diff --git a/pkgs/applications/audio/mopidy/moped.nix b/pkgs/applications/audio/mopidy/moped.nix
index edf9877fcaf6..ddc3268923d0 100644
--- a/pkgs/applications/audio/mopidy/moped.nix
+++ b/pkgs/applications/audio/mopidy/moped.nix
@@ -17,7 +17,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "15461174037d87af93dd59a236d4275c5abf71cea0670ffff24a7d0399a8a2e4";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
   buildInputs = [ glibcLocales ];
 
   build-system = [ pythonPackages.setuptools ];
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 2c6d63d0e918..7111275add99 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -116,12 +116,18 @@ stdenv.mkDerivation rec {
     "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinMinVersion}"
   ];
 
-  CMAKE_CXX_FLAGS = toString [
-    "-std=c++11"
-    "-Wno-deprecated-declarations"
-    "-Wno-unused-result"
-  ];
-  env.CXXFLAGS = "-include cstdint"; # needed at least with gcc13 on aarch64-linux
+  env = {
+    CMAKE_CXX_FLAGS = toString [
+      "-std=c++11"
+      "-Wno-deprecated-declarations"
+      "-Wno-unused-result"
+    ];
+    # needed at least with gcc13 on aarch64-linux
+    CXXFLAGS = toString [
+      "-include"
+      "cstdint"
+    ];
+  };
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications/RawTherapee.app $out/bin
diff --git a/pkgs/applications/networking/instant-messengers/profanity/default.nix b/pkgs/applications/networking/instant-messengers/profanity/default.nix
index 03be31854dbc..09aaac6e9ad1 100644
--- a/pkgs/applications/networking/instant-messengers/profanity/default.nix
+++ b/pkgs/applications/networking/instant-messengers/profanity/default.nix
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  LC_ALL = "en_US.utf8";
+  env.LC_ALL = "en_US.utf8";
 
   meta = {
     homepage = "https://profanity-im.github.io";
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 4e19564295cd..5e0b96969a82 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -42,140 +42,139 @@ let
       sha256,
       extraPatches ? [ ],
     }:
-    stdenv.mkDerivation (
-      rec {
-        inherit version;
-        pname = "subversion${lib.optionalString (!bdbSupport && perlBindings && pythonBindings) "-client"}";
+    stdenv.mkDerivation rec {
+      inherit version;
+      pname = "subversion${lib.optionalString (!bdbSupport && perlBindings && pythonBindings) "-client"}";
 
-        src = fetchurl {
-          url = "mirror://apache/subversion/subversion-${version}.tar.bz2";
-          inherit sha256;
-        };
+      src = fetchurl {
+        url = "mirror://apache/subversion/subversion-${version}.tar.bz2";
+        inherit sha256;
+      };
 
-        # Can't do separate $lib and $bin, as libs reference bins
-        outputs = [
-          "out"
-          "dev"
-          "man"
-        ];
+      # Can't do separate $lib and $bin, as libs reference bins
+      outputs = [
+        "out"
+        "dev"
+        "man"
+      ];
 
-        nativeBuildInputs = [
-          autoconf
-          libtool
-          python3
-        ];
+      nativeBuildInputs = [
+        autoconf
+        libtool
+        python3
+      ];
 
-        buildInputs = [
-          zlib
-          apr
-          aprutil
-          sqlite
-          openssl
-          lz4
-          utf8proc
-        ]
-        ++ lib.optional httpSupport serf
-        ++ lib.optionals pythonBindings [
-          python3
-          py3c
-        ]
-        ++ lib.optional perlBindings perl
-        ++ lib.optional saslSupport sasl;
+      buildInputs = [
+        zlib
+        apr
+        aprutil
+        sqlite
+        openssl
+        lz4
+        utf8proc
+      ]
+      ++ lib.optional httpSupport serf
+      ++ lib.optionals pythonBindings [
+        python3
+        py3c
+      ]
+      ++ lib.optional perlBindings perl
+      ++ lib.optional saslSupport sasl;
 
-        patches = [ ./apr-1.patch ] ++ extraPatches;
+      patches = [ ./apr-1.patch ] ++ extraPatches;
 
-        # remove vendored swig-3 files as these will shadow the swig provided
-        # ones and result in compile errors
-        postPatch = ''
-          rm subversion/bindings/swig/proxy/{perlrun.swg,pyrun.swg,python.swg,rubydef.swg,rubyhead.swg,rubytracking.swg,runtime.swg,swigrun.swg}
-        '';
+      # remove vendored swig-3 files as these will shadow the swig provided
+      # ones and result in compile errors
+      postPatch = ''
+        rm subversion/bindings/swig/proxy/{perlrun.swg,pyrun.swg,python.swg,rubydef.swg,rubyhead.swg,rubytracking.swg,runtime.swg,swigrun.swg}
+      '';
 
