackup/default.nix b/pkgs/tools/backup/zbackup/default.nix
index f1dd30249fb56..24b4684745ce1 100644
--- a/pkgs/tools/backup/zbackup/default.nix
+++ b/pkgs/tools/backup/zbackup/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   # zbackup uses dynamic exception specifications which are not
   # allowed in C++17
-  NIX_CFLAGS_COMPILE = toString [ "--std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "--std=c++14" ];
 
   buildInputs = [ zlib openssl protobuf lzo libunwind ];
   nativeBuildInputs = [ cmake protobufc ];
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 0fa67bbd9320c..d3aa726afbb97 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Needed on gcc >= 6.
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with lib; {
     description = "A tool for recording audio or data CD-Rs in disk-at-once (DAO) mode";
diff --git a/pkgs/tools/cd-dvd/cdrkit/default.nix b/pkgs/tools/cd-dvd/cdrkit/default.nix
index 6f9c7a656d1b7..b950e37940c59 100644
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libcap zlib bzip2 perl ];
 
   hardeningDisable = [ "format" ];
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.hostPlatform.isMusl "-D__THROW=";
+  env.NIX_CFLAGS_COMPILE = lib.optional stdenv.hostPlatform.isMusl "-D__THROW=";
 
   # efi-boot-patch extracted from http://arm.koji.fedoraproject.org/koji/rpminfo?rpmID=174244
   patches = [ ./include-path.patch ./cdrkit-1.1.9-efi-boot.patch ./cdrkit-1.1.11-fno-common.patch ];
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index 612f4ebf04d84..1d67a0483cc24 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i6V2Owb8GcTcWowgb/BmdupOSFsYiCF2SbC9hXa26uY=";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-std=c++11" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-std=c++11" ];
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libtiff ];
diff --git a/pkgs/tools/compression/pbzip2/default.nix b/pkgs/tools/compression/pbzip2/default.nix
index 6d27b84e8c4c7..81144fb14b193 100644
--- a/pkgs/tools/compression/pbzip2/default.nix
+++ b/pkgs/tools/compression/pbzip2/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
 
   meta = with lib; {
     homepage = "http://compression.ca/pbzip2/";
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
index d9c609d7c0a9e..5ca592aa45650 100644
--- a/pkgs/tools/filesystems/9pfs/default.nix
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   # gcc-10. Otherwise build fails as:
   #   ld: lib/auth_rpc.o:/build/source/lib/../9pfs.h:35: multiple definition of
   #     `logfile'; 9pfs.o:/build/source/9pfs.h:35: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/filesystems/afpfs-ng/default.nix b/pkgs/tools/filesystems/afpfs-ng/default.nix
index b56bfba62cd4f..02dd1a7aafe05 100644
--- a/pkgs/tools/filesystems/afpfs-ng/default.nix
+++ b/pkgs/tools/filesystems/afpfs-ng/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   # avoid build failures like:
   #   ld: afpcmd-cmdline_main.o:/build/source/cmdline/cmdline_afp.h:4: multiple definition of
   #    `full_url'; afpcmd-cmdline_afp.o:/build/source/cmdline/cmdline_afp.c:27: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildInputs = [ fuse readline libgcrypt gmp ];
 
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index 668553a8054a4..a74d182fb3563 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
   pname = "blobfuse";
   inherit version src;
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=deprecated-declarations"
     "-Wno-error=catch-value"
diff --git a/pkgs/tools/filesystems/djmount/default.nix b/pkgs/tools/filesystems/djmount/default.nix
index bf1f7ba55d2b0..d3a75e420db91 100644
--- a/pkgs/tools/filesystems/djmount/default.nix
+++ b/pkgs/tools/filesystems/djmount/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: libupnp/upnp/.libs/libupnp.a(libupnp_la-gena_ctrlpt.o):libupnp/upnp/src/inc/upnpapi.h:163:
   #     multiple definition of `pVirtualDirList'; libupnp/upnp/.libs/libupnp.a(libupnp_la-upnpapi.o):libupnp/upnp/src/inc/upnpapi.h:163: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = {
     homepage = "https://djmount.sourceforge.net/";
diff --git a/pkgs/tools/filesystems/idsk/default.nix b/pkgs/tools/filesystems/idsk/default.nix
index 34a32c4a6dfe7..e23e8b13c1263 100644
--- a/pkgs/tools/filesystems/idsk/default.nix
+++ b/pkgs/tools/filesystems/idsk/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
     # Needed with GCC 12 but breaks on darwin (with clang)
     "-std=c++14"
   ];
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index afe1f2ffcd972..c11e416f71a94 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -36,7 +36,7 @@ rec {
     patches = [ ./irods_root_path.patch ];
 
