From e39e53c6c6a82f41bef75c5e0a3d01315d17bb88 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:15:51 +0100
Subject: [PATCH 1/6] python{313,314}Packages.matplotlib: work around `ld64`
 hardening issue

---
 .../python-modules/matplotlib/default.nix         | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ab1d363fc6ab..bee69a777e5e 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -62,6 +62,9 @@
 
   # Reverse dependency
   sage,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -104,7 +107,12 @@ buildPythonPackage (finalAttrs: {
         --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals enableGtk3 [ gobject-introspection ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     ffmpeg-headless
@@ -160,6 +168,11 @@ buildPythonPackage (finalAttrs: {
     b_lto = false;
   };
 
+  # TODO: Clean up on `staging`.
+  env.${if stdenv.hostPlatform.isDarwin then "CC_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "CXX_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "OBJC_LD" else null} = "lld";
+
   passthru.tests = {
     inherit sage;
   };

From fc952632d96e506faa958a807771a6577b48cf1a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:17:32 +0100
Subject: [PATCH 2/6] qt6.qtbase: work around `ld64` hardening issue

---
 .../libraries/qt-6/modules/qtbase/default.nix         | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7686093f4d75..e3f60553ee63 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -89,6 +89,9 @@
   # options
   qttranslations ? null,
   fetchpatch,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -197,7 +200,11 @@ stdenv.mkDerivation {
     cmake
     ninja
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    moveBuildTree
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ];
 
   propagatedNativeBuildInputs = [
     lndir
@@ -312,6 +319,8 @@ stdenv.mkDerivation {
     # When this variable is not set, cmake tries to execute xcodebuild
     # to query the version.
     "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    # TODO: Clean up on `staging`.
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ]
   ++ lib.optionals isCrossBuild [
     "-DQT_HOST_PATH=${pkgsBuildBuild.qt6.qtbase}"

From 89af4db9cfc5c1b13ba5b9e666683699f8179fab Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:24:46 +0100
Subject: [PATCH 3/6] wxwidgets_{3_1,3_2,3_3}: work around `ld64` hardening
 issue

---
 pkgs/by-name/wx/wxwidgets_3_1/package.nix | 26 +++++++++++++++++------
 pkgs/by-name/wx/wxwidgets_3_2/package.nix | 26 +++++++++++++++++------
 pkgs/by-name/wx/wxwidgets_3_3/package.nix | 26 +++++++++++++++++------
 3 files changed, 57 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/wx/wxwidgets_3_1/package.nix b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
index 17b1d60e360f..bea53d1e25e1 100644
--- a/pkgs/by-name/wx/wxwidgets_3_1/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
@@ -23,6 +23,9 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_1,
   libpng,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./0002-support-webkitgtk-41.patch
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -89,12 +96,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     substituteInPlace configure --replace \
diff --git a/pkgs/by-name/wx/wxwidgets_3_2/package.nix b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
index bc33af7fc265..ca05463f928f 100644
--- a/pkgs/by-name/wx/wxwidgets_3_2/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
@@ -29,6 +29,9 @@
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   catch = fetchFromGitHub {
@@ -56,7 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mYMUW3FnFkKHDQXb/k9UosSiWCPW7OQn+/orwq4Q95k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -114,12 +121,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     cp -r ${catch}/* 3rdparty/catch/
diff --git a/pkgs/by-name/wx/wxwidgets_3_3/package.nix b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
index 078dc6706c1d..8afa367df0fe 100644
--- a/pkgs/by-name/wx/wxwidgets_3_3/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
@@ -30,6 +30,9 @@
   withEGL ? true,
   withPrivateFonts ? false,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -44,7 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UL1NuByKFGMQ/dhjuWRdnWTgdy4+1cD9pSls3e1mur8=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -103,12 +110,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   postInstall = "
     pushd $out/include

From 2c0e8d977ae15f20f251167091b61e5a3e62bc27 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:25:47 +0100
Subject: [PATCH 4/6] python{313,314}Packages.pyobjc-core: work around `ld64`
 hardening issue

---
 pkgs/development/python-modules/pyobjc-core/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/pyobjc-core/default.nix b/pkgs/development/python-modules/pyobjc-core/default.nix
index e07a01289f74..278ad48196d8 100644
--- a/pkgs/development/python-modules/pyobjc-core/default.nix
+++ b/pkgs/development/python-modules/pyobjc-core/default.nix
@@ -4,6 +4,9 @@
   fetchFromGitHub,
   lib,
   setuptools,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 buildPythonPackage rec {
@@ -28,6 +31,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     darwin.DarwinTools # sw_vers
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "-Wno-error=unused-command-line-argument"
   ];
 
+  # TODO: Clean up on `staging`.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   pythonImportsCheck = [ "objc" ];
 
   meta = {

From 3b114d3460c13c07f259ee6ffb24e43de5f03277 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:27:13 +0100
Subject: [PATCH 5/6] glfw3: work around `ld64` hardening issue

---
 pkgs/by-name/gl/glfw3/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gl/glfw3/package.nix b/pkgs/by-name/gl/glfw3/package.nix
index 711406030b70..6ecf627adce1 100644
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@@ -20,6 +20,9 @@
   libxkbcommon,
   libdecor,
   withMinecraftPatch ? false,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   version = "3.4";
@@ -58,7 +61,11 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -86,6 +93,9 @@ stdenv.mkDerivation {
   cmakeFlags = [
     # Static linking isn't supported
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {

From 7a83e820ddc2dd54a2ff6038ffe5a2f7a4005fb8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:28:51 +0100
Subject: [PATCH 6/6] qemu: work around `ld64` hardening issue

---
 pkgs/by-name/qe/qemu/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 5bd6c6e0f8c7..80362ffd6757 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -123,6 +123,9 @@
   minimal ? toolsOnly || userOnly,
   gitUpdater,
   qemu-utils, # for tests attribute
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -180,6 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals hexagonSupport [ glib ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.sigtool
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ]
   ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -425,6 +431,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
     tests = lib.optionalAttrs (!toolsOnly) {