+      env = {
         # We are hitting the following issue even with APR 1.6.x
         # -> https://issues.apache.org/jira/browse/SVN-4813
         # "-P" CPPFLAG is needed to build Python bindings and subversionClient
-        CPPFLAGS = [ "-P" ];
-
-        preConfigure = ''
-          ./autogen.sh
-        '';
-
-        configureFlags = [
-          (lib.withFeature bdbSupport "berkeley-db")
-          (lib.withFeatureAs httpServer "apxs" "${apacheHttpd.dev}/bin/apxs")
-          (lib.withFeatureAs (pythonBindings || perlBindings) "swig" swig)
-          (lib.withFeatureAs saslSupport "sasl" sasl)
-          (lib.withFeatureAs httpSupport "serf" serf)
-          "--with-zlib=${zlib.dev}"
-          "--with-sqlite=${sqlite.dev}"
-          "--with-apr=${apr.dev}"
-          "--with-apr-util=${aprutil.dev}"
-        ]
-        ++ lib.optionals javahlBindings [
-          "--enable-javahl"
-          "--with-jdk=${jdk}"
-        ];
-
-        preBuild = ''
-          makeFlagsArray=(APACHE_LIBEXECDIR=$out/modules)
-        '';
-
-        postInstall = ''
-          if test -n "$pythonBindings"; then
-              make swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
-              make install-swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
-          fi
-
-          if test -n "$perlBindings"; then
-              make swig-pl-lib
-              make install-swig-pl-lib
-              cd subversion/bindings/swig/perl/native
-              perl Makefile.PL PREFIX=$out
-              make install
-              cd -
-          fi
-
-          mkdir -p $out/share/bash-completion/completions
-          cp tools/client-side/bash_completion $out/share/bash-completion/completions/subversion
-
-          for f in $out/lib/*.la $out/lib/python*/site-packages/*/*.la; do
-            substituteInPlace $f \
-              --replace "${expat.dev}/lib" "${expat.out}/lib" \
-              --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
-              --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
-              --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
-          done
-        '';
-
-        inherit perlBindings pythonBindings;
-
-        enableParallelBuilding = true;
-        # Missing install dependencies:
-        # libtool:   error: error: relink 'libsvn_ra_serf-1.la' with the above command before installing it
-        # make: *** [build-outputs.mk:1316: install-serf-lib] Error 1
-        enableParallelInstalling = false;
-
-        nativeCheckInputs = [ python3 ];
-        doCheck = false; # fails 10 out of ~2300 tests
-
-        passthru.tests = { inherit (nixosTests) svnserve; };
-
-        meta = {
-          description = "Version control system intended to be a compelling replacement for CVS in the open source community";
-          license = lib.licenses.asl20;
-          homepage = "https://subversion.apache.org/";
-          mainProgram = "svn";
-          maintainers = with lib.maintainers; [ lovek323 ];
-          platforms = lib.platforms.linux ++ lib.platforms.darwin;
-        };
-
+        CPPFLAGS = toString [ "-P" ];
       }
       // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
         CXX = "clang++";
         CC = "clang";
         CPP = "clang -E";
         CXXCPP = "clang++ -E";
-      }
-    );
+      };
+
+      preConfigure = ''
+        ./autogen.sh
+      '';
+
+      configureFlags = [
+        (lib.withFeature bdbSupport "berkeley-db")
+        (lib.withFeatureAs httpServer "apxs" "${apacheHttpd.dev}/bin/apxs")
+        (lib.withFeatureAs (pythonBindings || perlBindings) "swig" swig)
+        (lib.withFeatureAs saslSupport "sasl" sasl)
+        (lib.withFeatureAs httpSupport "serf" serf)
+        "--with-zlib=${zlib.dev}"
+        "--with-sqlite=${sqlite.dev}"
+        "--with-apr=${apr.dev}"
+        "--with-apr-util=${aprutil.dev}"
+      ]
+      ++ lib.optionals javahlBindings [
+        "--enable-javahl"
+        "--with-jdk=${jdk}"
+      ];
+
+      preBuild = ''
+        makeFlagsArray=(APACHE_LIBEXECDIR=$out/modules)
+      '';
+
+      postInstall = ''
+        if test -n "$pythonBindings"; then
+            make swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
+            make install-swig-py swig_pydir=$(toPythonPath $out)/libsvn swig_pydir_extra=$(toPythonPath $out)/svn
+        fi
+
+        if test -n "$perlBindings"; then
+            make swig-pl-lib
+            make install-swig-pl-lib
+            cd subversion/bindings/swig/perl/native
+            perl Makefile.PL PREFIX=$out
+            make install
+            cd -
+        fi
+
+        mkdir -p $out/share/bash-completion/completions
+        cp tools/client-side/bash_completion $out/share/bash-completion/completions/subversion
+
+        for f in $out/lib/*.la $out/lib/python*/site-packages/*/*.la; do
+          substituteInPlace $f \
+            --replace "${expat.dev}/lib" "${expat.out}/lib" \
+            --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
+            --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
+            --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
+        done
+      '';
+
+      inherit perlBindings pythonBindings;
+
+      enableParallelBuilding = true;
+      # Missing install dependencies:
+      # libtool:   error: error: relink 'libsvn_ra_serf-1.la' with the above command before installing it
+      # make: *** [build-outputs.mk:1316: install-serf-lib] Error 1
+      enableParallelInstalling = false;
+
+      nativeCheckInputs = [ python3 ];
+      doCheck = false; # fails 10 out of ~2300 tests
+
+      passthru.tests = { inherit (nixosTests) svnserve; };
+
+      meta = {
+        description = "Version control system intended to be a compelling replacement for CVS in the open source community";
+        license = lib.licenses.asl20;
+        homepage = "https://subversion.apache.org/";
+        mainProgram = "svn";
+        maintainers = with lib.maintainers; [ lovek323 ];
+        platforms = lib.platforms.linux ++ lib.platforms.darwin;
+      };
+    };
 
 in
 {
diff --git a/pkgs/by-name/ad/adrs/package.nix b/pkgs/by-name/ad/adrs/package.nix
index 90bbdbf893c9..b54c71c9b1fe 100644
--- a/pkgs/by-name/ad/adrs/package.nix
+++ b/pkgs/by-name/ad/adrs/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adrs";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "joshrotenberg";
     repo = "adrs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dHiXnLARzviShnih1gkMehMpsztaofFXToDStd3GWkY=";
+    hash = "sha256-D1Tg5ep9ri6fj0fLmKqQeMdlAe/Nc38wKTF5dsWxK3k=";
   };
 
