diff --git a/pkgs/by-name/cl/clickhouse/generic.nix b/pkgs/by-name/cl/clickhouse/generic.nix
index dd3378440f32..fffeaa3145c0 100644
--- a/pkgs/by-name/cl/clickhouse/generic.nix
+++ b/pkgs/by-name/cl/clickhouse/generic.nix
@@ -21,14 +21,17 @@
   darwin,
   findutils,
   libiconv,
+  removeReferencesTo,
   rustSupport ? true,
   rustc,
   cargo,
   rustPlatform,
   nix-update-script,
 }:
-
-llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
+let
+  llvmStdenv = llvmPackages_19.stdenv;
+in
+llvmStdenv.mkDerivation (finalAttrs: {
   pname = "clickhouse" + lib.optionalString lts "-lts";
   inherit version;
 
@@ -70,6 +73,7 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
     python3
     perl
     llvmPackages_19.lld
+    removeReferencesTo
   ]
   ++ lib.optionals stdenv.hostPlatform.isx86_64 [
     nasm
@@ -154,8 +158,12 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
     substituteInPlace $out/etc/clickhouse-server/config.xml \
       --replace-fail "<errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>" "<console>1</console>" \
       --replace-fail "<level>trace</level>" "<level>warning</level>"
+    remove-references-to -t ${llvmStdenv.cc} $out/bin/clickhouse
   '';
 
+  # canary for the remove-references-to hook failing
+  disallowedReferences = [ llvmStdenv.cc ];
+
   # Basic smoke test
   doCheck = true;
   checkPhase = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''