     # fix build with recent llvm versions
-    NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
+    env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
 
     postPatch = common.postPatch + ''
       patchShebangs ./test
diff --git a/pkgs/tools/filesystems/jfsutils/default.nix b/pkgs/tools/filesystems/jfsutils/default.nix
index 104c9807c4818..0ddd6cfd4dad7 100644
--- a/pkgs/tools/filesystems/jfsutils/default.nix
+++ b/pkgs/tools/filesystems/jfsutils/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #     ld: extract.o:/build/jfsutils-1.1.15/fscklog/extract.c:67: multiple definition of
   #       `xchklog_buffer'; display.o:/build/jfsutils-1.1.15/fscklog/display.c:57: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   # this required for wipefreespace
   postInstall = ''
diff --git a/pkgs/tools/filesystems/reiserfsprogs/default.nix b/pkgs/tools/filesystems/reiserfsprogs/default.nix
index 07ee46a02b784..8c3986d817d77 100644
--- a/pkgs/tools/filesystems/reiserfsprogs/default.nix
+++ b/pkgs/tools/filesystems/reiserfsprogs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libuuid ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-std=gnu90" "-D_GNU_SOURCE" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=gnu90" "-D_GNU_SOURCE" ];
 
   meta = {
     inherit version;
diff --git a/pkgs/tools/filesystems/sasquatch/default.nix b/pkgs/tools/filesystems/sasquatch/default.nix
index ba5fd9ccfc1b8..258814b8905b4 100644
--- a/pkgs/tools/filesystems/sasquatch/default.nix
+++ b/pkgs/tools/filesystems/sasquatch/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: unsquashfs_xattr.o:/build/squashfs4.4/squashfs-tools/error.h:34: multiple definition of
   #     `verbose'; unsquashfs.o:/build/squashfs4.4/squashfs-tools/error.h:34: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installFlags = [ "INSTALL_DIR=\${out}/bin" ];
 
diff --git a/pkgs/tools/filesystems/sshfs-fuse/common.nix b/pkgs/tools/filesystems/sshfs-fuse/common.nix
index 262c081e35079..932c7693dc88f 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/common.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/common.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ fuse glib ];
   nativeCheckInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString
+  env.NIX_CFLAGS_COMPILE = lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/filesystems/udftools/default.nix b/pkgs/tools/filesystems/udftools/default.nix
index ec3fd6efefae4..f50f98d33dc25 100644
--- a/pkgs/tools/filesystems/udftools/default.nix
+++ b/pkgs/tools/filesystems/udftools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   preConfigure = ''
     sed -e '1i#include <limits.h>' -i cdrwtool/cdrwtool.c -i pktsetup/pktsetup.c
diff --git a/pkgs/tools/filesystems/zkfuse/default.nix b/pkgs/tools/filesystems/zkfuse/default.nix
index ef36423043040..c58dbff9ac733 100644
--- a/pkgs/tools/filesystems/zkfuse/default.nix
+++ b/pkgs/tools/filesystems/zkfuse/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   # c++17 (gcc-11's default) breaks the build as:
   #   zkadapter.h:616:33: error: ISO C++17 does not allow dynamic exception specifications
-  NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 8e287f0073494..bfeb5ff195e58 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     "--with-context=$out/share/texmf/tex/context/third"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
+  env.NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
 
   postInstall = ''
     mv $out/share/info/asymptote/*.info $out/share/info/
diff --git a/pkgs/tools/graphics/cuneiform/default.nix b/pkgs/tools/graphics/cuneiform/default.nix
index ac777051d10ad..1a1b52502f7d1 100644
--- a/pkgs/tools/graphics/cuneiform/default.nix
+++ b/pkgs/tools/graphics/cuneiform/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   # gcc-10. Otherwise build fails as:
   #   ld: CMakeFiles/rbal.dir/src/statsearchbl.cpp.o:(.bss+0x0):
   #     multiple definition of `minrow'; CMakeFiles/rbal.dir/src/linban.c.o:(.bss+0xa3a): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postPatch = ''
     rm cuneiform_src/Kern/hhh/tigerh/h/strings.h
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 252510f805968..6722e1d781923 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ gcc9Stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
 
   meta = with lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/graphics/hobbits/default.nix b/pkgs/tools/graphics/hobbits/default.nix
index 2406df8152690..fc185682cabc8 100644
--- a/pkgs/tools/graphics/hobbits/default.nix
+++ b/pkgs/tools/graphics/hobbits/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DUSE_SYSTEM_PFFFT=ON" ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
 
   meta = with lib; {
     description = "A multi-platform GUI for bit-based analysis, processing, and visualization";
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index 07f605a4cbffb..acd2b4302fc9d 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   # Fixes a build failure on aarch64-darwin. Define for all Darwin targets for when x86_64-darwin
   # upgrades to a newer SDK.
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
+  env.NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
 
   patchPhase = ''
     patchShebangs extresso/extresso
diff --git a/pkgs/tools/graphics/ifm/default.nix b/pkgs/tools/graphics/ifm/default.nix
index 7b9d49b1273ff..854a35262b078 100644
--- a/pkgs/tools/graphics/ifm/default.nix
+++ b/pkgs/tools/graphics/ifm/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: libvars.a(vars-freeze-lex.o):src/libvars/vars-freeze-lex.l:23:
   #     multiple definition of `line_number'; ifm-main.o:src/ifm-main.c:46: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   enableParallelBuilding = false; # ifm-scan.l:16:10: fatal error: ifm-parse.h: No such file or directory
 
diff --git a/pkgs/tools/graphics/qrcode/default.nix b/pkgs/tools/graphics/qrcode/default.nix
index 2067d1a97e2e6..c759b23b79a7c 100644
--- a/pkgs/tools/graphics/qrcode/default.nix
+++ b/pkgs/tools/graphics/qrcode/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0v81745nx5gny2g05946k8j553j18a29ikmlyh6c3syq6c15k8cf";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index 0cf407faa0dc3..88993dbe8ce64 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   buildInputs = [ SDL SDL_gfx libjpeg libpng opencv ];
 
   makeFlags = [ "PREFIX=$(out)" ];
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL}/include/SDL -I${SDL_gfx}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL}/include/SDL -I${SDL_gfx}/include/SDL";
 