-  cargoHash = "sha256-RThX4n4qn/0cPm8GZLnzbNt5VrMWf0wMXz0G9Im9CHk=";
+  cargoHash = "sha256-jrKDOLPps/ExGnREQy1yz8Say1bAcvJXHrkLivux4Vg=";
 
   meta = {
     description = "Command-line tool for managing Architectural Decision Records";
diff --git a/pkgs/by-name/an/animeko/package.nix b/pkgs/by-name/an/animeko/package.nix
index b8c7d0ee2217..cebbec7a0d10 100644
--- a/pkgs/by-name/an/animeko/package.nix
+++ b/pkgs/by-name/an/animeko/package.nix
@@ -144,7 +144,10 @@ stdenv.mkDerivation (finalAttrs: {
     useBwrap = false;
   };
 
-  env.JAVA_HOME = jetbrains.jdk;
+  env = {
+    JAVA_HOME = jetbrains.jdk;
+    ANDROID_SDK_HOME = "$(pwd)";
+  };
 
   gradleFlags = [
     "-Dorg.gradle.java.home=${jetbrains.jdk}"
@@ -257,8 +260,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -sf ${libvlc}/lib $out/lib/app/resources/
   '';
 
-  ANDROID_SDK_HOME = "$(pwd)";
-
   passthru.updateScript = writeShellScript "update-animeko" ''
     ${lib.getExe nix-update} animeko
     $(nix-build -A animeko.mitmCache.updateScript)
diff --git a/pkgs/by-name/ar/arc-theme/package.nix b/pkgs/by-name/ar/arc-theme/package.nix
index a1e3bf7649c9..3f4287d1f1ef 100644
--- a/pkgs/by-name/ar/arc-theme/package.nix
+++ b/pkgs/by-name/ar/arc-theme/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Fontconfig error: Cannot load default config file: No such file: (null)
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+  env.FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   mesonFlags = [
     # "-Dthemes=cinnamon,gnome-shell,gtk2,gtk3,plank,xfwm,metacity"
diff --git a/pkgs/by-name/ar/ardour_8/package.nix b/pkgs/by-name/ar/ardour_8/package.nix
index e21a47802dcd..aa870cdd312d 100644
--- a/pkgs/by-name/ar/ardour_8/package.nix
+++ b/pkgs/by-name/ar/ardour_8/package.nix
@@ -216,7 +216,7 @@ stdenv.mkDerivation (
         }"
     '';
 
-    LINKFLAGS = "-lpthread";
+    env.LINKFLAGS = "-lpthread";
 
     meta = {
       description = "Multi-track hard disk recording software";
diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index d98a6c2e98c5..18a0f8667d88 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -105,12 +105,18 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCTL_INCLUDE_DIR=${color-transformation-language}/include/CTL"
   ];
 
-  CMAKE_CXX_FLAGS = toString [
-    "-std=c++11"
-    "-Wno-deprecated-declarations"
-    "-Wno-unused-result"
-  ];
-  env.CXXFLAGS = "-include cstdint"; # needed at least with gcc13 on aarch64-linux
+  env = {
+    CMAKE_CXX_FLAGS = toString [
+      "-std=c++11"
+      "-Wno-deprecated-declarations"
+      "-Wno-unused-result"
+    ];
+    # needed at least with gcc13 on aarch64-linux
+    CXXFLAGS = toString [
+      "-include"
+      "cstdint"
+    ];
+  };
 
   meta = {
     description = "Raw converter based on RawTherapee";
diff --git a/pkgs/by-name/av/avalanche-cli/package.nix b/pkgs/by-name/av/avalanche-cli/package.nix
index f2d83a65fe1a..959786285291 100644
--- a/pkgs/by-name/av/avalanche-cli/package.nix
+++ b/pkgs/by-name/av/avalanche-cli/package.nix
@@ -26,10 +26,12 @@ buildGoModule (finalAttrs: {
   proxyVendor = true;
   vendorHash = "sha256-0+YwlCHjiU46y333RSuaha4pLKFTYlj+M9+TFAALamY=";
 
-  # Fix error: 'Caught SIGILL in blst_cgo_init'
-  # https://github.com/bnb-chain/bsc/issues/1521
-  CGO_CFLAGS = "-O -D__BLST_PORTABLE__";
-  CGO_CFLAGS_ALLOW = "-O -D__BLST_PORTABLE__";
+  env = {
+    # Fix error: 'Caught SIGILL in blst_cgo_init'
+    # https://github.com/bnb-chain/bsc/issues/1521
+    CGO_CFLAGS = "-O -D__BLST_PORTABLE__";
+    CGO_CFLAGS_ALLOW = "-O -D__BLST_PORTABLE__";
+  };
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/aw/awsume/package.nix b/pkgs/by-name/aw/awsume/package.nix
index a9cc42881dcb..56c31bccc45e 100644
--- a/pkgs/by-name/aw/awsume/package.nix
+++ b/pkgs/by-name/aw/awsume/package.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-lm9YANYckyHDoNbB1wytBm55iyBmUuxFPmZupfpReqc=";
   };
 
-  AWSUME_SKIP_ALIAS_SETUP = 1;
+  env.AWSUME_SKIP_ALIAS_SETUP = 1;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/bf/bftpd/package.nix b/pkgs/by-name/bf/bftpd/package.nix
index 7f146a5dcf5a..01578c892844 100644
--- a/pkgs/by-name/bf/bftpd/package.nix
+++ b/pkgs/by-name/bf/bftpd/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libxcrypt ];
 
-  CFLAGS = "-std=gnu89";
+  env.CFLAGS = "-std=gnu89";
 
   preConfigure = ''
     sed -re 's/-[og] 0//g' -i Makefile*
diff --git a/pkgs/by-name/bl/blockbook/package.nix b/pkgs/by-name/bl/blockbook/package.nix
index 411221f63052..5ecf87529d88 100644
--- a/pkgs/by-name/bl/blockbook/package.nix
+++ b/pkgs/by-name/bl/blockbook/package.nix
@@ -49,7 +49,7 @@ buildGoModule rec {
     "-X github.com/trezor/blockbook/common.buildDate=unknown"
   ];
 
