about summary refs log tree commit diff
path: root/pkgs/applications
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/applications')
-rw-r--r--pkgs/applications/audio/aacgain/default.nix2
-rw-r--r--pkgs/applications/audio/adlplug/default.nix2
-rw-r--r--pkgs/applications/audio/aether-lv2/default.nix2
-rw-r--r--pkgs/applications/audio/audio-recorder/default.nix2
-rw-r--r--pkgs/applications/audio/bespokesynth/default.nix2
-rw-r--r--pkgs/applications/audio/bristol/default.nix2
-rw-r--r--pkgs/applications/audio/fire/default.nix2
-rw-r--r--pkgs/applications/audio/freewheeling/default.nix2
-rw-r--r--pkgs/applications/audio/furnace/default.nix4
-rw-r--r--pkgs/applications/audio/giada/default.nix2
-rw-r--r--pkgs/applications/audio/gnaural/default.nix2
-rw-r--r--pkgs/applications/audio/grandorgue/default.nix2
-rw-r--r--pkgs/applications/audio/gtkpod/default.nix2
-rw-r--r--pkgs/applications/audio/guitarix/default.nix2
-rw-r--r--pkgs/applications/audio/jamin/default.nix2
-rw-r--r--pkgs/applications/audio/klystrack/default.nix2
-rw-r--r--pkgs/applications/audio/littlegptracker/default.nix4
-rw-r--r--pkgs/applications/audio/lsp-plugins/default.nix2
-rw-r--r--pkgs/applications/audio/mi2ly/default.nix2
-rw-r--r--pkgs/applications/audio/mimic/default.nix2
-rw-r--r--pkgs/applications/audio/mp3blaster/default.nix2
-rw-r--r--pkgs/applications/audio/mpc123/default.nix2
-rw-r--r--pkgs/applications/audio/mpg321/default.nix2
-rw-r--r--pkgs/applications/audio/muse/default.nix2
-rw-r--r--pkgs/applications/audio/oxefmsynth/default.nix2
-rw-r--r--pkgs/applications/audio/picoloop/default.nix2
-rw-r--r--pkgs/applications/audio/pragha/default.nix2
-rw-r--r--pkgs/applications/audio/sayonara/default.nix2
-rw-r--r--pkgs/applications/audio/soundscape-renderer/default.nix2
-rw-r--r--pkgs/applications/audio/tenacity/default.nix2
-rw-r--r--pkgs/applications/audio/transcode/default.nix2
-rw-r--r--pkgs/applications/audio/ympd/default.nix2
-rw-r--r--pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix2
-rw-r--r--pkgs/applications/blockchains/cgminer/default.nix2
-rw-r--r--pkgs/applications/display-managers/greetd/gtkgreet.nix2
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix2
-rw-r--r--pkgs/applications/editors/gnome-latex/default.nix2
-rw-r--r--pkgs/applications/editors/hexcurse/default.nix2
-rw-r--r--pkgs/applications/editors/ht/default.nix2
-rw-r--r--pkgs/applications/editors/nedit/default.nix2
-rw-r--r--pkgs/applications/editors/texmaker/default.nix2
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix9
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix4
-rw-r--r--pkgs/applications/emulators/bsnes/ares/default.nix2
-rw-r--r--pkgs/applications/emulators/dosbox-staging/default.nix2
-rw-r--r--pkgs/applications/emulators/gens-gs/default.nix2
-rw-r--r--pkgs/applications/emulators/mame/default.nix2
-rw-r--r--pkgs/applications/emulators/np2kai/default.nix2
-rw-r--r--pkgs/applications/emulators/pcsxr/default.nix2
-rw-r--r--pkgs/applications/emulators/simh/default.nix2
-rw-r--r--pkgs/applications/emulators/tilem/default.nix2
-rw-r--r--pkgs/applications/emulators/uae/default.nix2
-rw-r--r--pkgs/applications/emulators/zsnes/2.x.nix2
-rw-r--r--pkgs/applications/emulators/zsnes/default.nix2
-rw-r--r--pkgs/applications/file-managers/nnn/default.nix2
-rw-r--r--pkgs/applications/file-managers/spacefm/default.nix2
-rw-r--r--pkgs/applications/graphics/foxotron/default.nix2
-rw-r--r--pkgs/applications/graphics/freepv/default.nix2
-rw-r--r--pkgs/applications/graphics/gimp/default.nix2
-rw-r--r--pkgs/applications/graphics/gimp/plugins/default.nix2
-rw-r--r--pkgs/applications/graphics/gnuclad/default.nix2
-rw-r--r--pkgs/applications/graphics/goxel/default.nix2
-rw-r--r--pkgs/applications/graphics/gqview/default.nix2
-rw-r--r--pkgs/applications/graphics/grafx2/default.nix2
-rw-r--r--pkgs/applications/graphics/hugin/default.nix2
-rw-r--r--pkgs/applications/graphics/imgcat/default.nix2
-rw-r--r--pkgs/applications/graphics/jpeg-archive/default.nix2
-rw-r--r--pkgs/applications/graphics/krita/generic.nix4
-rw-r--r--pkgs/applications/graphics/luminance-hdr/default.nix2
-rw-r--r--pkgs/applications/graphics/photoflare/default.nix2
-rw-r--r--pkgs/applications/kde/print-manager.nix2
-rw-r--r--pkgs/applications/misc/apvlv/default.nix2
-rw-r--r--pkgs/applications/misc/bb/default.nix2
-rw-r--r--pkgs/applications/misc/blender/default.nix2
-rw-r--r--pkgs/applications/misc/cataract/build.nix2
-rw-r--r--pkgs/applications/misc/getxbook/default.nix2
-rw-r--r--pkgs/applications/misc/gmtp/default.nix2
-rw-r--r--pkgs/applications/misc/gpsbabel/default.nix2
-rw-r--r--pkgs/applications/misc/gxneur/default.nix2
-rw-r--r--pkgs/applications/misc/keepassxc/default.nix2
-rw-r--r--pkgs/applications/misc/klayout/default.nix2
-rw-r--r--pkgs/applications/misc/lsd2dsl/default.nix2
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix4
-rw-r--r--pkgs/applications/misc/nut/default.nix2
-rw-r--r--pkgs/applications/misc/opencpn/default.nix4
-rw-r--r--pkgs/applications/misc/opentrack/aruco.nix2
-rw-r--r--pkgs/applications/misc/opentrack/default.nix2
-rw-r--r--pkgs/applications/misc/osm2xmap/default.nix2
-rw-r--r--pkgs/applications/misc/prusa-slicer/default.nix2
-rw-r--r--pkgs/applications/misc/pw-viz/default.nix2
-rw-r--r--pkgs/applications/misc/qlcplus/default.nix2
-rw-r--r--pkgs/applications/misc/sdcv/default.nix2
-rw-r--r--pkgs/applications/misc/slade/default.nix2
-rw-r--r--pkgs/applications/misc/slade/git.nix2
-rw-r--r--pkgs/applications/misc/syncthingtray/default.nix2
-rw-r--r--pkgs/applications/misc/synergy/default.nix2
-rw-r--r--pkgs/applications/misc/tilemaker/default.nix2
-rw-r--r--pkgs/applications/misc/vp/default.nix2
-rw-r--r--pkgs/applications/misc/xmr-stak/default.nix2
-rw-r--r--pkgs/applications/misc/xsw/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix2
-rw-r--r--pkgs/applications/networking/browsers/dillo/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/dillong/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/ladybird/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/netsurf/libcss.nix2
-rw-r--r--pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix2
-rw-r--r--pkgs/applications/networking/browsers/palemoon/bin.nix11
-rw-r--r--pkgs/applications/networking/browsers/palemoon/default.nix4
-rw-r--r--pkgs/applications/networking/calls/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch41
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix10
-rw-r--r--pkgs/applications/networking/cluster/k3s/1_24/default.nix52
-rw-r--r--pkgs/applications/networking/cluster/kaniko/default.nix53
-rw-r--r--pkgs/applications/networking/freefilesync/default.nix2
-rw-r--r--pkgs/applications/networking/ids/snort/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/baresip/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/fractal-next/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/tdlib-purple/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/rambox/default.nix4
-rw-r--r--pkgs/applications/networking/irc/bip/default.nix2
-rw-r--r--pkgs/applications/networking/irc/quassel/default.nix2
-rw-r--r--pkgs/applications/networking/irc/weechat/default.nix2
-rw-r--r--pkgs/applications/networking/mumble/default.nix2
-rw-r--r--pkgs/applications/networking/offrss/default.nix2
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix4
-rw-r--r--pkgs/applications/networking/remote/putty/default.nix2
-rw-r--r--pkgs/applications/networking/sniffers/ettercap/default.nix2
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix2
-rw-r--r--pkgs/applications/office/calligra/default.nix2
-rw-r--r--pkgs/applications/office/gnucash/default.nix4
-rw-r--r--pkgs/applications/office/kmymoney/default.nix2
-rw-r--r--pkgs/applications/office/libreoffice/default.nix2
-rw-r--r--pkgs/applications/office/mmex/default.nix2
-rw-r--r--pkgs/applications/office/teapot/default.nix2
-rw-r--r--pkgs/applications/office/treesheets/default.nix2
-rw-r--r--pkgs/applications/office/wordgrinder/default.nix2
-rw-r--r--pkgs/applications/radio/dump1090/default.nix2
-rw-r--r--pkgs/applications/radio/freedv/default.nix4
-rw-r--r--pkgs/applications/radio/sdrpp/default.nix2
-rw-r--r--pkgs/applications/radio/soapyremote/default.nix2
-rw-r--r--pkgs/applications/radio/xlog/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/astrolog/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/gildas/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/xplanet/default.nix2
-rw-r--r--pkgs/applications/science/biology/bayescan/default.nix2
-rw-r--r--pkgs/applications/science/biology/cmtk/default.nix2
-rw-r--r--pkgs/applications/science/biology/freebayes/default.nix2
-rw-r--r--pkgs/applications/science/biology/minia/default.nix2
-rw-r--r--pkgs/applications/science/biology/niftyreg/default.nix2
-rw-r--r--pkgs/applications/science/biology/octopus/default.nix2
-rw-r--r--pkgs/applications/science/biology/paml/default.nix2
-rw-r--r--pkgs/applications/science/biology/strelka/default.nix2
-rw-r--r--pkgs/applications/science/biology/svaba/default.nix2
-rw-r--r--pkgs/applications/science/chemistry/avogadro/default.nix2
-rw-r--r--pkgs/applications/science/chemistry/chemtool/default.nix2
-rw-r--r--pkgs/applications/science/chemistry/pymol/default.nix2
-rw-r--r--pkgs/applications/science/computer-architecture/timeloop/default.nix2
-rw-r--r--pkgs/applications/science/electronics/fped/default.nix2
-rw-r--r--pkgs/applications/science/electronics/fritzing/default.nix2
-rw-r--r--pkgs/applications/science/electronics/magic-vlsi/default.nix2
-rw-r--r--pkgs/applications/science/logic/avy/default.nix2
-rw-r--r--pkgs/applications/science/logic/cbmc/default.nix4
-rw-r--r--pkgs/applications/science/logic/klee/default.nix2
-rw-r--r--pkgs/applications/science/logic/satallax/default.nix2
-rw-r--r--pkgs/applications/science/math/calculix/default.nix2
-rw-r--r--pkgs/applications/science/math/cntk/default.nix2
-rw-r--r--pkgs/applications/science/math/eukleides/default.nix2
-rw-r--r--pkgs/applications/science/math/mxnet/default.nix2
-rw-r--r--pkgs/applications/science/math/perseus/default.nix2
-rw-r--r--pkgs/applications/science/misc/fityk/default.nix2
-rw-r--r--pkgs/applications/science/physics/dawncut/default.nix2
-rw-r--r--pkgs/applications/science/physics/xfitter/default.nix2
-rw-r--r--pkgs/applications/search/recoll/default.nix2
-rw-r--r--pkgs/applications/version-management/fnc/default.nix4
-rw-r--r--pkgs/applications/version-management/rapidsvn/default.nix2
-rw-r--r--pkgs/applications/version-management/rcs/default.nix2
-rw-r--r--pkgs/applications/video/aegisub/default.nix2
-rw-r--r--pkgs/applications/video/byzanz/default.nix2
-rw-r--r--pkgs/applications/video/coriander/default.nix2
-rw-r--r--pkgs/applications/video/gnome-mplayer/default.nix2
-rw-r--r--pkgs/applications/video/obs-studio/plugins/looking-glass-obs.nix2
-rw-r--r--pkgs/applications/video/ogmtools/default.nix2
-rw-r--r--pkgs/applications/video/shotcut/default.nix2
-rw-r--r--pkgs/applications/video/vokoscreen/default.nix2
-rw-r--r--pkgs/applications/video/w_scan/default.nix2
-rw-r--r--pkgs/applications/virtualization/OVMF/default.nix2
-rw-r--r--pkgs/applications/virtualization/docker/default.nix2
-rw-r--r--pkgs/applications/virtualization/libgovirt/default.nix2
-rw-r--r--pkgs/applications/virtualization/libnvidia-container/default.nix2
-rw-r--r--pkgs/applications/virtualization/spice-vdagent/default.nix2
-rw-r--r--pkgs/applications/virtualization/tini/default.nix2
-rw-r--r--pkgs/applications/virtualization/virtualbox/guest-additions/default.nix2
-rw-r--r--pkgs/applications/virtualization/xen/4.10.nix2
-rw-r--r--pkgs/applications/window-managers/cardboard/default.nix2
-rw-r--r--pkgs/applications/window-managers/fbpanel/default.nix2
-rw-r--r--pkgs/applications/window-managers/hyprwm/hypr/default.nix2
-rw-r--r--pkgs/applications/window-managers/oroborus/default.nix2
-rw-r--r--pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix2
-rw-r--r--pkgs/applications/window-managers/yeahwm/default.nix2
201 files changed, 312 insertions, 282 deletions
diff --git a/pkgs/applications/audio/aacgain/default.nix b/pkgs/applications/audio/aacgain/default.nix
index 62a72fea62a0a..4d45de86f3a1f 100644
--- a/pkgs/applications/audio/aacgain/default.nix
+++ b/pkgs/applications/audio/aacgain/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     libtool
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   meta = with lib; {
     description = "ReplayGain for AAC files";
diff --git a/pkgs/applications/audio/adlplug/default.nix b/pkgs/applications/audio/adlplug/default.nix
index a0f5b48a63231..a5d82b6e00ddd 100644
--- a/pkgs/applications/audio/adlplug/default.nix
+++ b/pkgs/applications/audio/adlplug/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     "-DADLplug_Jack=${if withJack then "ON" else "OFF"}"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
     # "fp.h" file not found
     "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers"
   ]);
diff --git a/pkgs/applications/audio/aether-lv2/default.nix b/pkgs/applications/audio/aether-lv2/default.nix
index 179c656968ce4..6710aaa87f4e3 100644
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     lv2 libX11 libGL libGLU mesa
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=array-bounds"
     "-Wno-error=stringop-overflow"
diff --git a/pkgs/applications/audio/audio-recorder/default.nix b/pkgs/applications/audio/audio-recorder/default.nix
index bb89cb45672bd..aaf6777533ffd 100644
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # https://bugs.launchpad.net/audio-recorder/+bug/1784622
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
 