   # Disable building of linux-only demos on darwin systems
   patches = lib.optionals stdenv.isDarwin [ ./0001-dont-build-demos.patch ];
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 9bf4a281e062a..3542c06ac09b5 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable assertions which include -dev QtBase file paths.
-  NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   configureFlags = [
     "--without-python"
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index 5422efb9d38df..5a5fb2da22827 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ fcitx gettext ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 29870d680b20d..cd890d6e83571 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
-  NIX_CFLAGS_COMPILE = toString []
+  env.NIX_CFLAGS_COMPILE = toString []
     # Work around a bogus warning in conjunction with musl.
     ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
     ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0";
diff --git a/pkgs/tools/misc/edk2-uefi-shell/default.nix b/pkgs/tools/misc/edk2-uefi-shell/default.nix
index d399c7dabc159..3f037755fb061 100644
--- a/pkgs/tools/misc/edk2-uefi-shell/default.nix
+++ b/pkgs/tools/misc/edk2-uefi-shell/default.nix
@@ -14,7 +14,7 @@ edk2.mkDerivation "ShellPkg/ShellPkg.dsc" (finalAttrs: {
     ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ];
   strictDeps = true;
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-fno-pic" "-Qunused-arguments" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-fno-pic" "-Qunused-arguments" ];
 
   # Set explicitly to use Python 3 from nixpkgs. Otherwise, the build system will detect and try to
   # use `/usr/bin/python3` on Darwin when sandboxing is disabled.
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index cefc80d3fe0ce..8967b02ed9129 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DFLB_METRICS=ON" "-DFLB_HTTP_SERVER=ON" "-DFLB_OUT_PGSQL=ON"  ];
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-O" ]
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-O" ]
     # Workaround build failure on -fno-common toolchains:
     #   ld: /monkey/mk_tls.h:81: multiple definition of `mk_tls_server_timeout';
     #     flb_config.c.o:include/monkey/mk_tls.h:81: first defined here
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index aa3d16a5fa566..6aee2be9118c9 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   '';
 
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 16db1cb2ef1a1..b6125b9faf761 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -339,7 +339,7 @@ stdenv.mkDerivation rec {
   separateDebugInfo = !xenSupport;
 
   # Work around a bug in the generated flex lexer (upstream flex bug?)
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index e4efceea888d3..559eec9bbdd06 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
+  env.NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/gtklp/default.nix b/pkgs/tools/misc/gtklp/default.nix
index 8eafd98e267f5..af98ed1ae1b73 100644
--- a/pkgs/tools/misc/gtklp/default.nix
+++ b/pkgs/tools/misc/gtklp/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: libgtklp.a(libgtklp.o):libgtklp/libgtklp.h:83: multiple definition of `progressBar';
   #     file.o:libgtklp/libgtklp.h:83: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preConfigure = ''
     substituteInPlace include/defaults.h --replace "netscape" "firefox"
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index c3a0c5aa906d4..d82c24dba915f 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index 9635f8e1a8cce..45cd96382381b 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureScript = "sh autogen.sh";
 
diff --git a/pkgs/tools/misc/lilo/default.nix b/pkgs/tools/misc/lilo/default.nix
index f72cdc422be0c..17b485ca8da63 100644
--- a/pkgs/tools/misc/lilo/default.nix
+++ b/pkgs/tools/misc/lilo/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: identify.o:(.bss+0x0): multiple definition of `identify';
   #     common.o:(.bss+0x160): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [
     "DESTDIR=${placeholder "out"}"
diff --git a/pkgs/tools/misc/lockfile-progs/default.nix b/pkgs/tools/misc/lockfile-progs/default.nix
index 43f1a0967c704..624a89ef9794e 100644
--- a/pkgs/tools/misc/lockfile-progs/default.nix
+++ b/pkgs/tools/misc/lockfile-progs/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ liblockfile ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=format-overflow"
   ];
diff --git a/pkgs/tools/misc/pipelight/default.nix b/pkgs/tools/misc/pipelight/default.nix
index 2f70ea677b62c..cdf77b0af427e 100644
--- a/pkgs/tools/misc/pipelight/default.nix
+++ b/pkgs/tools/misc/pipelight/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ wine_custom libX11 libGLU libGL curl ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
   patches = [
     ./pipelight.patch
diff --git a/pkgs/tools/misc/rockbox-utility/default.nix b/pkgs/tools/misc/rockbox-utility/default.nix
index 2ca7478b742f7..b5762fd651abc 100644
--- a/pkgs/tools/misc/rockbox-utility/default.nix
+++ b/pkgs/tools/misc/rockbox-utility/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation  rec {
   #   ld: libmkimxboot.a(elf.c.o):utils/imxtools/sbtools/misc.h:43: multiple definition of `g_nr_keys';
   #     libmkimxboot.a(mkimxboot.c.o):utils/imxtools/sbtools/misc.h:43: first defined here
   # TODO: try to remove with 1.5.1 update.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/misc/sfeed/default.nix b/pkgs/tools/misc/sfeed/default.nix
index 57bcd98b89d7b..36ef0fdc96a56 100644
--- a/pkgs/tools/misc/sfeed/default.nix
+++ b/pkgs/tools/misc/sfeed/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   # otherwise does not find SIGWINCH
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D_DARWIN_C_SOURCE";
 