-  CGO_LDFLAGS = [
+  env.CGO_LDFLAGS = toString [
     "-L${lib.getLib stdenv.cc.cc}/lib"
     "-lrocksdb"
     "-lz"
diff --git a/pkgs/by-name/bu/bumblebee/package.nix b/pkgs/by-name/bu/bumblebee/package.nix
index 01809953c540..3c454536bdc1 100644
--- a/pkgs/by-name/bu/bumblebee/package.nix
+++ b/pkgs/by-name/bu/bumblebee/package.nix
@@ -166,7 +166,7 @@ stdenv.mkDerivation rec {
     "CONF_MODPATH_NVIDIA=${nvidia_x11.bin}/lib/xorg/modules"
   ];
 
-  CFLAGS = [
+  env.CFLAGS = toString [
     "-DX_MODULE_APPENDS=\\\"${xmodules}\\\""
   ];
 
diff --git a/pkgs/by-name/ca/canon-capt/package.nix b/pkgs/by-name/ca/canon-capt/package.nix
index 389e7c898eda..52219a33e7f8 100644
--- a/pkgs/by-name/ca/canon-capt/package.nix
+++ b/pkgs/by-name/ca/canon-capt/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   # Fix for 'ppdc: Unable to find include file "<font.defs>"', which blocks '*.ppd' generation.
   # Issue occurs in hermetic sandbox; this workaround is the current solution.
   # Source: https://github.com/NixOS/nixpkgs/blob/9997402000a82eda4327fde36291234118c7515e/pkgs/misc/drivers/hplip/default.nix#L160
-  CUPS_DATADIR = "${cups}/share/cups";
+  env.CUPS_DATADIR = "${cups}/share/cups";
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/by-name/ca/capitaine-cursors/package.nix b/pkgs/by-name/ca/capitaine-cursors/package.nix
index b2d7fb323971..699aec8c5f0f 100644
--- a/pkgs/by-name/ca/capitaine-cursors/package.nix
+++ b/pkgs/by-name/ca/capitaine-cursors/package.nix
@@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   # Complains about not being able to find the fontconfig config file otherwise
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+  env.FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   buildInputs = [
     inkscape
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 457c99d4cf6a..d052a906ca19 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.429.0";
+  version = "1.430.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-msqySCQxAySQTEAToUF/JV+IH4B/NKxymCouofEt9Ic=";
+    hash = "sha256-b2NMh+9JcPrMu0JHL2vdWOJhUA+PoCmj7M21rS9MS3o=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 335da70bd81f..a084ae9b78e6 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [ systemdLibs ];
 
-  CGO_CFLAGS = "-I ${systemdLibs}/include";
+  env.CGO_CFLAGS = "-I ${systemdLibs}/include";
 
   ldflags = [
     "-extldflags='-Wl,-z,lazy'"
diff --git a/pkgs/by-name/cp/cpp-redis/package.nix b/pkgs/by-name/cp/cpp-redis/package.nix
index 5f129f3352da..0bf3ce1ed02b 100644
--- a/pkgs/by-name/cp/cpp-redis/package.nix
+++ b/pkgs/by-name/cp/cpp-redis/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
   ];
-  CFLAGS = "-D_GLIBCXX_USE_NANOSLEEP";
+  env.CFLAGS = "-D_GLIBCXX_USE_NANOSLEEP";
   patches = [
     ./01-fix-sleep_for.patch
   ];
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index a66adb559ad8..2a5f375c9c83 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -56,8 +56,10 @@ rustPlatform.buildRustPackage {
     patchShebangs third_party/minijail/tools/*.py
   '';
 
-  CROSVM_USE_SYSTEM_MINIGBM = true;
-  CROSVM_USE_SYSTEM_VIRGLRENDERER = true;
+  env = {
+    CROSVM_USE_SYSTEM_MINIGBM = true;
+    CROSVM_USE_SYSTEM_VIRGLRENDERER = true;
+  };
 
   buildFeatures = [ "virgl_renderer" ];
 
diff --git a/pkgs/by-name/cu/curlftpfs/package.nix b/pkgs/by-name/cu/curlftpfs/package.nix
index 2d4b90b9c764..9404af4c3830 100644
--- a/pkgs/by-name/cu/curlftpfs/package.nix
+++ b/pkgs/by-name/cu/curlftpfs/package.nix
@@ -39,7 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
-  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D__off_t=off_t";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CFLAGS = "-D__off_t=off_t";
+  };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Fix the build on macOS with macFUSE installed. Needs autoreconfHook for
diff --git a/pkgs/by-name/de/deadpixi-sam-unstable/package.nix b/pkgs/by-name/de/deadpixi-sam-unstable/package.nix
index cbd620ec8f07..0a9d81b10afc 100644
--- a/pkgs/by-name/de/deadpixi-sam-unstable/package.nix
+++ b/pkgs/by-name/de/deadpixi-sam-unstable/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
       --replace "RXPATH=/usr/bin/ssh" "RXPATH=ssh"
   '';
 
-  CFLAGS = "-D_DARWIN_C_SOURCE";
+  env.CFLAGS = "-D_DARWIN_C_SOURCE";
   makeFlags = [ "DESTDIR=$(out)" ];
   buildInputs = [
     libx11
diff --git a/pkgs/by-name/de/devpi-client/package.nix b/pkgs/by-name/de/devpi-client/package.nix
index 73dc522b8bd7..109d2213eafe 100644
--- a/pkgs/by-name/de/devpi-client/package.nix
+++ b/pkgs/by-name/de/devpi-client/package.nix
@@ -60,7 +60,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "--fast"
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/di/direnv/package.nix b/pkgs/by-name/di/direnv/package.nix
index 7b74981d9072..7b831c38ef85 100644
--- a/pkgs/by-name/di/direnv/package.nix
+++ b/pkgs/by-name/di/direnv/package.nix
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-SAIGFQGACTB3Q0KnIdiKKNYY6fVjf/09wGqNr0Hkg+M=";
 