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix
index 7fc921e59fbfd..919768d58ed73 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
     CoreAudioKit
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
     # Fails to find fp.h on its own
     "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/CarbonCore.framework/Versions/Current/Headers/"
   ]);
diff --git a/pkgs/applications/audio/bristol/default.nix b/pkgs/applications/audio/bristol/default.nix
index 6099895a0f23f..39227fd065227 100644
--- a/pkgs/applications/audio/bristol/default.nix
+++ b/pkgs/applications/audio/bristol/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation  rec {
   # gcc-10. Otherwise build fails as:
   #  ld: brightonCLI.o:/build/bristol-0.60.11/brighton/brightonCLI.c:139: multiple definition of
   #    `event'; brightonMixerMenu.o:/build/bristol-0.60.11/brighton/brightonMixerMenu.c:1182: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preInstall = ''
     sed -e "s@\`which bristol\`@$out/bin/bristol@g" -i bin/startBristol
diff --git a/pkgs/applications/audio/fire/default.nix b/pkgs/applications/audio/fire/default.nix
index 54d5bba446618..93536944d96dd 100644
--- a/pkgs/applications/audio/fire/default.nix
+++ b/pkgs/applications/audio/fire/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Fails to find fp.h on its own
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/CarbonCore.framework/Versions/Current/Headers/";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/CarbonCore.framework/Versions/Current/Headers/";
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
diff --git a/pkgs/applications/audio/freewheeling/default.nix b/pkgs/applications/audio/freewheeling/default.nix
index 08afe21763e98..531352d0ed949 100644
--- a/pkgs/applications/audio/freewheeling/default.nix
+++ b/pkgs/applications/audio/freewheeling/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       configureFlags = oldAttrs.configureFlags ++ [ "--enable-openssl-compatibility" ];
     }))
   ];
-  NIX_CFLAGS_COMPILE = toString
+  env.NIX_CFLAGS_COMPILE = toString
     (makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ]);
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index f0bb039a79c4a..e0298d8f9365b 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -63,11 +63,11 @@ stdenv.mkDerivation rec {
     "-DWARNINGS_ARE_ERRORS=ON"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or aarch64 (old gcc)
     "-Wno-error=mismatched-new-delete"
     "-Wno-error=use-after-free"
-  ];
+  ]);
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
diff --git a/pkgs/applications/audio/giada/default.nix b/pkgs/applications/audio/giada/default.nix
index 15eccc46943fa..c5dcec05a9d1d 100644
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-w"
     "-Wno-error"
   ];
diff --git a/pkgs/applications/audio/gnaural/default.nix b/pkgs/applications/audio/gnaural/default.nix
index 42b28eacc4f46..e7753ef28e6b3 100644
--- a/pkgs/applications/audio/gnaural/default.nix
+++ b/pkgs/applications/audio/gnaural/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: src/net/../gnauralnet.h:233: multiple definition of `GN_ScheduleFingerprint';
   #     src/net/../../src/gnauralnet.h:233: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postInstall = ''
     mkdir -p $out/share/applications
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 0bbe0b1f0da54..f988e5cd1d420 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "-DINSTALL_DEPEND=OFF"
   ] ++ lib.optional (!includeDemo) "-DINSTALL_DEMO=OFF";
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/{Applications,bin,lib}
diff --git a/pkgs/applications/audio/gtkpod/default.nix b/pkgs/applications/audio/gtkpod/default.nix
index 220d2d38e145d..a16ad3c932017 100644
--- a/pkgs/applications/audio/gtkpod/default.nix
+++ b/pkgs/applications/audio/gtkpod/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: .libs/autodetection.o:/build/gtkpod-2.1.5/libgtkpod/gtkpod_app_iface.h:248: multiple definition of
   #       `gtkpod_app'; .libs/gtkpod_app_iface.o:/build/gtkpod-2.1.5/libgtkpod/gtkpod_app_iface.h:248: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index 870f4b216f51f..3033888996a19 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     "--install-roboto-font"
   ] ++ optional optimizationSupport "--optimization";
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
   meta = with lib; {
     description = "A virtual guitar amplifier for Linux running with JACK";
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index f4a5e58c5e11b..e130d9a642d42 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #     ld: jamin-preferences.o:/build/jamin-0.95.0/src/hdeq.h:64: multiple definition of
   #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
diff --git a/pkgs/applications/audio/klystrack/default.nix b/pkgs/applications/audio/klystrack/default.nix
index 362c76a0d4dec..9ea5f40be14bb 100644
--- a/pkgs/applications/audio/klystrack/default.nix
+++ b/pkgs/applications/audio/klystrack/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   #   ld: libengine_gui.a(gui_menu.o):(.bss+0x0): multiple definition of
   #     `menu_t'; objs.release/action.o:(.bss+0x20): first defined here
   # TODO: remove it for 1.7.7+ release as it was fixed upstream.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildFlags = [ "PREFIX=${placeholder "out"}" "CFG=release" ];
 
diff --git a/pkgs/applications/audio/littlegptracker/default.nix b/pkgs/applications/audio/littlegptracker/default.nix
index abeaa7dff4270..846936e65f6a7 100644
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux  [ "PLATFORM=DEB" ]
     ++ lib.optionals stdenv.isDarwin [ "PLATFORM=OSX" ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ] ++
-    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-fpermissive" ] ++
+    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing");
 
   NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework Foundation";
 
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index 4e4612ef922cb..c3d8671b26dd1 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
+  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
 
   configurePhase = ''
     make config PREFIX=${placeholder "out"}
diff --git a/pkgs/applications/audio/mi2ly/default.nix b/pkgs/applications/audio/mi2ly/default.nix
index 9a046a2e11aac..2ba12575543c1 100644
--- a/pkgs/applications/audio/mi2ly/default.nix
+++ b/pkgs/applications/audio/mi2ly/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = [ "-fgnu89-inline" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fgnu89-inline" ];
 
   buildPhase = "./cc";
   installPhase = ''
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index 47e043f5d4673..2819e288ec115 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     pcre2
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=free-nonheap-object"
   ];
diff --git a/pkgs/applications/audio/mp3blaster/default.nix b/pkgs/applications/audio/mp3blaster/default.nix
index 0d65fe813ec19..8d4a63f3b9ef1 100644
--- a/pkgs/applications/audio/mp3blaster/default.nix
+++ b/pkgs/applications/audio/mp3blaster/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     libvorbis
   ] ++ lib.optional stdenv.isDarwin SDL;
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-narrowing"
   ] ++ lib.optionals stdenv.cc.isClang [
     "-Wno-reserved-user-defined-literal"
diff --git a/pkgs/applications/audio/mpc123/default.nix b/pkgs/applications/audio/mpc123/default.nix
index 9a693c0eaa39f..7746d1c63fa83 100644
--- a/pkgs/applications/audio/mpc123/default.nix
+++ b/pkgs/applications/audio/mpc123/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: /build/cc566Cj9.o:(.bss+0x0): multiple definition of `mpc123_file_reader'; ao.o:(.bss+0x40): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   buildInputs = [ gettext libmpcdec libao ];
 
diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index 4a73ddf03c877..e00b6722f38d6 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: volume.o:/build/mpg321-0.3.2-orig/mpg321.h:119: multiple definition of
   #     `loop_remaining'; mpg321.o:/build/mpg321-0.3.2-orig/mpg321.h:119: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   configureFlags =
     [ ("--enable-alsa=" + (if stdenv.isLinux then "yes" else "no")) ]
diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
index 065c943764ea1..5663070d7dfeb 100644
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     libsamplerate libsndfile lilv lrdf lv2 qtsvg rtaudio rubberband sord
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${lib.getDev serd}/include/serd-0" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${lib.getDev serd}/include/serd-0" ];
 
   meta = with lib; {
     homepage = "https://muse-sequencer.github.io/";
diff --git a/pkgs/applications/audio/oxefmsynth/default.nix b/pkgs/applications/audio/oxefmsynth/default.nix
index 59ed1ce21f5f6..81cdc29be7a49 100644
--- a/pkgs/applications/audio/oxefmsynth/default.nix
+++ b/pkgs/applications/audio/oxefmsynth/default.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1rk71ls33a38wx8i22plsi7d89cqqxrfxknq5i4f9igsw1ipm4gn";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-narrowing" ];
 
   buildFlags = [ "VSTSDK_PATH=${vst-sdk}/VST2_SDK" ];
 
diff --git a/pkgs/applications/audio/picoloop/default.nix b/pkgs/applications/audio/picoloop/default.nix
index bd956963a4682..8f11ec809c3a4 100644
--- a/pkgs/applications/audio/picoloop/default.nix
+++ b/pkgs/applications/audio/picoloop/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "-f Makefile.PatternPlayer_debian_RtAudio_sdl20" ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${SDL2.dev}/include/SDL2" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${SDL2.dev}/include/SDL2" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/audio/pragha/default.nix b/pkgs/applications/audio/pragha/default.nix
index da5a64f708eb0..8e039f05927f5 100644
--- a/pkgs/applications/audio/pragha/default.nix
+++ b/pkgs/applications/audio/pragha/default.nix
@@ -83,7 +83,7 @@ mkDerivation rec {
 
   CFLAGS = [ "-DHAVE_PARANOIA_NEW_INCLUDES" ];
 
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/applications/audio/sayonara/default.nix b/pkgs/applications/audio/sayonara/default.nix
index d578a4f307840..e7efb7896be7c 100644
--- a/pkgs/applications/audio/sayonara/default.nix
+++ b/pkgs/applications/audio/sayonara/default.nix
@@ -56,7 +56,7 @@ mkDerivation rec {
   ];
 
   # gstreamer cannot otherwise be found
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/applications/audio/soundscape-renderer/default.nix b/pkgs/applications/audio/soundscape-renderer/default.nix
index 3ec2cda4280be..7a6399ff3c666 100644
--- a/pkgs/applications/audio/soundscape-renderer/default.nix
+++ b/pkgs/applications/audio/soundscape-renderer/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   # Without it doesn't find all of the boost libraries.
   BOOST_LIB_DIR = "${boost}/lib";
   # uses the deprecated get_generic_category() in boost_system
-  NIX_CFLAGS_COMPILE = "-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
+  env.NIX_CFLAGS_COMPILE = "-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
 
   LC_ALL = "en_US.UTF-8";
 
diff --git a/pkgs/applications/audio/tenacity/default.nix b/pkgs/applications/audio/tenacity/default.nix
index 525a743965c27..c27e3864d27f7 100644
--- a/pkgs/applications/audio/tenacity/default.nix
+++ b/pkgs/applications/audio/tenacity/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
       --prefix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = "-D GIT_DESCRIBE=\"\"";
+  env.NIX_CFLAGS_COMPILE = "-D GIT_DESCRIBE=\"\"";
 