   meta = with lib; {
     homepage = "https://codemadness.org/sfeed-simple-feed-parser.html";
diff --git a/pkgs/tools/misc/shallot/default.nix b/pkgs/tools/misc/shallot/default.nix
index 93f67bd2defbf..46c5714ce9667 100644
--- a/pkgs/tools/misc/shallot/default.nix
+++ b/pkgs/tools/misc/shallot/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: src/shallot.o:(.bss+0x8): multiple definition of `lucky_thread'; src/error.o:(.bss+0x8): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/shim/default.nix b/pkgs/tools/misc/shim/default.nix
index 9bb7c59c7b7c1..ea13cc1bd66f3 100644
--- a/pkgs/tools/misc/shim/default.nix
+++ b/pkgs/tools/misc/shim/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ elfutils ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-I${toString elfutils.dev}/include" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${toString elfutils.dev}/include" ];
 
   makeFlags =
     lib.optional (vendorCertFile != null) "VENDOR_CERT_FILE=${vendorCertFile}"
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index c757882c12a27..b96aa7c39998a 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index f3094302cd680..754bf767d1dab 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     Foundation
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-framework"
     "AppKit"
   ];
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index 16f4d1eb55173..4511d3be744a3 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   nativeCheckInputs = [ which ]; # used for tests with checkFlags = [ "DEBUG=true" ];
   checkTarget = "tests";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with lib; {
     description = "Lightweight implementation of some Unix command line utilities";
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index c6fd76d096627..5499cac9a8a17 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libbfd zlib libiberty ];
   makeFlags = [ "wimboot.x86_64.efi" ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=array-bounds"
   ];
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index 365a2ddabafcc..d570014494042 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libgsf glib libxml2 ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = {
     description = "Excellent MS Word filter lib, used in most Office suites";
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index 703af40864ae5..290b37889977c 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -9,7 +9,7 @@ gccStdenv.mkDerivation rec {
     sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=format"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index f1ea8cba5c199..8198b21e9094a 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-uNTvi6zbrYHAivQMPkhlNCoqRW9GOkgKvCf3mInds80=";
   };
 
-  NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
 
   postPatch = ''
     for file in ./examples/*/*.pl; do
diff --git a/pkgs/tools/networking/atftp/default.nix b/pkgs/tools/networking/atftp/default.nix
index 06b04170a3f3b..a8db0e93d5d3b 100644
--- a/pkgs/tools/networking/atftp/default.nix
+++ b/pkgs/tools/networking/atftp/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Expects pre-GCC5 inline semantics
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   doCheck = true;
 
diff --git a/pkgs/tools/networking/atinout/default.nix b/pkgs/tools/networking/atinout/default.nix
index 561211fe33d5e..7ff1b06c3b803 100644
--- a/pkgs/tools/networking/atinout/default.nix
+++ b/pkgs/tools/networking/atinout/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "atinout";
   version = "0.9.2-alpha";
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.cc.isClang) "-Werror=implicit-fallthrough=0";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.cc.isClang) "-Werror=implicit-fallthrough=0";
   LANG = if stdenv.isDarwin then "en_US.UTF-8" else "C.UTF-8";
   nativeBuildInputs = [ ronn mount ];
 
diff --git a/pkgs/tools/networking/bsd-finger/default.nix b/pkgs/tools/networking/bsd-finger/default.nix
index 12e429b7bcba8..48e64b202c6ef 100644
--- a/pkgs/tools/networking/bsd-finger/default.nix
+++ b/pkgs/tools/networking/bsd-finger/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   # outputs = [ "out" "man" ];
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   patches = [
     ./ubuntu-0.17-9.patch
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index d564846d47d90..7f06eb6b3ef77 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
     libuv
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-O2"
     "-Wno-error=array-bounds"
     "-Wno-error=stringop-overflow"
diff --git a/pkgs/tools/networking/connman/connman-ncurses/default.nix b/pkgs/tools/networking/connman/connman-ncurses/default.nix
index 976708c038cd0..9d638c48000a9 100644
--- a/pkgs/tools/networking/connman/connman-ncurses/default.nix
+++ b/pkgs/tools/networking/connman/connman-ncurses/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ dbus ncurses json_c connman ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index 7446403f6b20b..757a7208c4d2c 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ]
     ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "BUILD_CC=$(CC_FOR_BUILD)";
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=pointer-compare"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
diff --git a/pkgs/tools/networking/dibbler/default.nix b/pkgs/tools/networking/dibbler/default.nix
index b6e5229a2f20a..92254231bf7c0 100644
--- a/pkgs/tools/networking/dibbler/default.nix
+++ b/pkgs/tools/networking/dibbler/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ./Port-linux/libLowLevel.a(libLowLevel_a-interface.o):(.bss+0x4): multiple definition of `interface_auto_up';
   #     ./Port-linux/libLowLevel.a(libLowLevel_a-lowlevel-linux-link-state.o):(.bss+0x74): first defined here
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1" + " -fcommon";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1" + " -fcommon";
 