   # we have no bash at the moment for windows
-  BASH_PATH = lib.optionalString (!stdenv.hostPlatform.isWindows) "${bash}/bin/bash";
+  env.BASH_PATH = lib.optionalString (!stdenv.hostPlatform.isWindows) "${bash}/bin/bash";
 
   # replace the build phase to use the GNUMakefile instead
   buildPhase = ''
diff --git a/pkgs/by-name/dn/dnsdist/disable-network-tests.patch b/pkgs/by-name/dn/dnsdist/disable-network-tests.patch
deleted file mode 100644
index fd0fdfbc4eae..000000000000
--- a/pkgs/by-name/dn/dnsdist/disable-network-tests.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/test-dnsdisttcp_cc.cc b/test-dnsdisttcp_cc.cc
-index 1fbb00e..dc04137 100644
---- a/test-dnsdisttcp_cc.cc
-+++ b/test-dnsdisttcp_cc.cc
-@@ -848,6 +848,7 @@ BOOST_AUTO_TEST_CASE(test_IncomingConnectionWithProxyProtocol_SelfAnswered)
- 
- BOOST_AUTO_TEST_CASE(test_IncomingConnection_BackendNoOOOR)
- {
-+  return;
-   auto local = getBackendAddress("1", 80);
-   ClientState localCS(local, true, false, false, "", {});
-   auto tlsCtx = std::make_shared<MockupTLSCtx>();
-@@ -1711,6 +1712,7 @@ BOOST_AUTO_TEST_CASE(test_IncomingConnection_BackendNoOOOR)
- 
- BOOST_AUTO_TEST_CASE(test_IncomingConnectionOOOR_BackendOOOR)
- {
-+  return;
-   auto local = getBackendAddress("1", 80);
-   ClientState localCS(local, true, false, false, "", {});
-   /* enable out-of-order on the front side */
-@@ -3677,6 +3679,7 @@ BOOST_AUTO_TEST_CASE(test_IncomingConnectionOOOR_BackendOOOR)
- 
- BOOST_AUTO_TEST_CASE(test_IncomingConnectionOOOR_BackendNotOOOR)
- {
-+  return;
-   auto local = getBackendAddress("1", 80);
-   ClientState localCS(local, true, false, false, "", {});
-   /* enable out-of-order on the front side */
diff --git a/pkgs/by-name/dn/dnsdist/package.nix b/pkgs/by-name/dn/dnsdist/package.nix
index 07f3f465b2e4..8af9f1347384 100644
--- a/pkgs/by-name/dn/dnsdist/package.nix
+++ b/pkgs/by-name/dn/dnsdist/package.nix
@@ -1,62 +1,86 @@
 {
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  systemd,
   boost,
-  libsodium,
-  libedit,
-  re2,
-  net-snmp,
-  lua,
-  protobuf,
-  openssl,
-  zlib,
+  cargo,
+  fetchpatch,
+  fetchurl,
+  fstrm,
   h2o,
+  lib,
+  libbpf,
+  libcap,
+  libedit,
+  libsodium,
+  lua,
+  net-snmp,
   nghttp2,
   nixosTests,
+  openssl,
+  pkg-config,
+  protobuf,
+  python3,
+  re2,
+  rustPlatform,
+  stdenv,
+  systemd,
+  xdp-tools,
+  zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnsdist";
-  version = "1.9.10";
+  version = "2.0.2";
 
   src = fetchurl {
-    url = "https://downloads.powerdns.com/releases/dnsdist-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-An3b3uaVxaWXKAV7/EHFsaaR+hx6XokniwnzVTJfvtY=";
+    url = "https://downloads.powerdns.com/releases/dnsdist-${finalAttrs.version}.tar.xz";
+    hash = "sha256-M3Trplpco8+5/Fl5HEflA1FJ/lIcy7ztX4NKF/RWQb8=";
   };
 
   patches = [
-    # Disable tests requiring networking:
-    # "Error connecting to new server with address 192.0.2.1:53: connecting socket to 192.0.2.1:53: Network is unreachable"
-    ./disable-network-tests.patch
+    # Fix build error when only protobuf is enabled
+    (fetchpatch {
+      url = "https://github.com/PowerDNS/pdns/commit/daece82818d7f83b26dcf724ec1864644bc3f854.patch";
+      hash = "sha256-Ag65Gjmm2m4yvRfqMjSo1EEJg/2EHWDBg15vSL5DKCU=";
+      stripLen = 2;
+    })
   ];
 
   nativeBuildInputs = [
+    cargo
     pkg-config
     protobuf
+    python3
+    python3.pkgs.pyyaml
+    rustPlatform.cargoSetupHook
   ];
   buildInputs = [
-    systemd
     boost
-    libsodium
-    libedit
-    re2
-    net-snmp
-    lua
-    openssl
-    zlib
+    fstrm # Required for DNSTAP
     h2o
+    libbpf
+    libcap
+    libedit
+    libsodium
+    lua
+    net-snmp
     nghttp2
+    openssl
+    re2
+    systemd
+    xdp-tools # AF_XDP support
+    zlib
   ];
 
