diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index a6b08042db99..c65327ffbad0 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -27,7 +27,8 @@ rec {
   };
 
   extract = args@{ name ? "${args.pname}-${args.version}", postExtract ? "", src, ... }: pkgs.runCommand "${name}-extracted" {
-      buildInputs = [ appimage-exec ];
+      nativeBuildInputs = [ appimage-exec ];
+      strictDeps = true;
     } ''
       appimage-exec.sh -x $out ${src}
       ${postExtract}
diff --git a/pkgs/by-name/li/libmysqlconnectorcpp/package.nix b/pkgs/by-name/li/libmysqlconnectorcpp/package.nix
index 6eb9ff06f206..7668c9576f0d 100644
--- a/pkgs/by-name/li/libmysqlconnectorcpp/package.nix
+++ b/pkgs/by-name/li/libmysqlconnectorcpp/package.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    mysql80
   ];
 
   buildInputs = [
@@ -25,6 +26,8 @@ stdenv.mkDerivation rec {
     mysql80
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     # libmysqlclient is shared library
     "-DMYSQLCLIENT_STATIC_LINKING=false"
diff --git a/pkgs/by-name/mu/multipath-tools/package.nix b/pkgs/by-name/mu/multipath-tools/package.nix
index 9fe8630e2275..d1c5edb7b1bb 100644
--- a/pkgs/by-name/mu/multipath-tools/package.nix
+++ b/pkgs/by-name/mu/multipath-tools/package.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     systemd
     util-linuxMinimal # for libmount
   ];
+  strictDeps = true;
 
   makeFlags = [
     "LIB=lib"
@@ -77,7 +78,7 @@ stdenv.mkDerivation rec {
     # skip test attempting to access /sys/dev/block
     substituteInPlace tests/Makefile --replace-fail ' devt ' ' '
   '';
-  nativeCheckInputs = [ cmocka ];
+  checkInputs = [ cmocka ];
 
   passthru.tests = { inherit (nixosTests) iscsi-multipath-root; };
 
diff --git a/pkgs/by-name/th/thrift/package.nix b/pkgs/by-name/th/thrift/package.nix
index 589f03c68858..cbb7e5967f40 100644
--- a/pkgs/by-name/th/thrift/package.nix
+++ b/pkgs/by-name/th/thrift/package.nix
@@ -34,14 +34,16 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     python3.pkgs.setuptools
+  ] ++ lib.optionals (!static) [
+    python3.pkgs.twisted
   ];
 
   buildInputs = [
     boost
-  ] ++ lib.optionals (!static) [
-    (python3.withPackages (ps: [ps.twisted]))
   ];
 
+  strictDeps = true;
+
   propagatedBuildInputs = [
     libevent
     openssl
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 2c005cbfa434..f93efd316cb5 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -189,6 +189,7 @@ stdenv.mkDerivation (finalAttrs: {
     systemd
     taglib
     xcbutilkeysyms
+    wayland-scanner # only required for configure script
     zlib
   ]
   ++ optionals (!stdenv.hostPlatform.isAarch && !onlyLibVLC) [ live555 ]
@@ -207,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtx11extras
   ])
   ++ optionals (waylandSupport && withQt5) [ libsForQt5.qtwayland ];
+  strictDeps = true;
 
   env = {
     # vlc depends on a c11-gcc wrapper script which we don't have so we need to
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index 0db577decce3..e6db5ef8e35b 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -55,9 +55,9 @@ let
       name = "flutter-${version}-unwrapped";
       inherit src patches version;
 
-      buildInputs = [ git ];
-      nativeBuildInputs = [ makeWrapper jq ]
+      nativeBuildInputs = [ makeWrapper jq git ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
+      strictDeps = true;
 
       preConfigure = ''
         if [ "$(< bin/internal/engine.version)" != '${engineVersion}' ]; then
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 1ed4bfc8b2c2..1ca065e94ce9 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -90,6 +90,7 @@ stdenv.mkDerivation (finalAttrs: ({
     ++ lib.optional (postgresql != null) postgresql;
 
   nativeBuildInputs = [ bison flex gperf lndir perl pkg-config which ]
+    ++ lib.optionals (mysqlSupport) [ libmysqlclient ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
 
   } // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
@@ -101,6 +102,8 @@ stdenv.mkDerivation (finalAttrs: ({
 
   propagatedNativeBuildInputs = [ lndir ];
 
+  strictDeps = true;
+
   # libQt5Core links calls CoreFoundation APIs that call into the system ICU. Binaries linked
   # against it will crash during build unless they can access `/usr/share/icu/icudtXXl.dat`.
   propagatedSandboxProfile = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 76976be200b5..24a57957a131 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -24,8 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja wayland-scanner ];
-  nativeCheckInputs = [ python3 ];
+  nativeCheckInputs = [ python3 wayland ];
   checkInputs = [ wayland ];
+  strictDeps = true;
 
   mesonFlags = [ "-Dtests=${lib.boolToString finalAttrs.doCheck}" ];
 
diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index b6664daa2576..756cd75ed6ad 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -90,7 +90,7 @@ lib.fix (
     checkPhase = ''
       runHook preCheck
 
-      meson test -C _meson-build --no-rebuild --print-errorlogs
+      meson test -C _meson-build --no-rebuild --print-errorlogs --timeout-multiplier 0
 
       runHook postCheck
     '';
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index e4427a495680..de8036a55bcc 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-At/ZQ/lnQvf5zXiFWzJwjqTfVIycFK+Sc4F/O72dIrI=";
   };
 
-  nativeBuildInputs = [ bison cmake pkg-config ]
+  nativeBuildInputs = [ bison cmake pkg-config protobuf ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ];
 
   patches = [
@@ -34,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     cctools CoreServices developer_cmds DarwinTools
   ];
 
+  strictDeps = true;
+
   outputs = [ "out" "static" ];
 
   cmakeFlags = [
diff --git a/pkgs/tools/filesystems/encfs/default.nix b/pkgs/tools/filesystems/encfs/default.nix
index 4f546932c733..739caa5402b0 100644
--- a/pkgs/tools/filesystems/encfs/default.nix
+++ b/pkgs/tools/filesystems/encfs/default.nix
@@ -23,8 +23,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ gettext fuse openssl tinyxml2 ];
-  nativeBuildInputs = [ cmake pkg-config perl ];
+  buildInputs = [ fuse openssl tinyxml2 ];
+  nativeBuildInputs = [ cmake pkg-config perl gettext ];
+  strictDeps = true;
 
   cmakeFlags =
     [ "-DUSE_INTERNAL_TINYXML=OFF"