   meta = with lib; {
     description = "Portable DHCPv6 implementation";
diff --git a/pkgs/tools/networking/dirb/default.nix b/pkgs/tools/networking/dirb/default.nix
index 957cbed63102f..1ff6c33bcc26b 100644
--- a/pkgs/tools/networking/dirb/default.nix
+++ b/pkgs/tools/networking/dirb/default.nix
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: resume.o:/build/dirb222/src/variables.h:15: multiple definition of `curl';
   #     crea_wordlist.o:/build/dirb222/src/variables.h:15: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postInstall = ''
     mkdir -p $out/share/dirb/
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index a85f225670112..592ec23086577 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -61,7 +61,7 @@ in gcc9Stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook rpcsvc-proto ];
   buildInputs = [ glib pcap libtirpc libnsl ];
   NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread -ltirpc";
-  NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   postPatch = ''
     for patch in debian/patches/*.patch; do
       patch < $patch
diff --git a/pkgs/tools/networking/iftop/default.nix b/pkgs/tools/networking/iftop/default.nix
index 137ce03b2520e..100164ff3db7e 100644
--- a/pkgs/tools/networking/iftop/default.nix
+++ b/pkgs/tools/networking/iftop/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: tui.o:/build/iftop-1.0pre4/ui_common.h:41: multiple definition of `service_hash';
   #     iftop.o:/build/iftop-1.0pre4/ui_common.h:41: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   passthru.tests = { inherit (nixosTests) iftop; };
 
diff --git a/pkgs/tools/networking/iodine/default.nix b/pkgs/tools/networking/iodine/default.nix
index 226cfb9ce8ef5..a684f3a580f56 100644
--- a/pkgs/tools/networking/iodine/default.nix
+++ b/pkgs/tools/networking/iodine/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''sed -i "s,/sbin/route,${nettools}/bin/route," src/tun.c'';
 
-  NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
+  env.NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
 
   installFlags = [ "prefix=\${out}" ];
 
diff --git a/pkgs/tools/networking/iouyap/default.nix b/pkgs/tools/networking/iouyap/default.nix
index 0b3c8007af6eb..d2754469fadec 100644
--- a/pkgs/tools/networking/iouyap/default.nix
+++ b/pkgs/tools/networking/iouyap/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: netmap.o:(.bss+0x20): multiple definition of `sizecheck'; iouyap.o:(.bss+0x20): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     install -D -m555 iouyap $out/bin/iouyap;
diff --git a/pkgs/tools/networking/jwhois/default.nix b/pkgs/tools/networking/jwhois/default.nix
index 025169a9fd353..12494fc269921 100644
--- a/pkgs/tools/networking/jwhois/default.nix
+++ b/pkgs/tools/networking/jwhois/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   # Work around error from <stdio.h> on aarch64-darwin:
   #     error: 'TARGET_OS_IPHONE' is not defined, evaluates to 0 [-Werror,-Wundef-prefix=TARGET_OS_]
   # TODO: this should probably be fixed at a lower level than this?
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-undef-prefix";
+  env.NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-undef-prefix";
 
   meta = {
     description = "A client for the WHOIS protocol allowing you to query the owner of a domain name";
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index 7c5e09b950ae1..f5fc34487aa1d 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   #   ld: liblsh.a(unix_user.o):/build/lsh-2.0.4/src/server_userauth.h:108: multiple definition of
   #     `server_userauth_none_preauth'; lshd.o:/build/lsh-2.0.4/src/server_userauth.h:108: first defined here
   # Should be present in upcoming 2.1 release.
-  NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon";
 
   buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam libxcrypt ];
 
diff --git a/pkgs/tools/networking/ncftp/default.nix b/pkgs/tools/networking/ncftp/default.nix
index 8156caad7c3df..02dd29c0fda58 100644
--- a/pkgs/tools/networking/ncftp/default.nix
+++ b/pkgs/tools/networking/ncftp/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: bookmark.o: (.bss+0x20): multiple definition of `gBm';
   #     gpshare.o:(.bss+0x0): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preConfigure = ''
     find -name Makefile.in | xargs sed -i '/^TMPDIR=/d'
diff --git a/pkgs/tools/networking/networkmanager/iodine/default.nix b/pkgs/tools/networking/networkmanager/iodine/default.nix
index 8d09977b4e57a..aff411ea0ed9b 100644
--- a/pkgs/tools/networking/networkmanager/iodine/default.nix
+++ b/pkgs/tools/networking/networkmanager/iodine/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool autoreconfHook pkg-config ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = "intltoolize";
   configureFlags = [
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
index a8d8c2cff6b7e..297ada3cc2aad 100644
--- a/pkgs/tools/networking/nfstrace/default.nix
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   # To build with GCC 8+ it needs:
   CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
   # CMake can't find json_c without:
-  NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" "-Wno-error=address-of-packed-member" "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" "-Wno-error=address-of-packed-member" "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-ltirpc" ];
 
   doCheck = false; # requires network access
diff --git a/pkgs/tools/networking/oonf-olsrd2/default.nix b/pkgs/tools/networking/oonf-olsrd2/default.nix
index e86bfbd1961a5..bc7cbe8d491da 100644
--- a/pkgs/tools/networking/oonf-olsrd2/default.nix
+++ b/pkgs/tools/networking/oonf-olsrd2/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   #   ld: CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router_session.c.o:(.bss+0x0):
   #     multiple definition of `LOG_DLEP_ROUTER'; CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router.c.o:(.bss+0x0): first defined here
   # Can be removed once release with https://github.com/OLSR/OONF/pull/40 is out.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   cmakeFlags = [
     "-DOONF_NO_WERROR=yes"
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index e9b67edcf3d15..139078f2f6fce 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     export sourceRoot=$(realpath */gtests/net/packetdrill)
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=unused-result"
     "-Wno-error=stringop-truncation"
     "-Wno-error=address-of-packed-member"
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 09e7578a7187e..eee0dfd030680 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   # still builds.
   #
   # [1]: https://github.com/ppp-project/ppp/commit/c2881a6b71a36d28a89166e82820dc5e711fd775
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.hostPlatform.isMusl "-UIPX_CHANGE";
 