   configureFlags = [
     "--with-libsodium"
     "--with-re2"
     "--enable-dnscrypt"
+    "--enable-dnstap"
     "--enable-dns-over-tls"
     "--enable-dns-over-https"
+    "--enable-yaml"
+    "--with-ebpf"
+    "--with-xsk"
+    "--with-libcap"
     "--with-protobuf=yes"
     "--with-net-snmp"
     "--disable-dependency-tracking"
@@ -65,6 +89,13 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-boost=${boost.dev}"
   ];
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) cargoRoot src;
+    hash = "sha256-nDAvgM3xb+95dcGIHiSKlFo4/0Rs5Evf1vvR5vF4MXs=";
+  };
+
+  cargoRoot = "dnsdist-rust-lib/rust";
+
   doCheck = true;
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/dr/droidcam/package.nix b/pkgs/by-name/dr/droidcam/package.nix
index 5e9caf964d96..c3a9a211284d 100644
--- a/pkgs/by-name/dr/droidcam/package.nix
+++ b/pkgs/by-name/dr/droidcam/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "droidcam";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "aramg";
     repo = "droidcam";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-z/SteW3jYR/VR+HffvTetdGs5oz4qWBNkaqLYiP1V8c=";
+    sha256 = "sha256-22lRmtXumjR/83Fg1edBisM1GjNZvNUvPs1Yg7Na1xw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dr/dropbear/package.nix b/pkgs/by-name/dr/dropbear/package.nix
index 47f81d6a25bb..de58c611f8bc 100644
--- a/pkgs/by-name/dr/dropbear/package.nix
+++ b/pkgs/by-name/dr/dropbear/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-DR98pxHPwzbcioXmcsq5z9giOgL+LaCkp661jJ4RNjQ=";
   };
 
-  CFLAGS = lib.pipe (lib.attrNames dflags) [
+  env.CFLAGS = lib.pipe (lib.attrNames dflags) [
     (map (name: "-D${name}=\\\"${dflags.${name}}\\\""))
     (lib.concatStringsSep " ")
   ];
diff --git a/pkgs/by-name/du/dumpasn1/package.nix b/pkgs/by-name/du/dumpasn1/package.nix
index f9a878f711b5..cf7a526589bc 100644
--- a/pkgs/by-name/du/dumpasn1/package.nix
+++ b/pkgs/by-name/du/dumpasn1/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-r40czSLdjCYbt73zK7exCoP/kMq6+pyJfz9LKJLLaXM=";
   };
 
-  CFLAGS = ''-DDUMPASN1_CONFIG_PATH='"$(out)/etc/"' '';
+  env.CFLAGS = ''-DDUMPASN1_CONFIG_PATH='"$(out)/etc/"' '';
 
   makeFlags = [ "prefix=$(out)" ];
 
diff --git a/pkgs/by-name/dy/dynamic-colors/package.nix b/pkgs/by-name/dy/dynamic-colors/package.nix
index 2d453bcab36d..7613f54bd019 100644
--- a/pkgs/by-name/dy/dynamic-colors/package.nix
+++ b/pkgs/by-name/dy/dynamic-colors/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-jSdwq9WwYZP8MK6z7zJa0q93xfanr6iuvAt8YQkQxxE=";
   };
 
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   postPatch = ''
     substituteInPlace bin/dynamic-colors \
diff --git a/pkgs/by-name/ec/ecapture/package.nix b/pkgs/by-name/ec/ecapture/package.nix
index 9000999343a2..5deea8e1531c 100644
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@@ -52,7 +52,11 @@ buildGoModule rec {
     glibc
   ];
 
-  CGO_LDFLAGS = "-lpcap -lpthread -static";
+  env.CGO_LDFLAGS = toString [
+    "-lpcap"
+    "-lpthread"
+    "-static"
+  ];
 
   ldflags = [
     "-extldflags '-static'"
diff --git a/pkgs/by-name/ef/eflite/package.nix b/pkgs/by-name/ef/eflite/package.nix
index a6aa478947e8..c797057b331f 100644
--- a/pkgs/by-name/ef/eflite/package.nix
+++ b/pkgs/by-name/ef/eflite/package.nix
@@ -44,7 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./format.patch
   ];
 
-  CFLAGS = lib.optionalString debug " -DDEBUG=2";
+  env = lib.optionalAttrs debug {
+    CFLAGS = " -DDEBUG=2";
+  };
 
   meta = {
     homepage = "https://eflite.sourceforge.net";
diff --git a/pkgs/by-name/ex/exifprobe/package.nix b/pkgs/by-name/ex/exifprobe/package.nix
index b1d5b1cf412c..584eb2abf667 100644
--- a/pkgs/by-name/ex/exifprobe/package.nix
+++ b/pkgs/by-name/ex/exifprobe/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     sha256 = "1c1fhc0v1m452lgnfcijnvrc0by06qfbhn3zkliqi60kv8l2isbp";
   };
 
-  CFLAGS = [ "-O2" ];
+  env.CFLAGS = toString [ "-O2" ];
 
   installFlags = [ "DESTDIR=$(out)" ];
 
diff --git a/pkgs/by-name/ex/exportarr/package.nix b/pkgs/by-name/ex/exportarr/package.nix
index 805da4706900..eff10e663409 100644
--- a/pkgs/by-name/ex/exportarr/package.nix
+++ b/pkgs/by-name/ex/exportarr/package.nix
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/exportarr" ];
 
-  CGO_ENABLE = 0;
+  env.CGO_ENABLE = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fc/fcrackzip/package.nix b/pkgs/by-name/fc/fcrackzip/package.nix
index 4d89ece7d0ca..b90f8b92565f 100644
--- a/pkgs/by-name/fc/fcrackzip/package.nix
+++ b/pkgs/by-name/fc/fcrackzip/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "0l1qsk949vnz18k4vjf3ppq8p497966x4c7f2yx18x8pk35whn2a";
   };
 
-  CFLAGS = "-std=gnu89";
+  env.CFLAGS = "-std=gnu89";
 
