diff --git a/pkgs/tools/nix/dnadd/default.nix b/pkgs/tools/nix/dnadd/default.nix
index 3f4d76a9c4d4..59a0516629e1 100644
--- a/pkgs/tools/nix/dnadd/default.nix
+++ b/pkgs/tools/nix/dnadd/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1vzbgz8y9gj4lszsx4iczfbrj373sl4wi43j7rp46zfcbw323d4r";
   };
 
+  strictDeps = true;
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
diff --git a/pkgs/tools/nix/info/default.nix b/pkgs/tools/nix/info/default.nix
index 84bd3e891622..73c336afe045 100644
--- a/pkgs/tools/nix/info/default.nix
+++ b/pkgs/tools/nix/info/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, coreutils, findutils, gnugrep, darwin
+{ stdenv, lib, coreutils, findutils, gnugrep, darwin, bash
 # Avoid having GHC in the build-time closure of all NixOS configurations
 , doCheck ? false, shellcheck
 }:
@@ -26,7 +26,9 @@ stdenv.mkDerivation {
   '';
 
   inherit doCheck;
+  strictDeps = true;
   nativeCheckInputs = [ shellcheck ];
+  buildInputs = [ bash ];
 
   checkPhase = ''
     shellcheck ./nix-info
diff --git a/pkgs/tools/nix/nix-script/default.nix b/pkgs/tools/nix/nix-script/default.nix
index f9077ef13871..c83bfbc7a226 100644
--- a/pkgs/tools/nix/nix-script/default.nix
+++ b/pkgs/tools/nix/nix-script/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0yiqljamcj9x8z801bwj7r30sskrwv4rm6sdf39j83jqql1fyq7y";
   };
 
-  buildInputs  = [
+  strictDeps = true;
+  nativeBuildInputs  = [
     (haskellPackages.ghcWithPackages (hs: with hs; [ posix-escape ]))
   ];
 
diff --git a/pkgs/tools/nix/nixos-generators/default.nix b/pkgs/tools/nix/nixos-generators/default.nix
index fa4495647c6e..bf3a387c439f 100644
--- a/pkgs/tools/nix/nixos-generators/default.nix
+++ b/pkgs/tools/nix/nixos-generators/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, coreutils, jq, findutils, nix  }:
+{ stdenv, lib, fetchFromGitHub, makeWrapper, coreutils, jq, findutils, nix, bash }:
 
 stdenv.mkDerivation rec {
   pname = "nixos-generators";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     rev = version;
     sha256 = "sha256-WecDwDY/hEcDQYzFnccCNa+5Umht0lfjx/d1qGDy/rQ=";
   };
+  strictDeps = true;
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
   installFlags = [ "PREFIX=$(out)" ];
   postFixup = ''
     wrapProgram $out/bin/nixos-generate \
diff --git a/pkgs/tools/nix/nixos-option/default.nix b/pkgs/tools/nix/nixos-option/default.nix
index 9137e5a716c5..a9cc967d7680 100644
--- a/pkgs/tools/nix/nixos-option/default.nix
+++ b/pkgs/tools/nix/nixos-option/default.nix
@@ -3,6 +3,7 @@
 stdenv.mkDerivation rec {
   name = "nixos-option";
   src = ./.;
+  strictDeps = true;
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ boost nix ];
   meta = with lib; {
diff --git a/pkgs/tools/wayland/mpvpaper/default.nix b/pkgs/tools/wayland/mpvpaper/default.nix
index 76598f4afea2..3f98e8ef8c21 100644
--- a/pkgs/tools/wayland/mpvpaper/default.nix
+++ b/pkgs/tools/wayland/mpvpaper/default.nix
@@ -6,6 +6,7 @@
 , wlroots
 , wayland
 , wayland-protocols
+, wayland-scanner
 , egl-wayland
 , glew-egl
 , mpv
@@ -26,12 +27,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0LjIwOY2hBUb0nziD3HLP2Ek5+8v3ntssRFD9eQgWkc=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     makeWrapper
     installShellFiles
+    wayland-scanner
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/wayland/proycon-wayout/default.nix b/pkgs/tools/wayland/proycon-wayout/default.nix
index 2b4dc0f54e4f..265d585ce1df 100644
--- a/pkgs/tools/wayland/proycon-wayout/default.nix
+++ b/pkgs/tools/wayland/proycon-wayout/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
     mv $out/bin/wayout $out/bin/proycon-wayout # Avoid conflict with shinyzenith/wayout
   '';
 
+  strictDeps = true;
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ scdoc ninja meson cmake pkg-config wayland-scanner ];
   buildInputs = [ wayland-protocols wayland cairo pango ];
diff --git a/pkgs/tools/wayland/sov/default.nix b/pkgs/tools/wayland/sov/default.nix
index b9b139c7a1f9..d7415a5fa517 100644
--- a/pkgs/tools/wayland/sov/default.nix
+++ b/pkgs/tools/wayland/sov/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/sov/main.c --replace '/usr' $out
   '';
+
+  strictDeps = true;
   nativeBuildInputs = [ meson pkg-config wayland-scanner ninja ];
   buildInputs = [ wayland wayland-protocols freetype ];
 
diff --git a/pkgs/tools/wayland/waynergy/default.nix b/pkgs/tools/wayland/waynergy/default.nix
index fce7ac6605af..83de408554db 100644
--- a/pkgs/tools/wayland/waynergy/default.nix
+++ b/pkgs/tools/wayland/waynergy/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-pk1U3svy9r7O9ivFjBNXsaOmgc+nv2QTuwwHejB7B4Q=";
   };
 
-  depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ meson ninja ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
   buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon libressl ];
 
   postPatch = ''
diff --git a/pkgs/tools/wayland/wev/default.nix b/pkgs/tools/wayland/wev/default.nix
index e450de2f2dcf..506b67d14e5b 100644
--- a/pkgs/tools/wayland/wev/default.nix
+++ b/pkgs/tools/wayland/wev/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "0l71v3fzgiiv6xkk365q1l08qvaymxd4kpaya6r2g8yzkr7i2hms";
   };
 
+  strictDeps = true;
   # for scdoc
   depsBuildBuild = [
     pkg-config
diff --git a/pkgs/tools/wayland/wlprop/default.nix b/pkgs/tools/wayland/wlprop/default.nix
index 82f80a594ad0..67c4918b371f 100644
--- a/pkgs/tools/wayland/wlprop/default.nix
+++ b/pkgs/tools/wayland/wlprop/default.nix
@@ -1,4 +1,4 @@
-{ fetchgit, gawk, jq, lib, makeWrapper, slurp, stdenv, sway }:
+{ fetchgit, gawk, jq, lib, makeWrapper, slurp, stdenv, sway, bash }:
 
 stdenv.mkDerivation rec {
   pname = "wlprop";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZJ9LYYrU2cNYikiVNTlEcI4QXcoqfl7iwk3Be+NhGG8=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
 
   dontBuild = true;
   installPhase = ''