   installPhase = ''
diff --git a/pkgs/tools/networking/reaver-wps/default.nix b/pkgs/tools/networking/reaver-wps/default.nix
index 9fe7d88f12c3e..050cadf3ed641 100644
--- a/pkgs/tools/networking/reaver-wps/default.nix
+++ b/pkgs/tools/networking/reaver-wps/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: crypto/dh_groups.o:src/crypto/../globule.h:141: multiple definition of
   #     `globule'; /build/ccrzO6vA.o:src/globule.h:141: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   setSourceRoot = ''
     sourceRoot=$(echo */src)
diff --git a/pkgs/tools/networking/redfang/default.nix b/pkgs/tools/networking/redfang/default.nix
index 9e18d687dc0f0..8e799b7d41fd3 100644
--- a/pkgs/tools/networking/redfang/default.nix
+++ b/pkgs/tools/networking/redfang/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-security";
 
   buildInputs = [ bluez ];
 
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index 89a7d706ccdcf..c2aeaaa18e00b 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: transport.o:/build/source/sipsak.h:323: multiple definition of
   #     `address'; auth.o:/build/source/sipsak.h:323: first defined here
-  NIX_CFLAGS_COMPILE = "-std=gnu89 -fcommon";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89 -fcommon";
 
   src = fetchFromGitHub {
     owner = "sipwise";
diff --git a/pkgs/tools/networking/termscp/default.nix b/pkgs/tools/networking/termscp/default.nix
index 4a65620e48b77..477850f5d6672 100644
--- a/pkgs/tools/networking/termscp/default.nix
+++ b/pkgs/tools/networking/termscp/default.nix
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-framework" "AppKit"
   ];
 
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 031e9b029268e..6ce4d96d7653f 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "SD_NOTIFY=1"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=maybe-uninitialized"
   ];
diff --git a/pkgs/tools/networking/trickle/default.nix b/pkgs/tools/networking/trickle/default.nix
index 0dafd86dd1ad1..5d1ca8e4ee7db 100644
--- a/pkgs/tools/networking/trickle/default.nix
+++ b/pkgs/tools/networking/trickle/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   '';
 
   NIX_LDFLAGS = [ "-levent" "-ltirpc" ];
-  NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
 
   configureFlags = [ "--with-libevent" ];
 
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 067bc51854ada..220e20dcd9e7b 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ libubox json_c ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+  env.NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
     "-Wno-error=dangling-pointer"
   ];
diff --git a/pkgs/tools/networking/uwimap/default.nix b/pkgs/tools/networking/uwimap/default.nix
index 4bd2f872caf3e..fa80f7348abb5 100644
--- a/pkgs/tools/networking/uwimap/default.nix
+++ b/pkgs/tools/networking/uwimap/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${lib.getLib openssl}/lib,'
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-I${openssl.dev}/include/openssl";
 
   installPhase = ''
diff --git a/pkgs/tools/networking/webalizer/default.nix b/pkgs/tools/networking/webalizer/default.nix
index cf49ad0be3e26..4c2354b5f7fbb 100644
--- a/pkgs/tools/networking/webalizer/default.nix
+++ b/pkgs/tools/networking/webalizer/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   # Workaround build failure on -fno-common toolchains:
   #   ld: dns_resolv.o:(.bss+0x20): multiple definition of `system_info'; webalizer.o:(.bss+0x76e0): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preConfigure =
     ''
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 74280724ca40c..20efd6f0182aa 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/package-management/apk-tools/default.nix b/pkgs/tools/package-management/apk-tools/default.nix
index d6279900aae05..87bba496859f4 100644
--- a/pkgs/tools/package-management/apk-tools/default.nix
+++ b/pkgs/tools/package-management/apk-tools/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "PKGCONFIGDIR=$(out)/lib/pkgconfig"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=unused-result"
     "-Wno-error=deprecated-declarations"
   ];
diff --git a/pkgs/tools/package-management/appimagekit/default.nix b/pkgs/tools/package-management/appimagekit/default.nix
index 556b96ea2095e..3fa9528add12b 100644
--- a/pkgs/tools/package-management/appimagekit/default.nix
+++ b/pkgs/tools/package-management/appimagekit/default.nix
@@ -40,7 +40,7 @@ let
     # Workaround build failure on -fno-common toolchains:
     #   ld: libsquashfuse_ll.a(libfuseprivate_la-fuseprivate.o):(.bss+0x8):
     #     multiple definition of `have_libloaded'; runtime.4.o:(.bss.have_libloaded+0x0): first defined here
-    NIX_CFLAGS_COMPILE = "-fcommon";
+    env.NIX_CFLAGS_COMPILE = "-fcommon";
 
     preConfigure = ''
       sed -i "/PKG_CHECK_MODULES.*/,/,:./d" configure
diff --git a/pkgs/tools/package-management/cde/default.nix b/pkgs/tools/package-management/cde/default.nix
index 43a32eccda16d..2e0ceb53e4f9c 100644
--- a/pkgs/tools/package-management/cde/default.nix
+++ b/pkgs/tools/package-management/cde/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ../readelf-mini/libreadelf-mini.a(dwarf.o):/build/source/readelf-mini/dwarf.c:64:
   #     multiple definition of `do_wide'; ../readelf-mini/libreadelf-mini.a(readelf-mini.o):/build/source/readelf-mini/readelf-mini.c:170: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     install -d $out/bin
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 0e491fcbb27ac..7cb1dd91c26a7 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ popt nss db bzip2 libarchive libbfd ]
     ++ lib.optional stdenv.isLinux elfutils;
 