   # 'fcrackzip --use-unzip' cannot deal with file names containing a single quote
   # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=430387
diff --git a/pkgs/by-name/fe/feedgnuplot/package.nix b/pkgs/by-name/fe/feedgnuplot/package.nix
index b468221f8bbb..416a4fd61fd7 100644
--- a/pkgs/by-name/fe/feedgnuplot/package.nix
+++ b/pkgs/by-name/fe/feedgnuplot/package.nix
@@ -46,7 +46,7 @@ perlPackages.buildPerlPackage rec {
   ]);
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = fontsConf;
+  env.FONTCONFIG_FILE = fontsConf;
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/by-name/fm/fmi-reference-fmus/package.nix b/pkgs/by-name/fm/fmi-reference-fmus/package.nix
index 223ffb3c9e39..175d114b8844 100644
--- a/pkgs/by-name/fm/fmi-reference-fmus/package.nix
+++ b/pkgs/by-name/fm/fmi-reference-fmus/package.nix
@@ -31,7 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DFMI_VERSION=${toString FMIVersion}"
     (lib.cmakeBool "WITH_FMUSIM" false)
   ];
-  CFLAGS = lib.optionalString (FMIVersion == 3) "-Wno-stringop-truncation";
+
+  env = lib.optionalAttrs (FMIVersion == 3) {
+    CFLAGS = "-Wno-stringop-truncation";
+  };
 
   meta = {
     # CMakeLists.txt explicitly states support for aarch64-darwin, but
diff --git a/pkgs/by-name/fo/font-alias/package.nix b/pkgs/by-name/fo/font-alias/package.nix
index 7ce6cb893415..4ec91e542e0b 100644
--- a/pkgs/by-name/fo/font-alias/package.nix
+++ b/pkgs/by-name/fo/font-alias/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  stdenv,
+  stdenvNoCC,
   fetchFromGitLab,
   gitUpdater,
   autoreconfHook,
@@ -8,9 +8,9 @@
   util-macros,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "font-alias";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "font";
     repo = "alias";
     tag = "font-alias-${finalAttrs.version}";
-    hash = "sha256-qglRNSt/PgFprpsvOVCeLMA+YagJw8DZMAfFdZ0m0/s=";
+    hash = "sha256-WGCC4OTerSRf+2sGNqggSBzVVv7gcuP6s3QQHBLahdM=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
       cronyx
       mit
     ];
-    maintainers = [ ];
-    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ qweered ];
   };
 })
diff --git a/pkgs/by-name/fo/foot/package.nix b/pkgs/by-name/fo/foot/package.nix
index f8119264478a..424a316996cb 100644
--- a/pkgs/by-name/fo/foot/package.nix
+++ b/pkgs/by-name/fo/foot/package.nix
@@ -138,7 +138,7 @@ stdenv.mkDerivation {
 
   # recommended build flags for performance optimized foot builds
   # https://codeberg.org/dnkl/foot/src/branch/master/INSTALL.md#release-build
-  CFLAGS = if !doPgo then "-O3" else pgoCflags;
+  env.CFLAGS = if !doPgo then "-O3" else pgoCflags;
 
   # ar with gcc plugins for lto objects
   preConfigure = ''
diff --git a/pkgs/by-name/gi/git-vendor/package.nix b/pkgs/by-name/gi/git-vendor/package.nix
index b8132fc6cdb2..a4ec7901f9f0 100644
--- a/pkgs/by-name/gi/git-vendor/package.nix
+++ b/pkgs/by-name/gi/git-vendor/package.nix
@@ -29,9 +29,11 @@ stdenv.mkDerivation {
     "out"
   ];
 
-  PREFIX = (placeholder "out");
-  BINPREFIX = "${placeholder "bin"}/bin";
-  MANPREFIX = "${placeholder "man"}/share/man/man1";
+  env = {
+    PREFIX = (placeholder "out");
+    BINPREFIX = "${placeholder "bin"}/bin";
+    MANPREFIX = "${placeholder "man"}/share/man/man1";
+  };
 
   buildInputs = [
     # stubbing out a `git config` check that `make install` tries to do
diff --git a/pkgs/by-name/gl/glom/package.nix b/pkgs/by-name/gl/glom/package.nix
index a1b637990d8f..7b734670b04d 100644
--- a/pkgs/by-name/gl/glom/package.nix
+++ b/pkgs/by-name/gl/glom/package.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [ freefont_ttf ];
   };
 
diff --git a/pkgs/by-name/gn/gnome-network-displays/package.nix b/pkgs/by-name/gn/gnome-network-displays/package.nix
index b10568e8d94b..9e3ec5c16c23 100644
--- a/pkgs/by-name/gn/gnome-network-displays/package.nix
+++ b/pkgs/by-name/gn/gnome-network-displays/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     Hence, this is not necessarily an upstream issue, but could be something
     wrong with how our gst_all_1 depend on each other.
   */
-  CFLAGS = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.CFLAGS = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   preConfigure = ''
     patchShebangs ./build-aux/meson/postinstall.py
diff --git a/pkgs/by-name/gt/gtkmm4/package.nix b/pkgs/by-name/gt/gtkmm4/package.nix
index 2ab6e28fe6fe..dde0fe3485ba 100644
--- a/pkgs/by-name/gt/gtkmm4/package.nix
+++ b/pkgs/by-name/gt/gtkmm4/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Tests require fontconfig.
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [ ];
   };
 
diff --git a/pkgs/by-name/gt/gtypist/package.nix b/pkgs/by-name/gt/gtypist/package.nix
index facac531cc67..5b3c20feb5b0 100644
--- a/pkgs/by-name/gt/gtypist/package.nix
+++ b/pkgs/by-name/gt/gtypist/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ymGAVOkfHtXvBD/MQ1ALutcByVnDGETUaI/yKEmsJS0=";
   };
 
-  CFLAGS = "-std=gnu99";
+  env.CFLAGS = "-std=gnu99";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/hp/hplip/package.nix b/pkgs/by-name/hp/hplip/package.nix
index d4e4f9f48528..0d2668a79dd9 100644
--- a/pkgs/by-name/hp/hplip/package.nix
+++ b/pkgs/by-name/hp/hplip/package.nix
@@ -203,12 +203,6 @@ python3Packages.buildPythonApplication {
     ++ lib.optional withStaticPPDInstall "--enable-cups-ppd-install"
     ++ lib.optional withQt5 "--enable-qt5";
 