   # tenacity only looks for ffmpeg at runtime, so we need to link it in manually
   NIX_LDFLAGS = toString [
diff --git a/pkgs/applications/audio/transcode/default.nix b/pkgs/applications/audio/transcode/default.nix
index da149db075379..55883a4f70e95 100644
--- a/pkgs/applications/audio/transcode/default.nix
+++ b/pkgs/applications/audio/transcode/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: tcextract-extract_pcm.o:/build/transcode-1.1.7/import/extract_pcm.c:36: multiple definition of
   #     `audio'; tcextract-extract_ac3.o:/build/transcode-1.1.7/import/extract_ac3.c:337: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     description = "Suite of command line utilities for transcoding video and audio codecs, and for converting between different container formats";
diff --git a/pkgs/applications/audio/ympd/default.nix b/pkgs/applications/audio/ympd/default.nix
index 218204d690a16..83ce36a595816 100644
--- a/pkgs/applications/audio/ympd/default.nix
+++ b/pkgs/applications/audio/ympd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   #   ld: CMakeFiles/ympd.dir/src/mpd_client.c.o:(.bss+0x0): multiple definition of `mpd';
   #     CMakeFiles/ympd.dir/src/ympd.c.o:(.bss+0x20): first defined here
   # Should be fixed by pending https://github.com/notandy/ympd/pull/191 (does not apply as is).
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libmpdclient openssl ];
diff --git a/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix b/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix
index 797b4624b966e..f490e452b51c0 100644
--- a/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/mruby-zest/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   # Force optimization to fix:
   # warning: #warning _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   # Remove pre-built y.tab.c to generate with nixpkgs bison
   preBuild = ''
diff --git a/pkgs/applications/blockchains/cgminer/default.nix b/pkgs/applications/blockchains/cgminer/default.nix
index 48a8d3ad93022..7d2dbe9208582 100644
--- a/pkgs/applications/blockchains/cgminer/default.nix
+++ b/pkgs/applications/blockchains/cgminer/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   #   ld: cgminer-driver-modminer.o:/build/source/miner.h:285:
   #     multiple definition of `bitforce_drv'; cgminer-cgminer.o:/build/source/miner.h:285:
   #     first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     description = "CPU/GPU miner in c for bitcoin";
diff --git a/pkgs/applications/display-managers/greetd/gtkgreet.nix b/pkgs/applications/display-managers/greetd/gtkgreet.nix
index e0ebbb3bc4c26..77ddda9337102 100644
--- a/pkgs/applications/display-managers/greetd/gtkgreet.nix
+++ b/pkgs/applications/display-managers/greetd/gtkgreet.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
 
   # G_APPLICATION_FLAGS_NONE is deprecated in GLib 2.73.3+.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   meta = with lib; {
     description = "GTK based greeter for greetd, to be run under cage or similar";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 6ce924adf11c6..172f54bcd2a03 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -266,7 +266,7 @@ let
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [ ] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
           preConfigure = ''
             cd server
           '';
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index 573b8cdfee9ec..e0b7bc9524fd0 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   passthru.updateScript = gnome.updateScript {
     packageName = pname;
diff --git a/pkgs/applications/editors/hexcurse/default.nix b/pkgs/applications/editors/hexcurse/default.nix
index 9adce387f4077..715693770c550 100644
--- a/pkgs/applications/editors/hexcurse/default.nix
+++ b/pkgs/applications/editors/hexcurse/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "17ckkxfzbqvvfdnh10if4aqdcq98q3vl6dn1v6f4lhr4ifnyjdlk";
   };
   buildInputs = [ ncurses ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-overflow" "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=stringop-overflow" "-Wno-error=stringop-truncation" ];
   patches = [
     # gcc7 compat
     (fetchpatch {
diff --git a/pkgs/applications/editors/ht/default.nix b/pkgs/applications/editors/ht/default.nix
index 0460065fe8759..42b3f1495a317 100644
--- a/pkgs/applications/editors/ht/default.nix
+++ b/pkgs/applications/editors/ht/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc7.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-narrowing" ];
 
   meta = with lib; {
     description = "File editor/viewer/analyzer for executables";
diff --git a/pkgs/applications/editors/nedit/default.nix b/pkgs/applications/editors/nedit/default.nix
index b49fbc14fad9c..41c72cc51eaa3 100644
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # the linux config works fine on darwin too!
   buildFlags = lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";
 
-  NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
+  env.NIX_CFLAGS_COMPILE = "-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/texmaker/default.nix b/pkgs/applications/editors/texmaker/default.nix
index 693362f95f688..d4bfdebd6a552 100644
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@@ -11,7 +11,7 @@ mkDerivation rec {
 
   buildInputs = [ qtbase qtscript poppler zlib qtwebengine ];
   nativeBuildInputs = [ pkg-config poppler qmake ];
-  NIX_CFLAGS_COMPILE="-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   qmakeFlags = [
     "DESKTOPDIR=${placeholder "out"}/share/applications"
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index bd03fd2fde472..258d58cac05da 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1348,6 +1348,15 @@ self: super: {
     dependencies = with self; [ vimproc-vim ];
   });
 
+  vim-trailing-whitespace = super.vim-trailing-whitespace.overrideAttrs (old: {
+    patches = [(fetchpatch {
+      # https://github.com/bronson/vim-trailing-whitespace/pull/30
+      name = "fix-add-dynamic-TerminalOpen-for-both-vim-and-nvim.patch";
+      url = "https://github.com/bronson/vim-trailing-whitespace/commit/99ef803ebdc01d62b418a3e9386d5f10797bfac3.patch";
+      hash = "sha256-cyanHUKxhbY8c6EkAbpUq7QcEBQABCwZ6NoEUOpd2F8=";
+    })];
+  });
+
   vim-zettel = super.vim-zettel.overrideAttrs (old: {
     dependencies = with self; [ vimwiki fzf-vim ];
   });
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6746ae4c0bb81..52bf2719e20f3 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2597,8 +2597,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.16.0";
-          sha256 = "sha256-Qr4cYAEvAkvvE6KytVeInJzcMQJZqr/e/KPfelVzjUA=";
+          version = "2.17.1";
+          sha256 = "sha256-gQSAq63fqniHmA9T0nKpUAzo+kpSCZzblr6FQ33LIPI=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/emulators/bsnes/ares/default.nix b/pkgs/applications/emulators/bsnes/ares/default.nix
index 36d2dfe1ff332..9914e6e691c3d 100644
--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-C desktop-ui"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.14";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.14";
 
   meta = with lib; {
     homepage = "https://ares-emu.net";
diff --git a/pkgs/applications/emulators/dosbox-staging/default.nix b/pkgs/applications/emulators/dosbox-staging/default.nix
index f26fb7c9d76c4..baa283d1178e2 100644
--- a/pkgs/applications/emulators/dosbox-staging/default.nix
+++ b/pkgs/applications/emulators/dosbox-staging/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     speexdsp
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${SDL2_image}/include/SDL2"
     "-I${SDL2_net}/include/SDL2"
   ];
diff --git a/pkgs/applications/emulators/gens-gs/default.nix b/pkgs/applications/emulators/gens-gs/default.nix
index 0fbd12fc36511..66c4eb8ada23a 100644
--- a/pkgs/applications/emulators/gens-gs/default.nix
+++ b/pkgs/applications/emulators/gens-gs/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   # Work around build failures on recent GTK.
   # See http://ubuntuforums.org/showthread.php?p=10535837
-  NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
+  env.NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
 
   meta = with lib; {
     homepage = "https://segaretro.org/Gens/GS";
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index aedf42ee126b5..93348862104fb 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -117,7 +117,7 @@ stdenv.mkDerivation rec {
       --subst-var-by mamePath "$out/opt/mame"
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=use-after-free"
   ];
 
diff --git a/pkgs/applications/emulators/np2kai/default.nix b/pkgs/applications/emulators/np2kai/default.nix
index 4e2f01ade369a..4a0ed1d519f9d 100644
--- a/pkgs/applications/emulators/np2kai/default.nix
+++ b/pkgs/applications/emulators/np2kai/default.nix
@@ -157,7 +157,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # TODO Remove when bumping past rev22
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
 
   buildPhase = optionalString enableSDL ''
     cd sdl2
diff --git a/pkgs/applications/emulators/pcsxr/default.nix b/pkgs/applications/emulators/pcsxr/default.nix
index 1c0fba3df1c56..88a058865ead8 100644
--- a/pkgs/applications/emulators/pcsxr/default.nix
+++ b/pkgs/applications/emulators/pcsxr/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: AboutDlg.o:/build/pcsxr/gui/Linux.h:42: multiple definition of `cfgfile';
   #     LnxMain.o:/build/pcsxr/gui/Linux.h:42: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   dynarecTarget =
    if stdenv.isx86_64 then "x86_64"
diff --git a/pkgs/applications/emulators/simh/default.nix b/pkgs/applications/emulators/simh/default.nix
index 6f3409ec0637d..b0cae68ed2180 100644
--- a/pkgs/applications/emulators/simh/default.nix
+++ b/pkgs/applications/emulators/simh/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   # Workaround to build against upstream gcc-10 and clang-11.
   # Can be removed when next release contains
   #    https://github.com/simh/simh/issues/794
-  NIX_CFLAGS_COMPILE = [ "-fcommon" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-fcommon" ];
 
   makeFlags = [ "GCC=${stdenv.cc.targetPrefix}cc" "CC_STD=-std=c99" "LDFLAGS=-lm" ];
 
diff --git a/pkgs/applications/emulators/tilem/default.nix b/pkgs/applications/emulators/tilem/default.nix
index bde706e23040d..c9ba0067ee746 100644
--- a/pkgs/applications/emulators/tilem/default.nix
+++ b/pkgs/applications/emulators/tilem/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib gtk2 libticonv libtifiles2 libticables2 libticalcs2 ];
-  NIX_CFLAGS_COMPILE = [ "-lm" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
   meta = with lib; {
     homepage = "http://lpg.ticalc.org/prj_tilem/";
     description = "Emulator and debugger for Texas Instruments Z80-based graphing calculators";
diff --git a/pkgs/applications/emulators/uae/default.nix b/pkgs/applications/emulators/uae/default.nix
index aeceb0dc6f841..105729f628298 100644
--- a/pkgs/applications/emulators/uae/default.nix
+++ b/pkgs/applications/emulators/uae/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: bsdsocket.o:(.bss+0x0): multiple definition of
   #     `socketbases'; main.o:(.bss+0x2792c0): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
   LDFLAGS = [ "-lm" ];
 
   meta = {
diff --git a/pkgs/applications/emulators/zsnes/2.x.nix b/pkgs/applications/emulators/zsnes/2.x.nix
index fdb4ad9fa139b..c11edd325d33e 100644
--- a/pkgs/applications/emulators/zsnes/2.x.nix
+++ b/pkgs/applications/emulators/zsnes/2.x.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontConfigure = true;
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Until upstream fixes the issues...
     "-Wp,-D_FORTIFY_SOURCE=0"
   ];
diff --git a/pkgs/applications/emulators/zsnes/default.nix b/pkgs/applications/emulators/zsnes/default.nix
index b9dd0f77a4ff4..1583777a058f7 100644
--- a/pkgs/applications/emulators/zsnes/default.nix
+++ b/pkgs/applications/emulators/zsnes/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation {
   # Workaround build failure on -fno-common toolchains:
   #   ld: initc.o:(.bss+0x28): multiple definition of `HacksDisable'; cfg.o:(.bss+0x59e3): first defined here
   # Use pre-c++17 standard (c++17 forbids throw annotations)
-  NIX_CFLAGS_COMPILE = "-fcommon -std=c++14";
+  env.NIX_CFLAGS_COMPILE = "-fcommon -std=c++14";
 
   preConfigure = ''
     cd src
diff --git a/pkgs/applications/file-managers/nnn/default.nix b/pkgs/applications/file-managers/nnn/default.nix
index d9ff3b15c798a..befbffb46e74c 100644
--- a/pkgs/applications/file-managers/nnn/default.nix
+++ b/pkgs/applications/file-managers/nnn/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ installShellFiles makeWrapper pkg-config ];
   buildInputs = [ readline ncurses ] ++ lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-I${musl-fts}/include";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-I${musl-fts}/include";
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-lfts";
 
   makeFlags = [ "PREFIX=$(out)" ]
diff --git a/pkgs/applications/file-managers/spacefm/default.nix b/pkgs/applications/file-managers/spacefm/default.nix
index 605340cbc85c0..1cab33edb9449 100644
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   #     `xsets'; vfs/spacefm-vfs-file-info.o:src/settings.h:123: first defined here
   # TODO: can be removed once https://github.com/IgnorantGuru/spacefm/pull/772
   # or equivalent is merged upstream.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   configureFlags = [
     "--with-bash-path=${pkgs.bash}/bin/bash"
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index ca2aa96bea141..5f28236b54ea3 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=array-bounds"
   ];
diff --git a/pkgs/applications/graphics/freepv/default.nix b/pkgs/applications/graphics/freepv/default.nix
index c69c9af184b00..def7e3e9dd867 100644
--- a/pkgs/applications/graphics/freepv/default.nix
+++ b/pkgs/applications/graphics/freepv/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       --replace png_set_gray_1_2_4_to_8 png_set_expand_gray_1_2_4_to_8
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
 
   meta = {
     description = "Open source panorama viewer using GL";
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 3ce6c56d94bb2..8ffc0a0424e5b 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -154,7 +154,7 @@ in stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-DGDK_OSX_BIG_SUR=16";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGDK_OSX_BIG_SUR=16";
 