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
+  env.NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
   configureFlags = [
     "--with-external-db"
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index eb71b51478092..c948c66b47f12 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=deprecated-declarations";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index acbaf00036ef2..11b276ca05d2c 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -51,7 +51,7 @@ let
         --replace '"clang++"' '"clang++-UNSUPPORTED"'
     '';
 
-    NIX_CFLAGS_COMPILE = toString [
+    env.NIX_CFLAGS_COMPILE = toString [
       # Needed with GCC 12
       "-Wno-error=use-after-free"
     ];
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index f16849ce63746..2acdc9bb09f07 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
     mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=dangling-pointer"
   ];
diff --git a/pkgs/tools/security/dieharder/default.nix b/pkgs/tools/security/dieharder/default.nix
index b85a5c39656ea..51370ad8dcc2d 100644
--- a/pkgs/tools/security/dieharder/default.nix
+++ b/pkgs/tools/security/dieharder/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: include/dieharder/parse.h:21: multiple definition of `splitbuf';
   #     include/dieharder/parse.h:21: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildInputs = [ gsl ];
 
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index 5fa9bc0beddba..390665fe44fd8 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ../util/libutil.a(estream-printf.o):/build/gnupg-1.4.23/util/../include/memory.h:100: multiple definition of
   #     `memory_debug_mode'; gpgsplit.o:/build/gnupg-1.4.23/tools/../include/memory.h:100: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   doCheck = true;
 
diff --git a/pkgs/tools/security/haka/default.nix b/pkgs/tools/security/haka/default.nix
index 3ea38e060407e..b20abbb8bf20f 100644
--- a/pkgs/tools/security/haka/default.nix
+++ b/pkgs/tools/security/haka/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0dm39g3k77sa70zrjsqadidg27a6iqq61jzfdxazpllnrw4mjy4w";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = ''
     sed -i 's,/etc,'$out'/etc,' src/haka/haka.c
diff --git a/pkgs/tools/security/iaito/default.nix b/pkgs/tools/security/iaito/default.nix
index f5825d2e18f9b..4e7567d45fdac 100644
--- a/pkgs/tools/security/iaito/default.nix
+++ b/pkgs/tools/security/iaito/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   ];
 
   # the radare2 binary package seems to not install all necessary headers.
-  NIX_CFLAGS_COMPILE = toString [ "-I" "${radare2.src}/shlr/sdb/include/sdb" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I" "${radare2.src}/shlr/sdb/include/sdb" ];
 
   postBuild = ''
     pushd ../../../iaito-translations
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 54cf67ecb9d6c..51e9434f82e8f 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.isDarwin Carbon
   ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [
     "--enable-zlib"
diff --git a/pkgs/tools/security/ossec/default.nix b/pkgs/tools/security/ossec/default.nix
index 3c43c51c103ab..1aa606f592742 100644
--- a/pkgs/tools/security/ossec/default.nix
+++ b/pkgs/tools/security/ossec/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: src/common/mgmt/pint-worker-external.po:(.data.rel.local+0x0): multiple definition of
   #     `PINT_worker_external_impl'; src/common/mgmt/pint-mgmt.po:(.bss+0x20): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildPhase = ''
     echo "en
diff --git a/pkgs/tools/security/pcsc-cyberjack/default.nix b/pkgs/tools/security/pcsc-cyberjack/default.nix
index 40736cdc86bad..b420263c209b2 100644
--- a/pkgs/tools/security/pcsc-cyberjack/default.nix
+++ b/pkgs/tools/security/pcsc-cyberjack/default.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   configureFlags = [
     "--with-usbdropdir=${placeholder "out"}/pcsc/drivers"
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 1c2e9cbd4ab4e..8000ae9afc8c2 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: pam.o:/build/super-3.30.0/super.h:293: multiple definition of
   #     `Method'; super.o:/build/super-3.30.0/super.h:293: first defined here
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE -fcommon";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE -fcommon";
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index 06f8d2dfe2505..5502de2d6272a 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-usercheck" ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/security/truecrack/default.nix b/pkgs/tools/security/truecrack/default.nix
index e90eed4d6612b..aebbbc79f8f4e 100644
--- a/pkgs/tools/security/truecrack/default.nix
+++ b/pkgs/tools/security/truecrack/default.nix
@@ -33,7 +33,7 @@ gccStdenv.mkDerivation rec {
   #     `t_rc'; CpuCore.o:/build/source/src/Crypto/CpuAes.h:1237: first defined here
   # TODO: remove on upstream fixes it:
   #   https://gitlab.com/kalilinux/packages/truecrack/-/issues/1
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installFlags = [ "prefix=$(out)" ];
   enableParallelBuilding = true;
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 0493a7b78560d..92f30e4ddbc93 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "iasl"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-O3"
     # Needed with GCC 12
     "-Wno-dangling-pointer"
diff --git a/pkgs/tools/system/ddrutility/default.nix b/pkgs/tools/system/ddrutility/default.nix
index ce5e16e4eb4bf..fc81c35fa4626 100644
--- a/pkgs/tools/system/ddrutility/default.nix
+++ b/pkgs/tools/system/ddrutility/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: /build/ccltHly5.o:(.bss+0x119f8): multiple definition of `start_time'; /build/cc9evx3L.o:(.bss+0x10978): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [ "DESTDIR=$(out)" ];
 
