From 407f9757dbadc8e1ab1850c36cb3666443f16bba Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 26 Apr 2026 14:54:46 -0400
Subject: [PATCH] stdenv.mkDerivation: remove pie hardening flag warning

---
 doc/release-notes/rl-2605.section.md    | 2 ++
 pkgs/stdenv/generic/make-derivation.nix | 6 ++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index b133b37cd5c7..b333f6848381 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -274,6 +274,8 @@
 
 - The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.
 
+- The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 79f49c5eedb4..2a8361efe328 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -434,7 +434,7 @@ let
         else
           subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
       # hardeningDisable additionally supports "all".
-      erroneousHardeningFlags = subtractLists (knownHardeningFlags ++ [ "pie" ]) (
+      erroneousHardeningFlags = subtractLists knownHardeningFlags (
         hardeningEnable ++ remove "all" hardeningDisable
       );
 
@@ -636,9 +636,7 @@ let
             else
               null
           } =
-            lib.warnIf (elem "pie" hardeningEnable || elem "pie" hardeningDisable)
-              "The 'pie' hardening flag has been removed in favor of enabling PIE by default in compilers and should no longer be used. PIE can be disabled with the -no-pie compiler flag, but this is usually not necessary as most build systems pass this if needed. Usage of the 'pie' hardening flag will become an error in future."
-              (concatStringsSep " " enabledHardeningOptions);
+            concatStringsSep " " enabledHardeningOptions;
 
           # TODO: remove platform condition
           # Enabling this check could be a breaking change as it requires to edit nix.conf