   # Check if librsvg was built with --disable-pixbuf-loader.
   PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 5f75d2770ac6b..2077fabc35dfe 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -236,7 +236,7 @@ in
     # Workaround build failure on -fno-common toolchains like upstream
     # gcc-10. Otherwise build fails as:
     #   ld: interface.o:(.bss+0xe0): multiple definition of `fimg'; plugin.o:(.bss+0x40): first defined here
-    NIX_CFLAGS_COMPILE = "-fcommon";
+    env.NIX_CFLAGS_COMPILE = "-fcommon";
     NIX_LDFLAGS = "-lm";
     src = fetchurl {
       url = "https://github.com/pixlsus/registry.gimp.org_static/raw/master/registry.gimp.org/files/wavelet-sharpen-0.1.2.tar.gz";
diff --git a/pkgs/applications/graphics/gnuclad/default.nix b/pkgs/applications/graphics/gnuclad/default.nix
index 0ac22106b989c..b90735d850837 100644
--- a/pkgs/applications/graphics/gnuclad/default.nix
+++ b/pkgs/applications/graphics/gnuclad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ka2kscpjff7gflsargv3r9fdaxhkf3nym9mfaln3pnq6q7fwdki";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.cc.isGNU "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=catch-value";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 8f70d9273b7a8..8236af42956d3 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=format-truncation"
   ];
diff --git a/pkgs/applications/graphics/gqview/default.nix b/pkgs/applications/graphics/gqview/default.nix
index 359cfac72dce2..847fa9ea5f686 100644
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
   NIX_LDFLAGS = "-lm";
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/grafx2/default.nix b/pkgs/applications/graphics/grafx2/default.nix
index 48e97e7dbb3b9..db297f70095a8 100644
--- a/pkgs/applications/graphics/grafx2/default.nix
+++ b/pkgs/applications/graphics/grafx2/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ../obj/unix/tiles.o:/build/grafx2/src/global.h:306: multiple definition of
   #     `Main_selector'; ../obj/unix/main.o:/build/grafx2/src/global.h:306: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preInstall = '' mkdir -p "$out" '';
 
diff --git a/pkgs/applications/graphics/hugin/default.nix b/pkgs/applications/graphics/hugin/default.nix
index f4d424b3fc30d..204cfa387dd39 100644
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   # disable installation of the python scripting interface
   cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   postInstall = ''
     for p in $out/bin/*; do
diff --git a/pkgs/applications/graphics/imgcat/default.nix b/pkgs/applications/graphics/imgcat/default.nix
index b904dec085699..5d56dbe86d702 100644
--- a/pkgs/applications/graphics/imgcat/default.nix
+++ b/pkgs/applications/graphics/imgcat/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-EkVE6BgoA1lo4oqlNETTxLILIVvGXspFyXykxpmYk8M=";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with lib; {
     description = "It's like cat, but for images";
diff --git a/pkgs/applications/graphics/jpeg-archive/default.nix b/pkgs/applications/graphics/jpeg-archive/default.nix
index bd4a580cc4621..b8cf63b188743 100644
--- a/pkgs/applications/graphics/jpeg-archive/default.nix
+++ b/pkgs/applications/graphics/jpeg-archive/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   # gcc-10. Otherwise build fails as:
   #   ld: src/util.o:(.bss+0x0): multiple definition of `progname'; /build/ccBZT2Za.o:(.bss+0x20): first defined here
   # https://github.com/danielgtaylor/jpeg-archive/issues/119
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index 86d8de46f9921..4adedcaffe793 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -33,8 +33,8 @@ mkDerivation rec {
     xsimd
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ]
-    ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-I${ilmbase.dev}/include/OpenEXR" ]
+    ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy");
 
   # Krita runs custom python scripts in CMake with custom PYTHONPATH which krita determined in their CMake script.
   # Patch the PYTHONPATH so python scripts can import sip successfully.
diff --git a/pkgs/applications/graphics/luminance-hdr/default.nix b/pkgs/applications/graphics/luminance-hdr/default.nix
index d0cf9af97d214..97d889c285c62 100644
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@@ -15,7 +15,7 @@ mkDerivation rec {
     sha256 = "1izmgjjp8mgyxv57sjjr05z7g7059ykb5wchlcn4wrnnb6aslnvn";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   buildInputs = [
     qtbase qtdeclarative qttools qtwebengine eigen
diff --git a/pkgs/applications/graphics/photoflare/default.nix b/pkgs/applications/graphics/photoflare/default.nix
index c3207eb6c57c2..4e9f33621ffd2 100644
--- a/pkgs/applications/graphics/photoflare/default.nix
+++ b/pkgs/applications/graphics/photoflare/default.nix
@@ -17,7 +17,7 @@ mkDerivation rec {
 
   qmakeFlags = [ "PREFIX=${placeholder "out"}" ];
 
-  NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
+  env.NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
 
   meta = with lib; {
     description = "A cross-platform image editor with a powerful features and a very friendly graphical user interface";
diff --git a/pkgs/applications/kde/print-manager.nix b/pkgs/applications/kde/print-manager.nix
index 2ea662419b17c..5fa200978353c 100644
--- a/pkgs/applications/kde/print-manager.nix
+++ b/pkgs/applications/kde/print-manager.nix
@@ -22,5 +22,5 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   # Fix build with cups deprecations etc.
   # See: https://github.com/NixOS/nixpkgs/issues/73334
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
 }
diff --git a/pkgs/applications/misc/apvlv/default.nix b/pkgs/applications/misc/apvlv/default.nix
index d7dde2a77ff51..78d353ce2a85c 100644
--- a/pkgs/applications/misc/apvlv/default.nix
+++ b/pkgs/applications/misc/apvlv/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n4xiic8lqnv3mqi7wpdv866gyyakax71gffv3n9427rmcld465i";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/bb/default.nix b/pkgs/applications/misc/bb/default.nix
index 94775b97baee7..97bd2a1f21ca1 100644
--- a/pkgs/applications/misc/bb/default.nix
+++ b/pkgs/applications/misc/bb/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   # error: 'regparm' is not valid on this platform
-  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64)
     "-D__STRICT_ANSI__";
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 9bb2a11b7cd78..01374737f585d 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
       "-DOPTIX_ROOT_DIR=${optix}"
     ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
 
   # Since some dependencies are built with gcc 6, we need gcc 6's
   # libstdc++ in our RPATH. Sigh.
diff --git a/pkgs/applications/misc/cataract/build.nix b/pkgs/applications/misc/cataract/build.nix
index 2c369e64b5d23..9576ee2ebc6c7 100644
--- a/pkgs/applications/misc/cataract/build.nix
+++ b/pkgs/applications/misc/cataract/build.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   # avoid build failures like:
   #   ld: stats.o:/build/cataract-675e647/src/stats.h:24: multiple definition of
   #     `stats_images'; cgg.o:/build/cataract-675e647/src/stats.h:24: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     mkdir $out/{bin,share} -p
diff --git a/pkgs/applications/misc/getxbook/default.nix b/pkgs/applications/misc/getxbook/default.nix
index 6ac5f2327f023..dd091563fde34 100644
--- a/pkgs/applications/misc/getxbook/default.nix
+++ b/pkgs/applications/misc/getxbook/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ihwrx4gspj8l7fc8vxch6dpjrw1lvv9z3c19f0wxnmnxhv1cjvs";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString (
+  env.NIX_CFLAGS_COMPILE = builtins.toString (
     [ "-Wno-error=deprecated-declarations" ]
       ++ lib.optionals (!stdenv.cc.isClang) [
         "-Wno-error=format-truncation"
diff --git a/pkgs/applications/misc/gmtp/default.nix b/pkgs/applications/misc/gmtp/default.nix
index 953aad85ae863..a8465538b50ad 100644
--- a/pkgs/applications/misc/gmtp/default.nix
+++ b/pkgs/applications/misc/gmtp/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   #   ld: gmtp-preferences.o:src/main.h:72: multiple definition of
   #     `scrolledwindowMain'; gmtp-about.o:src/main.h:72: first defined here
   # TODO: can be removed when 1.4.0 is released.
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preFixup = ''
     gappsWrapperArgs+=(--add-flags "--datapath $out/share");
diff --git a/pkgs/applications/misc/gpsbabel/default.nix b/pkgs/applications/misc/gpsbabel/default.nix
index 888672b5fa013..60a1e40a614ed 100644
--- a/pkgs/applications/misc/gpsbabel/default.nix
+++ b/pkgs/applications/misc/gpsbabel/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   # Floating point behavior on i686 causes nmea.test failures. Preventing
   # extended precision fixes this problem.
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isi686 "-ffloat-store";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-ffloat-store";
 
   doCheck = true;
 
diff --git a/pkgs/applications/misc/gxneur/default.nix b/pkgs/applications/misc/gxneur/default.nix
index 7c32cec721927..53873af2b07a3 100644
--- a/pkgs/applications/misc/gxneur/default.nix
+++ b/pkgs/applications/misc/gxneur/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index fd37735c64cef..1870c21bed136 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-amedKK9nplLVJTldeabN3/c+g/QesrdH+qx+rba2/4s=";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang [
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index 4348afb0205b8..2e98be7b558dc 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -45,7 +45,7 @@ mkDerivation rec {
     mv $out/lib/klayout $out/bin/
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-parentheses" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-parentheses" ];
 
   dontInstall = true; # Installation already happens as part of "build.sh"
 
diff --git a/pkgs/applications/misc/lsd2dsl/default.nix b/pkgs/applications/misc/lsd2dsl/default.nix
index eceb9308fc0af..b46c6ea2afa3c 100644
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@@ -17,7 +17,7 @@ mkDerivation rec {
 
   buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";
 
   desktopItems = lib.singleton (makeDesktopItem {
     name = "lsd2dsl";
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index e5e0f92ed1da4..4ba4d992835ce 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -140,7 +140,7 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString ([
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
     "-Wno-error=deprecated-declarations"
   ] ++ lib.optionals stdenv.isAarch64 [
@@ -149,7 +149,7 @@ in stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but problematic with some old GCCs
     "-Wno-error=maybe-uninitalized"
-  ];
+  ]);
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/nut/default.nix b/pkgs/applications/misc/nut/default.nix
index 4a3025cec55c4..31adb54ac71fe 100644
--- a/pkgs/applications/misc/nut/default.nix
+++ b/pkgs/applications/misc/nut/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   meta = with lib; {
     description = "Network UPS Tools";
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 357f4fcd87e56..313f61e28ce02 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -117,9 +117,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DOCPN_BUNDLE_DOCS=true" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals (!stdenv.hostPlatform.isx86) [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (!stdenv.hostPlatform.isx86) [
     "-DSQUISH_USE_SSE=0"
-  ];
+  ]);
 
   postInstall = lib.optionals stdenv.isDarwin ''
     mkdir -p $out/Applications
diff --git a/pkgs/applications/misc/opentrack/aruco.nix b/pkgs/applications/misc/opentrack/aruco.nix
index 2c28d0e8d397c..dddbfe78beabe 100644
--- a/pkgs/applications/misc/opentrack/aruco.nix
+++ b/pkgs/applications/misc/opentrack/aruco.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencv4 ];
 
-  NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
+  env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
 
   preInstall = ''
     mkdir -p $out/include/aruco
diff --git a/pkgs/applications/misc/opentrack/default.nix b/pkgs/applications/misc/opentrack/default.nix
index 7be07093cd1d8..b4c455c0ce043 100644
--- a/pkgs/applications/misc/opentrack/default.nix
+++ b/pkgs/applications/misc/opentrack/default.nix
@@ -42,7 +42,7 @@ in
     nativeBuildInputs = [cmake pkg-config ninja copyDesktopItems];
     buildInputs = [qtbase qttools opencv4 procps eigen libXdmcp libevdev aruco];
 
-    NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
+    env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
     dontWrapQtApps = true;
 
     cmakeFlags = [
diff --git a/pkgs/applications/misc/osm2xmap/default.nix b/pkgs/applications/misc/osm2xmap/default.nix
index ef31ed2f033b1..545ea498002a1 100644
--- a/pkgs/applications/misc/osm2xmap/default.nix
+++ b/pkgs/applications/misc/osm2xmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "INSTALL_MANDIR=${placeholder "out"}/share/man/man1"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   buildInputs = [ libroxml proj_7 yaml-cpp_0_3 boost ];
 