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 0e746b0d07a44..c6c091c1fba1b 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     "-DRUBY_LIB_INSTALL=${placeholder "out"}/lib/ruby"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost cpp-hocon curl leatherman libwhereami yaml-cpp openssl ruby util-linux ];
diff --git a/pkgs/tools/system/foremost/default.nix b/pkgs/tools/system/foremost/default.nix
index 0e1f118c2054b..140ce91fd66cc 100644
--- a/pkgs/tools/system/foremost/default.nix
+++ b/pkgs/tools/system/foremost/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   # -fcommon: Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: api.o:(.bss+0xbdba0): multiple definition of `wildcard'; main.o:(.bss+0xbd760): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [ "PREFIX=$(out)" ] ++ lib.optionals stdenv.isDarwin [ "mac" ];
 
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index d691a86e246ca..b08d705cad17e 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sed -e "s@/var@$out/var@g" -i Makefile */Makefile */*/Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   meta = with lib; {
     description = "An easy-to-use IPMI server management utility";
diff --git a/pkgs/tools/system/mac-fdisk/default.nix b/pkgs/tools/system/mac-fdisk/default.nix
index 292b77d2d2cf7..94e7996c16163 100644
--- a/pkgs/tools/system/mac-fdisk/default.nix
+++ b/pkgs/tools/system/mac-fdisk/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5f24ddf626091..d5612331e8295 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
   # We pick zlib.dev as a simple canary package with pkg-config input.
   disallowedReferences = [ zlib.dev ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = ''
     ln -s ${go-d-plugin}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
diff --git a/pkgs/tools/system/pdisk/default.nix b/pkgs/tools/system/pdisk/default.nix
index e0a78b6b94096..b10d9e81caa18 100644
--- a/pkgs/tools/system/pdisk/default.nix
+++ b/pkgs/tools/system/pdisk/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     IOKit
   ];
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 993bfdaf834a8..f360697efbd36 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-Wno-error=format";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index aea767e323aa9..7c94c9c89e5d1 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index c60228fd3ee42..96ce3fcd412e9 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./dont_static_link.patch ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # fix build with gcc9
     "-Wno-error"
     # workaround build failure on -fno-common toolchains:
diff --git a/pkgs/tools/text/kytea/default.nix b/pkgs/tools/text/kytea/default.nix
index 9cbc2c030a455..322fa77ebad67 100644
--- a/pkgs/tools/text/kytea/default.nix
+++ b/pkgs/tools/text/kytea/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc-O3.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     homepage = "http://www.phontron.com/kytea/";
diff --git a/pkgs/tools/text/qgrep/default.nix b/pkgs/tools/text/qgrep/default.nix
index 4145ec656d20b..ed6a409b2696c 100644
--- a/pkgs/tools/text/qgrep/default.nix
+++ b/pkgs/tools/text/qgrep/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices CoreFoundation ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+  env.NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
     "-Wno-error=mismatched-new-delete"
   ];
diff --git a/pkgs/tools/text/sgml/jade/default.nix b/pkgs/tools/text/sgml/jade/default.nix
index 891e26017e68c..a744300bfddec 100644
--- a/pkgs/tools/text/sgml/jade/default.nix
+++ b/pkgs/tools/text/sgml/jade/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnum4 ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated";
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated";
 
   # Makefile is missing intra-library depends, fails build as:
   # ld: cannot find -lsp
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 53146ddd06105..94c5c8cf02fc9 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   #   ld: src/zfile.o:/build/source/src/log.h:12: multiple definition of
   #     `print_mtx'; src/ignore.o:/build/source/src/log.h:12: first defined here
   # TODO: remove once next release has https://github.com/ggreer/the_silver_searcher/pull/1377
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
   NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lgcc_s";
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/text/smu/default.nix b/pkgs/tools/text/smu/default.nix
index 02a29a91f47d9..85e593982e85a 100644
--- a/pkgs/tools/text/smu/default.nix
+++ b/pkgs/tools/text/smu/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O";
+  env.NIX_CFLAGS_COMPILE = "-O";
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index b9b1b228efa59..675dfc109de13 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL";
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index dbad79e61ad1d..c2b0efbdec802 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   # Fixes build with GCC 6
-  NIX_CFLAGS_COMPILE = "-std=c++03";
+  env.NIX_CFLAGS_COMPILE = "-std=c++03";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libxslt freetype libpng libxml2 ];
diff --git a/pkgs/tools/virtualization/google-guest-oslogin/default.nix b/pkgs/tools/virtualization/google-guest-oslogin/default.nix
index 0249052fc26b5..0e2aae22f728f 100644
--- a/pkgs/tools/virtualization/google-guest-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-guest-oslogin/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ curl.dev pam json_c ];
 
-  NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" ];
 
   makeFlags = [
     "VERSION=${version}"
diff --git a/pkgs/tools/wayland/wlrctl/default.nix b/pkgs/tools/wayland/wlrctl/default.nix
index 4de7699b35f87..3915e3a18a0e9 100644
--- a/pkgs/tools/wayland/wlrctl/default.nix
+++ b/pkgs/tools/wayland/wlrctl/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson pkg-config scdoc ninja wayland-scanner ];
   buildInputs = [ libxkbcommon wayland ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=type-limits";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=type-limits";
 
   meta = with lib; {
     description = "Command line utility for miscellaneous wlroots Wayland extensions";