diff --git a/pkgs/by-name/av/avalanche-cli/package.nix b/pkgs/by-name/av/avalanche-cli/package.nix
index f2d83a65fe1a..959786285291 100644
--- a/pkgs/by-name/av/avalanche-cli/package.nix
+++ b/pkgs/by-name/av/avalanche-cli/package.nix
@@ -26,10 +26,12 @@ buildGoModule (finalAttrs: {
   proxyVendor = true;
   vendorHash = "sha256-0+YwlCHjiU46y333RSuaha4pLKFTYlj+M9+TFAALamY=";
 
-  # Fix error: 'Caught SIGILL in blst_cgo_init'
-  # https://github.com/bnb-chain/bsc/issues/1521
-  CGO_CFLAGS = "-O -D__BLST_PORTABLE__";
-  CGO_CFLAGS_ALLOW = "-O -D__BLST_PORTABLE__";
+  env = {
+    # Fix error: 'Caught SIGILL in blst_cgo_init'
+    # https://github.com/bnb-chain/bsc/issues/1521
+    CGO_CFLAGS = "-O -D__BLST_PORTABLE__";
+    CGO_CFLAGS_ALLOW = "-O -D__BLST_PORTABLE__";
+  };
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/bl/blockbook/package.nix b/pkgs/by-name/bl/blockbook/package.nix
index 411221f63052..5ecf87529d88 100644
--- a/pkgs/by-name/bl/blockbook/package.nix
+++ b/pkgs/by-name/bl/blockbook/package.nix
@@ -49,7 +49,7 @@ buildGoModule rec {
     "-X github.com/trezor/blockbook/common.buildDate=unknown"
   ];
 
-  CGO_LDFLAGS = [
+  env.CGO_LDFLAGS = toString [
     "-L${lib.getLib stdenv.cc.cc}/lib"
     "-lrocksdb"
     "-lz"
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 335da70bd81f..a084ae9b78e6 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [ systemdLibs ];
 
-  CGO_CFLAGS = "-I ${systemdLibs}/include";
+  env.CGO_CFLAGS = "-I ${systemdLibs}/include";
 
   ldflags = [
     "-extldflags='-Wl,-z,lazy'"
diff --git a/pkgs/by-name/ec/ecapture/package.nix b/pkgs/by-name/ec/ecapture/package.nix
index 9000999343a2..5deea8e1531c 100644
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@@ -52,7 +52,11 @@ buildGoModule rec {
     glibc
   ];
 
-  CGO_LDFLAGS = "-lpcap -lpthread -static";
+  env.CGO_LDFLAGS = toString [
+    "-lpcap"
+    "-lpthread"
+    "-static"
+  ];
 
   ldflags = [
     "-extldflags '-static'"
diff --git a/pkgs/by-name/ex/exportarr/package.nix b/pkgs/by-name/ex/exportarr/package.nix
index 805da4706900..eff10e663409 100644
--- a/pkgs/by-name/ex/exportarr/package.nix
+++ b/pkgs/by-name/ex/exportarr/package.nix
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/exportarr" ];
 
-  CGO_ENABLE = 0;
+  env.CGO_ENABLE = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index c35d687e2b12..06eb4b16fd16 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -109,7 +109,7 @@ buildGoModule (finalAttrs: {
   tags = [ "libsqlite3" ];
 
   # required for go-cowsql.
-  CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
+  env.CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
 
   # add our lxc location to incus's acceptable rootFsPaths
   # this is necessary for tmpfs/tmpfs-overlay to work
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index 8d05f31cf4ac..fbdb9cf03a8e 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -42,7 +42,9 @@ buildGoModule rec {
 
   tags = lib.optional withGoolm "goolm";
 
-  CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
+  env = lib.optionalAttrs withGoolm {
+    CGO_LDFLAGS = toString [ cppStdLib ];
+  };
 
   vendorHash = "sha256-TFz5P8czj8J9+QTFHjffCldw8Je2+DiM49W7jv5rY/I=";
 
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index 0aba55f33e3e..d1b8ce1c8f47 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -64,7 +64,9 @@ buildGoModule (finalAttrs: {
     "-X github.com/navidrome/navidrome/consts.gitTag=v${finalAttrs.version}"
   ];
 
-  CGO_CFLAGS = lib.optionals stdenv.cc.isGNU [ "-Wno-return-local-addr" ];
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    CGO_CFLAGS = toString [ "-Wno-return-local-addr" ];
+  };
 
   postPatch = ''
     patchShebangs ui/bin/update-workbox.sh
diff --git a/pkgs/by-name/ne/netcap/package.nix b/pkgs/by-name/ne/netcap/package.nix
index f08dfe02bcfa..92768c3334e3 100644
--- a/pkgs/by-name/ne/netcap/package.nix
+++ b/pkgs/by-name/ne/netcap/package.nix
@@ -40,22 +40,27 @@ buildGoModule (finalAttrs: {
   ];
 
   ldflags = [
-    "-s -w"
+    "-s"
+    "-w"
   ];
 
   tags = lib.optionals (!withDpi) [
     "nodpi"
   ];
 
-  CGO_LDFLAGS = lib.optionalString withDpi ''
-    -L${ndpi}/lib -lndpi
-    -L${libprotoident}/lib -lndpi
-  '';
+  env = lib.optionalAttrs withDpi {
+    CGO_LDFLAGS = toString [
+      "-L${ndpi}/lib"
+      "-lndpi"
+      "-L${libprotoident}/lib"
+      "-lndpi"
+    ];
 
-  CGO_CFLAGS = lib.optionalString withDpi ''
-    -I${ndpi}/include
-    -I${libprotoident}/include
-  '';
+    CGO_CFLAGS = toString [
+      "-I${ndpi}/include"
+      "-I${libprotoident}/include"
+    ];
+  };
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/net
diff --git a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
index 5016e1ae3b7e..ea877b581c35 100644
--- a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
     hash = "sha256-NafQWP1NxHTwmOND8ovy3oVia7qq0rCwZYE3VNlMBKQ=";
   };
 
-  CGO_LDFLAGS = "-ldcgm";
+  env.CGO_LDFLAGS = "-ldcgm";
 
   buildInputs = [
     dcgm
diff --git a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
index 12ed985a6260..3ae9843f851a 100644
--- a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
@@ -38,7 +38,7 @@ buildGoModule.override { stdenv = clangStdenv; } (finalAttrs: {
     libz
   ];
 
-  CGO_LDFLAGS = "-l bpf";
+  env.CGO_LDFLAGS = "-l bpf";
 
   hardeningDisable = [ "zerocallusedregs" ];
 
diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index 5a061773979f..e06231993204 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     "-X github.com/smallstep/step-kms-plugin/cmd.Version=${version}"
   ];
 
-  CGO_CFLAGS = "-I${lib.getDev pcsclite}/include/PCSC/";
+  env.CGO_CFLAGS = "-I${lib.getDev pcsclite}/include/PCSC/";
 
   meta = {
     description = "Step plugin to manage keys and certificates on cloud KMSs and HSMs";
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index d694e00b0340..4d405112e548 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
     "-w"
   ];
 
-  CGO_CFLAGS = [ "-Wno-format-security" ];
+  env.CGO_CFLAGS = toString [ "-Wno-format-security" ];
 
   preCheck = ''
     # Remove tests that require additional services.