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index c0a1e7e0217d2..702a7769200dd 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
   # Disable compiler warnings that clutter the build log.
   # It seems to be a known issue for Eigen:
   # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
-  NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
+  env.NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
 
   # prusa-slicer uses dlopen on `libudev.so` at runtime
   NIX_LDFLAGS = lib.optionalString withSystemd "-ludev";
diff --git a/pkgs/applications/misc/pw-viz/default.nix b/pkgs/applications/misc/pw-viz/default.nix
index f32f60bac1ac2..6d63ccd05eec5 100644
--- a/pkgs/applications/misc/pw-viz/default.nix
+++ b/pkgs/applications/misc/pw-viz/default.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage rec {
 
   # enables pipewire API deprecated in 0.3.64
   # fixes error caused by https://gitlab.freedesktop.org/pipewire/pipewire-rs/-/issues/55
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DPW_ENABLE_DEPRECATED" ];
 
   meta = with lib; {
     description = "A simple and elegant pipewire graph editor ";
diff --git a/pkgs/applications/misc/qlcplus/default.nix b/pkgs/applications/misc/qlcplus/default.nix
index 9096a56a42119..e27f2a0bdcae9 100644
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
 
   qmakeFlags = [ "INSTALLROOT=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/applications/misc/sdcv/default.nix b/pkgs/applications/misc/sdcv/default.nix
index 22356ac1a8dbe..5e2381ccfabc7 100644
--- a/pkgs/applications/misc/sdcv/default.nix
+++ b/pkgs/applications/misc/sdcv/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     mkdir locale
   '';
 
-  NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
+  env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
   meta = with lib; {
     homepage = "https://dushistov.github.io/sdcv/";
diff --git a/pkgs/applications/misc/slade/default.nix b/pkgs/applications/misc/slade/default.nix
index 3682325cafff6..a62812a73d17d 100644
--- a/pkgs/applications/misc/slade/default.nix
+++ b/pkgs/applications/misc/slade/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with lib; {
     description = "Doom editor";
diff --git a/pkgs/applications/misc/slade/git.nix b/pkgs/applications/misc/slade/git.nix
index d336d460d7c57..1df734af5e009 100644
--- a/pkgs/applications/misc/slade/git.nix
+++ b/pkgs/applications/misc/slade/git.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with lib; {
     description = "Doom editor";
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 11273fd14d8ec..5d583181ce65e 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -41,7 +41,7 @@ mkDerivation rec {
     # Hence we use a C definition with NIX_CFLAGS_COMPILE
     ./use-nix-path-in-autostart.patch
   ];
-  NIX_CFLAGS_COMPILE = "-DEXEC_NIX_PATH=\"${placeholder "out"}/bin/syncthingtray\"";
+  env.NIX_CFLAGS_COMPILE = "-DEXEC_NIX_PATH=\"${placeholder "out"}/bin/syncthingtray\"";
 
   buildInputs = [
     qtbase
diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix
index 401d4e00db168..90fbdb87fc899 100644
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Silences many warnings
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-inconsistent-missing-override";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-inconsistent-missing-override";
 
   cmakeFlags = lib.optional (!withGUI) "-DSYNERGY_BUILD_LEGACY_GUI=OFF"
     # NSFilenamesPboardType is deprecated in 10.14+
diff --git a/pkgs/applications/misc/tilemaker/default.nix b/pkgs/applications/misc/tilemaker/default.nix
index dd05604501e99..a158badc8843c 100644
--- a/pkgs/applications/misc/tilemaker/default.nix
+++ b/pkgs/applications/misc/tilemaker/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     "-DPROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc";
 
-  NIX_CFLAGS_COMPILE = [ "-DTM_VERSION=${finalAttrs.version}" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DTM_VERSION=${finalAttrs.version}" ];
 
   postInstall = ''
     installManPage ../docs/man/tilemaker.1
diff --git a/pkgs/applications/misc/vp/default.nix b/pkgs/applications/misc/vp/default.nix
index d133331a0a7b9..5d28029213414 100644
--- a/pkgs/applications/misc/vp/default.nix
+++ b/pkgs/applications/misc/vp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image ];
 
-  NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
 
   meta = with lib; {
     homepage = "https://brlcad.org/~erik/";
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index 5fffac0c7772b..823d17ba3664e 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ilx5mhh91ks7dwvykfyynh53l6vkkignjpwkkss8ss6b2k8gdbj";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   patches = [ (fetchpatch {
     name = "fix-libmicrohttpd-0-9-71.patch";
diff --git a/pkgs/applications/misc/xsw/default.nix b/pkgs/applications/misc/xsw/default.nix
index a664aec45e1f1..5248ed2f60401 100644
--- a/pkgs/applications/misc/xsw/default.nix
+++ b/pkgs/applications/misc/xsw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
+  env.NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
 
   patches = [
     ./parse.patch # Fixes compilation error by avoiding redundant definitions.
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b79c69275adfd..0da93d03624fc 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -324,7 +324,7 @@ let
     # Don't spam warnings about unknown warning options. This is useful because
     # our Clang is always older than Chromium's and the build logs have a size
     # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
+    env.NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
       buildCommand = target: ''
diff --git a/pkgs/applications/networking/browsers/dillo/default.nix b/pkgs/applications/networking/browsers/dillo/default.nix
index aff0042ded30e..ab79c1bd8f986 100644
--- a/pkgs/applications/networking/browsers/dillo/default.nix
+++ b/pkgs/applications/networking/browsers/dillo/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
   # Workaround build failure on -fno-common toolchains:
   #   ld: main.o:/build/dillo-3.0.5/dpid/dpid.h:64: multiple definition of `sock_set';
   #     dpid.o:/build/dillo-3.0.5/dpid/dpid.h:64: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   configureFlags = [ "--enable-ssl=yes" ];
 
diff --git a/pkgs/applications/networking/browsers/dillong/default.nix b/pkgs/applications/networking/browsers/dillong/default.nix
index 7fc7cc07121df..41c72fddef4ca 100644
--- a/pkgs/applications/networking/browsers/dillong/default.nix
+++ b/pkgs/applications/networking/browsers/dillong/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
   # Workaround build failure on -fno-common toolchains:
   #   ld: main.o:/build/dillo-3.0.5/dpid/dpid.h:64: multiple definition of `sock_set';
   #     dpid.o:/build/dillo-3.0.5/dpid/dpid.h:64: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     description = "Fork of Dillo, a lightweight web browser";
diff --git a/pkgs/applications/networking/browsers/ladybird/default.nix b/pkgs/applications/networking/browsers/ladybird/default.nix
index 0683b5210cbc8..da5f183867964 100644
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@@ -49,13 +49,13 @@ stdenv.mkDerivation {
     "-DENABLE_UNICODE_DATABASE_DOWNLOAD=false"
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error"
   ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
     # error: use of undeclared identifier 'aligned_alloc'
     "-include mm_malloc.h"
     "-Daligned_alloc=_mm_malloc"
-  ];
+  ]);
 
   # https://github.com/NixOS/nixpkgs/issues/201254
   NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
diff --git a/pkgs/applications/networking/browsers/netsurf/libcss.nix b/pkgs/applications/networking/browsers/netsurf/libcss.nix
index 7777bb243fa62..db5a39f22856b 100644
--- a/pkgs/applications/networking/browsers/netsurf/libcss.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libcss.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE= [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
 
   meta = with lib; {
     homepage = "https://www.netsurf-browser.org/projects/${libname}/";
diff --git a/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix b/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
index 318885bd27214..6a2918fa7d950 100644
--- a/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   meta = with lib; {
     homepage = "https://www.netsurf-browser.org/projects/${libname}/";
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index ade66f76e2570..1f650a2fdd589 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -17,14 +17,17 @@
 
 stdenv.mkDerivation rec {
   pname = "palemoon-bin";
-  version = "32.0.0";
+  version = "32.0.1";
 
   src = fetchzip {
-    url = "http://linux.palemoon.org/datastore/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz";
+    urls = [
+      "https://rm-eu.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
+      "https://rm-us.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
+    ];
     hash = if withGTK3 then
-      "sha256-KipzrQEbwd3np3t2oTq2eHHLUPtnC/nnGYMGmFc7arw="
+      "sha256-CSAsZTMIeInuvN7mddiMDtzzNKuYST2zp1XczKAP1mQ="
     else
-      "sha256-dbHGThzLx23Ws0nfGTEYrQp0g+hYwkk1bOczQwt4NYg=";
+      "sha256-bvdy4tqnuoUxVVz/8zp7VwfS3wH51eKCzXDqgDWMb3A=";
   };
 
   preferLocalBuild = true;
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 05e40ae79054e..231a858ef4fcc 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "32.0.0";
+  version = "32.0.1";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-0N63Xo8cRIHwEXkT8eeot0DgZU7aPirmVq/iHJjlGRw=";
+    sha256 = "sha256-lz9Ok8i95pVfl4UHy2zWFe9vwJocUvDbueiWdZuz4Bo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/calls/default.nix b/pkgs/applications/networking/calls/default.nix
index 557754ac50f8b..6475480b2191d 100644
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     xvfb-run
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   mesonFlags = [
     "-Dgtk_doc=true"
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch
deleted file mode 100644
index 115fd6824772b..0000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Thu, 3 Feb 2022 23:50:40 -0800
-Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
-
-The CRD packaging is a complicated set of commands, so let's reuse it.
----
- scripts/download | 10 ++--------
- 1 file changed, 2 insertions(+), 8 deletions(-)
-
-diff --git a/scripts/download b/scripts/download
-index 5effc0562a..82361803ee 100755
---- a/scripts/download
-+++ b/scripts/download
-@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
- mkdir -p ${CHARTS_DIR}
- mkdir -p ${DATA_DIR}
- 
--curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
--
--git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
--
--git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
--
- setup_tmp() {
-     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
-     cleanup() {
-@@ -44,8 +38,8 @@ setup_tmp() {
- 
- download_and_package_traefik () {
-   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
--  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
--  code=$?
-+  # nixpkgs: copy in our known traefik chart instead
-+  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
- 
-   if [ $code -ne 0 ]; then
-     echo "Error: Failed to download Traefik Helm chart!"
--- 
-2.34.1
-
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix
new file mode 100644
index 0000000000000..8c40604d0f1c6
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix
@@ -0,0 +1,10 @@
+{
+    traefik-crd  = {
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-20.3.1+up20.3.0.tgz";
+        sha256 = "1775vjldvqvhzdbzanxhbaqbmkih09yb91im651q8bc7z5sb9ckn";
+    };
+    traefik = {
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-20.3.1+up20.3.0.tgz";
+        sha256 = "1rj0f0n0vgjcbzfwzhqmsd501i2f6vw145w9plbp8gwdyzmg2nc6";
+    };
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/default.nix b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
index 9ebac6b7448ec..2ff642f351115 100644
--- a/pkgs/applications/networking/cluster/k3s/1_24/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
@@ -47,30 +47,32 @@
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.24.4+k3s1";     # k3s git tag
-  k3sCommit = "c3f830e9b9ed8a4d9d0e2aa663b4591b923a296e"; # k3s git commit at the above version
-  k3sRepoSha256 = "00ns6n7jxnacah8ahndhgdb160prgsqhswbb5809kkgvig7k8b27";
-  k3sVendorSha256 = "sha256-ReZvJCgxqffG2H39JlynGPUBSV5ngPkRtAoZ++OQZZI=";
+  k3sVersion = "1.24.10+k3s1";     # k3s git tag
+  k3sCommit = "546a94e9ae1c3be6f9c0dcde32a6e6672b035bc8"; # k3s git commit at the above version
+  k3sRepoSha256 = "sha256-HfkGb3GtR2wQkVIze26aFh6A6W0fegr8ovpSel7oujQ=";
+  k3sVendorSha256 = "sha256-YAerisDr/knlKPaO2fVMZA4FUpwshFmkpi3mJAmLqKM=";
 
-  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
-  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
-  traefikChartVersion = "10.19.3";
-  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+  # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/download#L29-L32
+  # see also https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/manifests/traefik.yaml#L8-L16
+  # At the time of writing, there are two traefik charts, and that's it
+  charts = import ./chart-versions.nix;
 
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
-  k3sRootVersion = "0.11.0";
-  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L56
+  k3sRootVersion = "0.12.1";
+  k3sRootSha256 = "sha256-xCXbarWztnvW2xn3cGa84hie3OevVZeGEDWh+Uf3RBw=";
 
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L49
   k3sCNIVersion = "1.1.1-k3s1";
   k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
 
   # taken from go.mod, the 'github.com/containerd/containerd' line
   # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.13-k3s1";
-  containerdSha256 = "09bj4ghwbsj9whkv1d5icqs52k64m449j8b73dmak2wz62fbzbvp";
+  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L10
+  containerdVersion = "1.5.16-k3s1";
+  containerdSha256 = "sha256-dxC44qE1A20Hd2j77Ir9Sla8xncttswWIuGGM/5FWi8=";
 
   # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L18
   criCtlVersion = "1.24.0-k3s1";
 
   baseMeta = k3s.meta;
@@ -93,10 +95,9 @@ let
   ];
 
   # bundled into the k3s binary
-  traefikChart = fetchurl {
-    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
-    sha256 = traefikChartSha256;
-  };
+  traefikChart = fetchurl charts.traefik;
+  traefik-crdChart = fetchurl charts.traefik-crd;
+
   # so, k3s is a complicated thing to package
   # This derivation attempts to avoid including any random binaries from the
   # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
@@ -180,12 +181,13 @@ let
     postInstall = ''
       mv $out/bin/server $out/bin/k3s
       pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/build#L123-L131
       ln -s k3s ./bin/k3s-agent
       ln -s k3s ./bin/k3s-server
       ln -s k3s ./bin/k3s-etcd-snapshot
       ln -s k3s ./bin/k3s-secrets-encrypt
       ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/k3s-completion
       ln -s k3s ./bin/kubectl
       ln -s k3s ./bin/crictl
       ln -s k3s ./bin/ctr
@@ -218,10 +220,6 @@ buildGoModule rec {
   src = k3sRepo;
   vendorSha256 = k3sVendorSha256;
 
-  patches = [
-    ./0001-script-download-strip-downloading-just-package-CRD.patch
-  ];
-
   postPatch = ''
     # Nix prefers dynamically linked binaries over static binary.
 
@@ -290,11 +288,9 @@ buildGoModule rec {
     ln -vsf ${k3sContainerd}/bin/* ./bin/
     rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
     mkdir -p ./build/static/charts
-    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
-    export TRAEFIK_CHART_FILE=${traefikChart}
-    # place the traefik chart using their code since it's complicated
-    # We trim the actual download, see patches
-    ./scripts/download
+
+    cp ${traefikChart} ./build/static/charts
+    cp ${traefik-crdChart} ./build/static/charts
 
     export ARCH=$GOARCH
     export DRONE_TAG="v${k3sVersion}"
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
new file mode 100644
index 0000000000000..ace2d3dee3554
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -0,0 +1,53 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, buildGoModule
+, installShellFiles
+, testers
+, kaniko
+}:
+
+buildGoModule rec {
+  pname = "kaniko";
+  version = "1.9.1";
+
+  src = fetchFromGitHub {
+    owner = "GoogleContainerTools";
+    repo = "kaniko";
+    rev = "v${version}";
+    hash = "sha256-sPICsDgkijQ7PyeTWQgT553toc4/rWPPo7SY3ptX82U=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/GoogleContainerTools/kaniko/pkg/version.version=${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doCheck = false; # requires docker, container-diff (unpackaged yet)
+
+  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+    for shell in bash fish zsh; do
+      $out/bin/executor completion $shell > executor.$shell
+      installShellCompletion executor.$shell
+    done
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = kaniko;
+    version = version;
+    command = "${kaniko}/bin/executor version";
+  };
+
+  meta = {
+    description = "A tool to build container images from a Dockerfile, inside a container or Kubernetes cluster";
+    homepage = "https://github.com/GoogleContainerTools/kaniko";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.superherointj ];
+    mainProgram = "executor";
+  };
+}
diff --git a/pkgs/applications/networking/freefilesync/default.nix b/pkgs/applications/networking/freefilesync/default.nix
index 49bc342724e0d..dab4de6f2fe58 100644
--- a/pkgs/applications/networking/freefilesync/default.nix
+++ b/pkgs/applications/networking/freefilesync/default.nix
@@ -57,7 +57,7 @@ gcc12Stdenv.mkDerivation rec {
     wxGTK32
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Undef g_object_ref on GLib 2.56+
     "-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_54"
     "-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_54"
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index f83a0757b26bd..9a6dd217e5de7 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkg-config ];
   buildInputs = [ luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index f9756594c5cce..d0fe18e1538ae 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${stdenv.cc.libc}"
   ;
 
-  NIX_CFLAGS_COMPILE = '' -I${librem}/include/rem -I${gsm}/include/gsm
+  env.NIX_CFLAGS_COMPILE = '' -I${librem}/include/rem -I${gsm}/include/gsm
     -DHAVE_INTTYPES_H -D__GLIBC__
     -D__need_timeval -D__need_timespec -D__need_time_t '';
 
diff --git a/pkgs/applications/networking/instant-messengers/fractal-next/default.nix b/pkgs/applications/networking/instant-messengers/fractal-next/default.nix
index 9203850b63882..360234ba3c699 100644
--- a/pkgs/applications/networking/instant-messengers/fractal-next/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal-next/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
 
   # enables pipewire API deprecated in 0.3.64
   # fixes error caused by https://gitlab.freedesktop.org/pipewire/pipewire-rs/-/issues/55
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DPW_ENABLE_DEPRECATED" ];
 
   meta = with lib; {
     description = "Matrix group messaging app (development version)";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
index 9845491f235de..0b51d172b7462 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gjm0z4wa5vi9x1xk43rany5pffrwg958n180ahdj9a7sa8a4hpm";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     # glib-2.62 deprecations
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
     # override "-O0 -Werror" set by build system
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tdlib-purple/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tdlib-purple/default.nix
index 36a5a0a7c90a2..1a1fd3b409a66 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tdlib-purple/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tdlib-purple/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DNoVoip=True" ]; # libtgvoip required
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ "-U__ARM_NEON__" ];
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ "-U__ARM_NEON__" ]);
 
   meta = with lib; {
     homepage = "https://github.com/ars3niy/tdlib-purple";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 2023997aa8116..d3700a66be789 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -18,7 +18,7 @@ let unwrapped = stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper intltool ];
 
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   buildInputs = let
     python-with-dbus = python3.withPackages (pp: with pp; [ dbus-python ]);
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 04c2fa27e5590..8f7c42de8abbe 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "rambox";
-  version = "2.0.10";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-NvsrWkdINrQV7V9SLfjtlN+obgQb0u8d/QgjGpZ+fpc=";
+    sha256 = "sha256-MQBDX4gCpEERdgimAAhKvnN76L1ckpsfWIHZqIsSJOE=";
   };
 
   desktopItem = (makeDesktopItem {
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index c144b4bf58531..f6341a4d74470 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
 
   meta = {
     description = "An IRC proxy (bouncer)";
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index 4bc930b12d0af..02927d870c90c 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -43,7 +43,7 @@ in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   };
 
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
-  NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ qtbase boost zlib ]
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 478b28190ae69..ad460fe6c7782 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -65,7 +65,7 @@ let
         ++ concatMap (p: p.buildInputs) enabledPlugins
         ++ extraBuildInputs;
 
-      NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
+      env.NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
         # Fix '_res_9_init: undefined symbol' error
         + (lib.optionalString stdenv.isDarwin "-DBIND_8_COMPAT=1 -lresolv");
 
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 6a705959a11e4..c9b6ac807a050 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -71,7 +71,7 @@ let
       ++ lib.optional (!pipewireSupport) "-D pipewire=OFF"
       ++ lib.optional jackSupport "-D alsa=OFF -D jackaudio=ON";
 
-    NIX_CFLAGS_COMPILE = lib.optional speechdSupport "-I${speechd}/include/speech-dispatcher";
+    env.NIX_CFLAGS_COMPILE = lib.optionalString speechdSupport "-I${speechd}/include/speech-dispatcher";
 
     postFixup = ''
       wrapProgram $out/bin/mumble \
diff --git a/pkgs/applications/networking/offrss/default.nix b/pkgs/applications/networking/offrss/default.nix
index cad7339fe081f..773ec444edf92 100644
--- a/pkgs/applications/networking/offrss/default.nix
+++ b/pkgs/applications/networking/offrss/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: serve_pdf.o:offrss.h:75: multiple definition of `cgi_url_path';
   #     offrss.o:offrss.h:75: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   configurePhase = ''
     substituteInPlace Makefile \
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index 840cd97cda277..dd1842e7d4773 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -175,11 +175,11 @@ stdenv.mkDerivation rec {
     WITH_X11 = true;
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
     "-include AudioToolbox/AudioToolbox.h"
-  ];
+  ]);
 
   NIX_LDFLAGS = lib.optionals stdenv.isDarwin [
     "-framework AudioToolbox"
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index 6249cce973ef5..4d8c1ee9dc40e 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isUnix ''
     perl mkfiles.pl
diff --git a/pkgs/applications/networking/sniffers/ettercap/default.nix b/pkgs/applications/networking/sniffers/ettercap/default.nix
index a3c79fd9560b7..a51f88ad5f7e8 100644
--- a/pkgs/applications/networking/sniffers/ettercap/default.nix
+++ b/pkgs/applications/networking/sniffers/ettercap/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   ];
 
   # TODO: Remove after the next release (0.8.4 should work without this):
-  NIX_CFLAGS_COMPILE = [ "-I${harfbuzz.dev}/include/harfbuzz" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${harfbuzz.dev}/include/harfbuzz" ];
 
   meta = with lib; {
     description = "Comprehensive suite for man in the middle attacks";
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 1dabe93728c09..47687bb544c26 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -34,7 +34,7 @@ in stdenv.mkDerivation {
   ];
 
   # Avoid referencing -dev paths because of debug assertions.
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DQT_NO_DEBUG" ];
 
   nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config python3 perl ]
     ++ lib.optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
diff --git a/pkgs/applications/office/calligra/default.nix b/pkgs/applications/office/calligra/default.nix
index 57b23ea95d164..302419fdcefcf 100644
--- a/pkgs/applications/office/calligra/default.nix
+++ b/pkgs/applications/office/calligra/default.nix
@@ -69,7 +69,7 @@ mkDerivation rec {
 
   propagatedUserEnvPkgs = [ kproperty ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   qtWrapperArgs = [
     "--prefix PATH : ${lib.getBin pstoedit}/bin"
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index f9e9ec57704c3..65a2d579d3f7b 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -80,10 +80,10 @@ stdenv.mkDerivation rec {
   # guile warning
   GUILE_AUTO_COMPILE="0";
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
     "-Wno-error=use-after-free"
-  ];
+  ]);
 
   # `make check` target does not define its prerequisites but expects them to
   # have already been built.  The list of targets below was built through trial
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index dfab08ace2d90..3b39f88add753 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Hidden dependency that wasn't included in CMakeLists.txt:
-  NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
+  env.NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
 
   nativeBuildInputs = [
     doxygen extra-cmake-modules graphviz kdoctools
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 6590e62557706..8fa7d6d78a74a 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -176,7 +176,7 @@ in
 
   outputs = [ "out" "dev" ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${librdf_rasqal}/include/rasqal" # librdf_redland refers to rasqal.h instead of rasqal/rasqal.h
     "-fno-visibility-inlines-hidden" # https://bugs.documentfoundation.org/show_bug.cgi?id=78174#c10
   ];
diff --git a/pkgs/applications/office/mmex/default.nix b/pkgs/applications/office/mmex/default.nix
index b84502170bf13..4846279569f46 100644
--- a/pkgs/applications/office/mmex/default.nix
+++ b/pkgs/applications/office/mmex/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     libobjc
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
     "-Wno-old-style-cast"
   ]);
 
diff --git a/pkgs/applications/office/teapot/default.nix b/pkgs/applications/office/teapot/default.nix
index d2d44511bc63f..209fa7c4556b8 100644
--- a/pkgs/applications/office/teapot/default.nix
+++ b/pkgs/applications/office/teapot/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   # By no known reason libtirpc is not detected
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-ltirpc" ];
 
   cmakeConfigureFlags = [
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 4ddbd42259d1d..6b318e7a7d627 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     Cocoa
   ];
 
-  NIX_CFLAGS_COMPILE = "-DPACKAGE_VERSION=\"${builtins.replaceStrings [ "unstable-" ] [ "" ] version}\"";
+  env.NIX_CFLAGS_COMPILE = "-DPACKAGE_VERSION=\"${builtins.replaceStrings [ "unstable-" ] [ "" ] version}\"";
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     shopt -s extglob
diff --git a/pkgs/applications/office/wordgrinder/default.nix b/pkgs/applications/office/wordgrinder/default.nix
index 0b086160e50ce..3647d8ea8e22f 100644
--- a/pkgs/applications/office/wordgrinder/default.nix
+++ b/pkgs/applications/office/wordgrinder/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   # To be able to find <Xft.h>
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
 
   # Binaries look for LuaFileSystem library (lfs.so) at runtime
   postInstall = ''
diff --git a/pkgs/applications/radio/dump1090/default.nix b/pkgs/applications/radio/dump1090/default.nix
index a67b48c840be1..defed4dc431ac 100644
--- a/pkgs/applications/radio/dump1090/default.nix
+++ b/pkgs/applications/radio/dump1090/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     hackrf
   ] ++ lib.optional stdenv.isLinux limesuite;
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-implicit-function-declaration -Wno-int-conversion";
 
   buildFlags = [ "dump1090" "view1090" ];
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index 06cb2776a0b34..605a916c6b4da 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -69,9 +69,9 @@ stdenv.mkDerivation rec {
     "-DUNITTEST=ON"
   ] ++ lib.optionals pulseSupport [ "-DUSE_PULSEAUDIO:BOOL=TRUE" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     "-DAPPLE_OLD_XCODE"
-  ];
+  ]);
 
   doCheck = true;
 
diff --git a/pkgs/applications/radio/sdrpp/default.nix b/pkgs/applications/radio/sdrpp/default.nix
index f2bb7920ea43d..b539426d96763 100644
--- a/pkgs/applications/radio/sdrpp/default.nix
+++ b/pkgs/applications/radio/sdrpp/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     OPT_BUILD_RIGCTL_SERVER = rigctl_server;
   };
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   hardeningDisable = lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/radio/soapyremote/default.nix b/pkgs/applications/radio/soapyremote/default.nix
index 95f429aef43e0..ebb34b0a0ce55 100644
--- a/pkgs/applications/radio/soapyremote/default.nix
+++ b/pkgs/applications/radio/soapyremote/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-include sys/select.h" ];
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [ "-include sys/select.h" ]);
 
   meta = with lib; {
     homepage = "https://github.com/pothosware/SoapyRemote";
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index d47bd418f513d..fe2b915e93adc 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib gtk2 hamlib ];
diff --git a/pkgs/applications/science/astronomy/astrolog/default.nix b/pkgs/applications/science/astronomy/astrolog/default.nix
index 26d0639ae67f2..743a58e9e053d 100644
--- a/pkgs/applications/science/astronomy/astrolog/default.nix
+++ b/pkgs/applications/science/astronomy/astrolog/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ xorg.libX11 ];
-  NIX_CFLAGS_COMPILE = "-Wno-format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-security";
 
   installPhase =
   let
diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
index 50eee7d3aa3f7..64e3f8713b2f8 100644
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./wrapper.patch ./clang.patch ./aarch64.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");
 
diff --git a/pkgs/applications/science/astronomy/xplanet/default.nix b/pkgs/applications/science/astronomy/xplanet/default.nix
index d284171831b87..94aa92a1b713f 100644
--- a/pkgs/applications/science/astronomy/xplanet/default.nix
+++ b/pkgs/applications/science/astronomy/xplanet/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with lib; {
     description = "Renders an image of the earth or other planets into the X root window";
diff --git a/pkgs/applications/science/biology/bayescan/default.nix b/pkgs/applications/science/biology/bayescan/default.nix
index cd5bb3210364e..e715ff4b45b06 100644
--- a/pkgs/applications/science/biology/bayescan/default.nix
+++ b/pkgs/applications/science/biology/bayescan/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     cp -r ../*pdf ../input_examples ../"R functions" $out/share/doc/bayescan
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   meta = with lib; {
     description = "Detecting natural selection from population-based genetic data";
diff --git a/pkgs/applications/science/biology/cmtk/default.nix b/pkgs/applications/science/biology/cmtk/default.nix
index 42ce5f934e826..3eef648372555 100644
--- a/pkgs/applications/science/biology/cmtk/default.nix
+++ b/pkgs/applications/science/biology/cmtk/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-std=c++11"
     (lib.optional stdenv.cc.isClang "-Wno-error=c++11-narrowing")
   ];
diff --git a/pkgs/applications/science/biology/freebayes/default.nix b/pkgs/applications/science/biology/freebayes/default.nix
index 5c2f09a4faefa..0ceaab4ab46be 100644
--- a/pkgs/applications/science/biology/freebayes/default.nix
+++ b/pkgs/applications/science/biology/freebayes/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: foomatic_rip-options.o:/build/foomatic-filters-4.0.17/options.c:49: multiple definition of `cupsfilter';
   #     foomatic_rip-foomaticrip.o:/build/foomatic-filters-4.0.17/foomaticrip.c:158: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     install -vD bin/freebayes bin/bamleftalign scripts/* -t $out/bin
diff --git a/pkgs/applications/science/biology/minia/default.nix b/pkgs/applications/science/biology/minia/default.nix
index 6b6bc300e0d9f..023a05d7504f9 100644
--- a/pkgs/applications/science/biology/minia/default.nix
+++ b/pkgs/applications/science/biology/minia/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./no-bundle.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wformat" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wformat" ];
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ hdf5 boost ];
diff --git a/pkgs/applications/science/biology/niftyreg/default.nix b/pkgs/applications/science/biology/niftyreg/default.nix
index d5f625893e925..0be59bcd726a0 100644
--- a/pkgs/applications/science/biology/niftyreg/default.nix
+++ b/pkgs/applications/science/biology/niftyreg/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "07v9v9s41lvw72wpb1jgh2nzanyc994779bd35p76vg8mzifmprl";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=narrowing" ];
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
diff --git a/pkgs/applications/science/biology/octopus/default.nix b/pkgs/applications/science/biology/octopus/default.nix
index b7c8c138cb82b..c2948087d8ed7 100644
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
   }) ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=deprecated-declarations"
   ];
diff --git a/pkgs/applications/science/biology/paml/default.nix b/pkgs/applications/science/biology/paml/default.nix
index 66ba244cacd68..871c76dc6e31b 100644
--- a/pkgs/applications/science/biology/paml/default.nix
+++ b/pkgs/applications/science/biology/paml/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: /build/ccKomtcd.o:(.bss+0x4544): multiple definition of `SeqTypes';
   #     /build/ccx7EsgU.o:(.bss+0x2a0dfdc): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preBuild = ''
     cd ./src/
diff --git a/pkgs/applications/science/biology/strelka/default.nix b/pkgs/applications/science/biology/strelka/default.nix
index 8585f3770fbcd..9730601e4e7d1 100644
--- a/pkgs/applications/science/biology/strelka/default.nix
+++ b/pkgs/applications/science/biology/strelka/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib python2 ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=maybe-uninitialized"
     "-Wno-error=pessimizing-move"
   ];
diff --git a/pkgs/applications/science/biology/svaba/default.nix b/pkgs/applications/science/biology/svaba/default.nix
index b1a174aaf882d..441c7ed6dcc3d 100644
--- a/pkgs/applications/science/biology/svaba/default.nix
+++ b/pkgs/applications/science/biology/svaba/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: ./libfml.a(rle.o):/build/source/SeqLib/fermi-lite/rle.h:33: multiple definition of
   #     `rle_auxtab'; ./libfml.a(misc.o):/build/source/SeqLib/fermi-lite/rle.h:33: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/science/chemistry/avogadro/default.nix b/pkgs/applications/science/chemistry/avogadro/default.nix
index c6339bab1228e..547123b67957c 100644
--- a/pkgs/applications/science/chemistry/avogadro/default.nix
+++ b/pkgs/applications/science/chemistry/avogadro/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config doxygen ];
 
-  NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
+  env.NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
 
   patches = [
     (fetchurl {
diff --git a/pkgs/applications/science/chemistry/chemtool/default.nix b/pkgs/applications/science/chemistry/chemtool/default.nix
index 37057e1c604a4..fe2d658b5a44f 100644
--- a/pkgs/applications/science/chemistry/chemtool/default.nix
+++ b/pkgs/applications/science/chemistry/chemtool/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   # Otherwise built fails as:
   #   ld: inout.o:/build/chemtool-1.6.14/ct1.h:279: multiple definition of
   #     `outtype'; draw.o:/build/chemtool-1.6.14/ct1.h:279: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preFixup = ''
     gappsWrapperArgs+=(--prefix PATH : "${lib.makeBinPath [ fig2dev ]}")
diff --git a/pkgs/applications/science/chemistry/pymol/default.nix b/pkgs/applications/science/chemistry/pymol/default.nix
index 4ad0380ef1e31..15a1e3158233f 100644
--- a/pkgs/applications/science/chemistry/pymol/default.nix
+++ b/pkgs/applications/science/chemistry/pymol/default.nix
@@ -48,7 +48,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
   buildInputs = [ python3Packages.numpy python3Packages.pyqt5 glew glm libpng libxml2 freetype msgpack netcdf ];
-  NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
   hardeningDisable = [ "format" ];
 
   installPhase = ''
diff --git a/pkgs/applications/science/computer-architecture/timeloop/default.nix b/pkgs/applications/science/computer-architecture/timeloop/default.nix
index 9b277ac650b74..4e794aaa29e24 100644
--- a/pkgs/applications/science/computer-architecture/timeloop/default.nix
+++ b/pkgs/applications/science/computer-architecture/timeloop/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   #link-time optimization fails on darwin
   #see https://github.com/NixOS/nixpkgs/issues/19098
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-fno-lto";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-fno-lto";
 
   postPatch = ''
     # use nix ar/ranlib
diff --git a/pkgs/applications/science/electronics/fped/default.nix b/pkgs/applications/science/electronics/fped/default.nix
index b1244b79a89f8..138d45c787cdd 100644
--- a/pkgs/applications/science/electronics/fped/default.nix
+++ b/pkgs/applications/science/electronics/fped/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   # Workaround build failure on -fno-common toolchains:
   #   ld: postscript.o:postscript.h:29: multiple definition of
   #     `postscript_params'; fped.o:postscript.h:29: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   # This uses '/bin/bash', '/usr/local' and 'lex' by default
   makeFlags = [
diff --git a/pkgs/applications/science/electronics/fritzing/default.nix b/pkgs/applications/science/electronics/fritzing/default.nix
index 22b65f2da313a..fdda4b2b0af2c 100644
--- a/pkgs/applications/science/electronics/fritzing/default.nix
+++ b/pkgs/applications/science/electronics/fritzing/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     cp -a ${parts}/* parts/
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${lib.getDev quazip}/include/QuaZip-Qt${lib.versions.major qtbase.version}-${quazip.version}/quazip";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev quazip}/include/QuaZip-Qt${lib.versions.major qtbase.version}-${quazip.version}/quazip";
 
   qmakeFlags = [
     "phoenix.pro"
diff --git a/pkgs/applications/science/electronics/magic-vlsi/default.nix b/pkgs/applications/science/electronics/magic-vlsi/default.nix
index edee5946d9460..fc68969bd498a 100644
--- a/pkgs/applications/science/electronics/magic-vlsi/default.nix
+++ b/pkgs/applications/science/electronics/magic-vlsi/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     patchShebangs scripts/*
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
 
   patches = [
     ./0001-strip-bin-prefix.patch
diff --git a/pkgs/applications/science/logic/avy/default.nix b/pkgs/applications/science/logic/avy/default.nix
index f6f43f1b0bb30..38fef51c56e6d 100644
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib boost.out boost.dev ];
-  NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
+  env.NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
     # Squelch endless stream of warnings on same few things
     ++ lib.optionals stdenv.cc.isClang [
       "-Wno-empty-body"
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index d61a9893942f8..ddfa999fcc7e3 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -60,13 +60,13 @@ stdenv.mkDerivation rec {
       --prefix PATH : "$out/share/cbmc" \
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     # Needed with GCC 12 but breaks on darwin (with clang)
     "-Wno-error=maybe-uninitialized"
   ] ++ lib.optionals stdenv.cc.isClang [
     # fix "argument unused during compilation"
     "-Wno-unused-command-line-argument"
-  ];
+  ]);
 
   # TODO: add jbmc support
   cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
diff --git a/pkgs/applications/science/logic/klee/default.nix b/pkgs/applications/science/logic/klee/default.nix
index 024e6e526c4e4..898e344f2a453 100644
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@@ -96,7 +96,7 @@ in stdenv.mkDerivation rec {
   ];
 
   # Silence various warnings during the compilation of fortified bitcode.
-  NIX_CFLAGS_COMPILE = ["-Wno-macro-redefined"];
+  env.NIX_CFLAGS_COMPILE = toString ["-Wno-macro-redefined"];
 
   prePatch = ''
     patchShebangs .
diff --git a/pkgs/applications/science/logic/satallax/default.nix b/pkgs/applications/science/logic/satallax/default.nix
index 5e5fe9925376b..af11cd0d6d8f9 100644
--- a/pkgs/applications/science/logic/satallax/default.nix
+++ b/pkgs/applications/science/logic/satallax/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   '';
 
   # error: invalid suffix on literal; C++11 requires a space between literal and identifier
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-reserved-user-defined-literal";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-reserved-user-defined-literal";
 
   installPhase = ''
     mkdir -p "$out/share/doc/satallax" "$out/bin" "$out/lib" "$out/lib/satallax"
diff --git a/pkgs/applications/science/math/calculix/default.nix b/pkgs/applications/science/math/calculix/default.nix
index 4b0ae6f8ac9d9..7a89fdd73c848 100644
--- a/pkgs/applications/science/math/calculix/default.nix
+++ b/pkgs/applications/science/math/calculix/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ arpack spooles blas lapack ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${spooles}/include/spooles"
     "-std=legacy"
   ];
diff --git a/pkgs/applications/science/math/cntk/default.nix b/pkgs/applications/science/math/cntk/default.nix
index bffd208f9ef61..f885dae444ba6 100644
--- a/pkgs/applications/science/math/cntk/default.nix
+++ b/pkgs/applications/science/math/cntk/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation rec {
   OMPI_CXX = "g++";
 
   # Uses some deprecated tensorflow functions
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   buildInputs = [ openblas opencv3 libzip boost protobuf mpi ]
              ++ lib.optional cudaSupport cudatoolkit
diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index 507fa0815298b..42e17c70673e6 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -36,7 +36,7 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: eukleides_build/triangle.o:(.bss+0x28): multiple definition of `A';
   #     eukleides_build/quadrilateral.o:(.bss+0x18): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preInstall = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index 021593124a37d..a5c0ebc85b13b 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     ] else [ "-DUSE_CUDA=OFF" ])
     ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=maybe-uninitialized"
     "-Wno-error=uninitialized"
diff --git a/pkgs/applications/science/math/perseus/default.nix b/pkgs/applications/science/math/perseus/default.nix
index d9921e68edb11..bbfc8aed44284 100644
--- a/pkgs/applications/science/math/perseus/default.nix
+++ b/pkgs/applications/science/math/perseus/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
 
   sourceRoot = ".";
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
   buildPhase = ''
     g++ Pers.cpp -O3 -fpermissive -o perseus
   '';
diff --git a/pkgs/applications/science/misc/fityk/default.nix b/pkgs/applications/science/misc/fityk/default.nix
index a4aa6457d608d..5ec7973065d2f 100644
--- a/pkgs/applications/science/misc/fityk/default.nix
+++ b/pkgs/applications/science/misc/fityk/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     swig3
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-std=c++11"
   ];
 
diff --git a/pkgs/applications/science/physics/dawncut/default.nix b/pkgs/applications/science/physics/dawncut/default.nix
index 8c0bc1ae6394a..5c17837d2e952 100644
--- a/pkgs/applications/science/physics/dawncut/default.nix
+++ b/pkgs/applications/science/physics/dawncut/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  NIX_CFLAGS_COMPILE="-std=c++98";
+  env.NIX_CFLAGS_COMPILE = "-std=c++98";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/science/physics/xfitter/default.nix b/pkgs/applications/science/physics/xfitter/default.nix
index 31df19b539a3f..1852ef3ff1c8e 100644
--- a/pkgs/applications/science/physics/xfitter/default.nix
+++ b/pkgs/applications/science/physics/xfitter/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (stdenv.hostPlatform.libc == "glibc") libtirpc
     ;
 
-  NIX_CFLAGS_COMPILE = lib.optional (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
   NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
 
   # workaround wrong library IDs
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 09ad299d10de1..56d68fcd474be 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -57,7 +57,7 @@ mkDerivation rec {
     "--without-inotify"
   ]);
 
-  NIX_CFLAGS_COMPILE = [ "-DNIXPKGS" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-DNIXPKGS" ];
 
   patches = [
     # fix "No/bad main configuration file" error
diff --git a/pkgs/applications/version-management/fnc/default.nix b/pkgs/applications/version-management/fnc/default.nix
index b74200a6919c0..0167f09ad5ba0 100644
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@@ -13,10 +13,10 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     # Needed with GCC 12
     "-Wno-error=maybe-uninitialized"
-  ];
+  ]);
 
   preInstall = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/version-management/rapidsvn/default.nix b/pkgs/applications/version-management/rapidsvn/default.nix
index 0027af3defe90..5c1499139ca0e 100644
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ wxGTK30 subversion apr aprutil python3 ];
 
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   configureFlags = [
     "--with-svn-include=${subversion.dev}/include"
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index 5f2f9aab2b3c3..40d909c8e0282 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
       [ buildPackages.diffutils buildPackages.ed ];
 
-  NIX_CFLAGS_COMPILE = "-std=c99";
+  env.NIX_CFLAGS_COMPILE = "-std=c99";
 
   hardeningDisable = lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 079fb1792e180..bb2d5822a22e1 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -133,7 +133,7 @@ stdenv.mkDerivation rec {
       --replace "NSUInteger" "size_t"
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${luajit52}/include";
+  env.NIX_CFLAGS_COMPILE = "-I${luajit52}/include";
   NIX_CFLAGS_LINK = "-L${luajit52}/lib";
 
   configurePhase = ''
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index d7ad9846306a5..e3a97197d1049 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     ./autogen.sh --prefix=$out
   '';
 
-  NIX_CFLAGS_COMPILE = builtins.concatStringsSep " " [
+  env.NIX_CFLAGS_COMPILE = builtins.concatStringsSep " " [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=incompatible-pointer-types"
   ];
diff --git a/pkgs/applications/video/coriander/default.nix b/pkgs/applications/video/coriander/default.nix
index 540339f05a561..d4e35ac484183 100644
--- a/pkgs/applications/video/coriander/default.nix
+++ b/pkgs/applications/video/coriander/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: subtitles.o:src/coriander.h:110: multiple definition of
   #     `main_window'; main.o:src/coriander.h:110: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preConfigure = ''
     cp ${automake}/share/automake-*/mkinstalldirs .
diff --git a/pkgs/applications/video/gnome-mplayer/default.nix b/pkgs/applications/video/gnome-mplayer/default.nix
index a63671accec4e..bab41b11bee94 100644
--- a/pkgs/applications/video/gnome-mplayer/default.nix
+++ b/pkgs/applications/video/gnome-mplayer/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: mpris-interface.o:src/playlist.h:32: multiple definition of
   #     `plclose'; gui.o:src/playlist.h:32: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     description = "Gnome MPlayer, a simple GUI for MPlayer";
diff --git a/pkgs/applications/video/obs-studio/plugins/looking-glass-obs.nix b/pkgs/applications/video/obs-studio/plugins/looking-glass-obs.nix
index cd7548846fa25..b581dc4402227 100644
--- a/pkgs/applications/video/obs-studio/plugins/looking-glass-obs.nix
+++ b/pkgs/applications/video/obs-studio/plugins/looking-glass-obs.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio libbfd SDL2 ];
 
-  NIX_CFLAGS_COMPILE = "-mavx";
+  env.NIX_CFLAGS_COMPILE = "-mavx";
 
   installPhase = ''
     mkdir -p $out/lib/obs-plugins/
diff --git a/pkgs/applications/video/ogmtools/default.nix b/pkgs/applications/video/ogmtools/default.nix
index 48f1b98f6e537..d910383bf956d 100644
--- a/pkgs/applications/video/ogmtools/default.nix
+++ b/pkgs/applications/video/ogmtools/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libogg libvorbis libdvdread ];
 
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=c++14" ];
 
   meta = {
     description = "Tools for modifying and inspecting OGG media streams";
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index e268b05094edc..5abc6c47a1346 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -47,7 +47,7 @@ mkDerivation rec {
     qtgraphicaleffects
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${mlt.dev}/include/mlt++ -I${mlt.dev}/include/mlt";
+  env.NIX_CFLAGS_COMPILE = "-I${mlt.dev}/include/mlt++ -I${mlt.dev}/include/mlt";
   qmakeFlags = [
     "QMAKE_LRELEASE=${lib.getDev qttools}/bin/lrelease"
     "SHOTCUT_VERSION=${version}"
diff --git a/pkgs/applications/video/vokoscreen/default.nix b/pkgs/applications/video/vokoscreen/default.nix
index 2bb9437f1b06f..82c23b4892e43 100644
--- a/pkgs/applications/video/vokoscreen/default.nix
+++ b/pkgs/applications/video/vokoscreen/default.nix
@@ -32,7 +32,7 @@ mkDerivation rec {
 
   # Workaround build failure on -fno-common toolchains:
   #   ld: alsa_device.o:(.bss+0x8): multiple definition of `rc'; QvkAlsaDevice.o:(.bss+0x8): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   preConfigure = ''
     sed -i 's/lrelease-qt5/lrelease/g' vokoscreen.pro
diff --git a/pkgs/applications/video/w_scan/default.nix b/pkgs/applications/video/w_scan/default.nix
index 9c07eb1a6368a..1a8c6f2d3adbe 100644
--- a/pkgs/applications/video/w_scan/default.nix
+++ b/pkgs/applications/video/w_scan/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: char-coding.o:/build/w_scan-20170107/si_types.h:117: multiple definition of
   #     `service_t'; countries.o:/build/w_scan-20170107/si_types.h:117: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = {
     description = "Small CLI utility to scan DVB and ATSC transmissions";
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 837e86082f950..7350765ab5d2f 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -46,7 +46,7 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ]
     ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.cc.isClang "-Qunused-arguments";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Qunused-arguments";
 
   postPatch = lib.optionalString csmSupport ''
     cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 1aa5071938a89..17b3982a1f7d0 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -68,7 +68,7 @@ rec {
 
       buildInputs = [ glibc glibc.static ];
 
-      NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
+      env.NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
     });
 
     moby-src = fetchFromGitHub {
diff --git a/pkgs/applications/virtualization/libgovirt/default.nix b/pkgs/applications/virtualization/libgovirt/default.nix
index c93f8a6897306..18d88b5468524 100644
--- a/pkgs/applications/virtualization/libgovirt/default.nix
+++ b/pkgs/applications/virtualization/libgovirt/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     # https://gitlab.gnome.org/GNOME/libgovirt/-/issues/9
     ./auto-disable-incompatible-compiler-warnings.patch
   ];
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (lib.concatStringsSep " " [
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (lib.concatStringsSep " " [
     "-Wno-typedef-redefinition"
     "-Wno-missing-field-initializers"
     "-Wno-cast-align"
diff --git a/pkgs/applications/virtualization/libnvidia-container/default.nix b/pkgs/applications/virtualization/libnvidia-container/default.nix
index d718c61066f2c..6cbed6f41f601 100644
--- a/pkgs/applications/virtualization/libnvidia-container/default.nix
+++ b/pkgs/applications/virtualization/libnvidia-container/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     HOME="$(mktemp -d)"
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-L${libtirpc.dev}/lib" "-ltirpc" ];
 
   nativeBuildInputs = [ pkg-config go rpcsvc-proto makeWrapper removeReferencesTo ];
diff --git a/pkgs/applications/virtualization/spice-vdagent/default.nix b/pkgs/applications/virtualization/spice-vdagent/default.nix
index 2b27e3a7875a2..5390a4fb6625d 100644
--- a/pkgs/applications/virtualization/spice-vdagent/default.nix
+++ b/pkgs/applications/virtualization/spice-vdagent/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # FIXME: May no longer be needed with spice-vdagent versions over 0.21.0
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postPatch = ''
     substituteInPlace data/spice-vdagent.desktop --replace /usr $out
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index 76668301c6bbf..2df0978b0d0aa 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   postPatch = "sed -i /tini-static/d CMakeLists.txt";
 
-  NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
+  env.NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index d6531452c760f..1ff7f0abebaa4 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
 
   nativeBuildInputs = [ patchelf makeWrapper ];
   buildInputs = [ cdrkit ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index cb91d8505633e..57fd03361305d 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -148,7 +148,7 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24.
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC 8
diff --git a/pkgs/applications/window-managers/cardboard/default.nix b/pkgs/applications/window-managers/cardboard/default.nix
index 6e483a40ef51c..115ab3d53e04b 100644
--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@@ -110,7 +110,7 @@ stdenv.mkDerivation rec {
     "-Dwlroots:libseat=disabled"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ]; # gcc12
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=array-bounds" ]; # gcc12
 
   meta = with lib; {
     homepage = "https://gitlab.com/cardboardwm/cardboard";
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index 6dc22a664d3dc..d056005e8f523 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: plugin.o:(.bss+0x0): multiple definition of `stam'; panel.o:(.bss+0x20): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
   NIX_LDFLAGS="-lX11";
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/hyprwm/hypr/default.nix b/pkgs/applications/window-managers/hyprwm/hypr/default.nix
index 2485552fce6ea..1450807c6709f 100644
--- a/pkgs/applications/window-managers/hyprwm/hypr/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hypr/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # src/ewmh/ewmh.cpp:67:28: error: non-constant-expression cannot be narrowed from type 'int' to 'uint32_t' (aka 'unsigned int') in initializer list
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-c++11-narrowing";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/window-managers/oroborus/default.nix b/pkgs/applications/window-managers/oroborus/default.nix
index fc25171076709..fdd9604f7c796 100644
--- a/pkgs/applications/window-managers/oroborus/default.nix
+++ b/pkgs/applications/window-managers/oroborus/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: workspaces.o:src/keyboard.h:93: multiple definition of
   #     `NumLockMask'; client.o:src/keyboard.h:93: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     homepage = "https://web.archive.org/web/20191129172107/https://www.oroborus.org/";
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix b/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
index 225e44c21cedb..5c68a39a1ead5 100644
--- a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     export sourceRoot=$(echo */${pname}/wmsm)
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/applications/window-managers/yeahwm/default.nix b/pkgs/applications/window-managers/yeahwm/default.nix
index 25a25a06ad9ed..f1a6635b362a2 100644
--- a/pkgs/applications/window-managers/yeahwm/default.nix
+++ b/pkgs/applications/window-managers/yeahwm/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: screen.o:(.bss+0x40): multiple definition of `fg'; client.o:(.bss+0x40): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postInstall = ''
     gzip -9 --stdout yeahwm.1 > yeahwm.1.gz