-  # Prevent 'ppdc: Unable to find include file "<font.defs>"' which prevent
-  # generation of '*.ppd' files.
-  # This seems to be a 'ppdc' issue when the tool is run in a hermetic sandbox.
-  # Could not find how to fix the problem in 'ppdc' so this is a workaround.
-  CUPS_DATADIR = "${cups}/share/cups";
-
   makeFlags =
     let
       out = placeholder "out";
@@ -234,6 +228,12 @@ python3Packages.buildPythonApplication {
   enableParallelInstalling = false;
 
   env = {
+    # Prevent 'ppdc: Unable to find include file "<font.defs>"' which prevent
+    # generation of '*.ppd' files.
+    # This seems to be a 'ppdc' issue when the tool is run in a hermetic sandbox.
+    # Could not find how to fix the problem in 'ppdc' so this is a workaround.
+    CUPS_DATADIR = "${cups}/share/cups";
+
     NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=implicit-int"
       "-Wno-error=implicit-function-declaration"
diff --git a/pkgs/by-name/ht/httpstat/package.nix b/pkgs/by-name/ht/httpstat/package.nix
index 4807cb9c716b..fc9382a891fe 100644
--- a/pkgs/by-name/ht/httpstat/package.nix
+++ b/pkgs/by-name/ht/httpstat/package.nix
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   buildInputs = [ glibcLocales ];
   runtimeDeps = [ curl ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   meta = {
     description = "Curl statistics made simple";
diff --git a/pkgs/by-name/i3/i3minator/package.nix b/pkgs/by-name/i3/i3minator/package.nix
index d94d0004a2a2..53d7211e170e 100644
--- a/pkgs/by-name/i3/i3minator/package.nix
+++ b/pkgs/by-name/i3/i3minator/package.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sha256 = "07dic5d2m0zw0psginpl43xn0mpxw7wilj49d02knz69f7c416lm";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
   buildInputs = [ glibcLocales ];
 
   build-system = [
diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index c35d687e2b12..06eb4b16fd16 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -109,7 +109,7 @@ buildGoModule (finalAttrs: {
   tags = [ "libsqlite3" ];
 
   # required for go-cowsql.
-  CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
+  env.CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
 
   # add our lxc location to incus's acceptable rootFsPaths
   # this is necessary for tmpfs/tmpfs-overlay to work
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index 6919ba9ec52d..f76750056487 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
   strictDeps = true;
 
-  CFLAGS = [
+  env.CFLAGS = toString [
     "-O2"
     "-DNDEBUG"
   ];
diff --git a/pkgs/by-name/le/lepton-eda/package.nix b/pkgs/by-name/le/lepton-eda/package.nix
index e685ec889d41..6e2895785fca 100644
--- a/pkgs/by-name/le/lepton-eda/package.nix
+++ b/pkgs/by-name/le/lepton-eda/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     "--with-gtk3"
   ];
 
-  CFLAGS = [
+  env.CFLAGS = toString [
     "-DSCM_DEBUG_TYPING_STRICTNESS=2"
   ];
 
diff --git a/pkgs/by-name/li/libaccounts-glib/package.nix b/pkgs/by-name/li/libaccounts-glib/package.nix
index 02dfa6431f80..998f305c801f 100644
--- a/pkgs/by-name/li/libaccounts-glib/package.nix
+++ b/pkgs/by-name/li/libaccounts-glib/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "subdir('tests')" ""
   '';
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   mesonFlags = [
     "-Dinstall-py-overrides=true"
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index f393ee46823c..7c7ae06fd369 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -127,11 +127,13 @@ stdenv.mkDerivation rec {
     "-Drpi-awb-nn=disabled"
   ];
 
-  # Fixes error on a deprecated declaration
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env = {
+    # Fixes error on a deprecated declaration
+    NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
-  # Silence fontconfig warnings about missing config
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+    # Silence fontconfig warnings about missing config
+    FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+  };
 
   meta = {
     description = "Open source camera stack and framework for Linux, Android, and ChromeOS";
diff --git a/pkgs/by-name/li/libmatthew_java/package.nix b/pkgs/by-name/li/libmatthew_java/package.nix
index c11ae7a4a681..a6ad4e205932 100644
--- a/pkgs/by-name/li/libmatthew_java/package.nix
+++ b/pkgs/by-name/li/libmatthew_java/package.nix
@@ -15,8 +15,12 @@ stdenv.mkDerivation (finalAttrs: {
     url = "https://src.fedoraproject.org/repo/pkgs/libmatthew-java/libmatthew-java-${finalAttrs.version}.tar.gz/8455b8751083ce25c99c2840609271f5/libmatthew-java-${finalAttrs.version}.tar.gz";
     sha256 = "1yldkhsdzm0a41a0i881bin2jklhp85y3ah245jd6fz3npcx7l85";
   };
-  JAVA_HOME = jdk;
-  PREFIX = "\${out}";
+
+  env = {
+    JAVA_HOME = jdk;
+    PREFIX = "\${out}";
+  };
+
   buildInputs = [ jdk ];
 
   meta = {
diff --git a/pkgs/by-name/li/libnest2d/package.nix b/pkgs/by-name/li/libnest2d/package.nix
index eec7acc9f86c..a43427264c93 100644
--- a/pkgs/by-name/li/libnest2d/package.nix
+++ b/pkgs/by-name/li/libnest2d/package.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation {
   ];
   nativeBuildInputs = [ cmake ];
 
-  CLIPPER_PATH = "${clipper.out}";
+  env.CLIPPER_PATH = clipper.out;
+
   cmakeFlags = [ "-DLIBNEST2D_HEADER_ONLY=OFF" ];
 
   meta = {
diff --git a/pkgs/by-name/li/libnixxml/package.nix b/pkgs/by-name/li/libnixxml/package.nix
index f825d46a920a..1919f788cc0a 100644
--- a/pkgs/by-name/li/libnixxml/package.nix
+++ b/pkgs/by-name/li/libnixxml/package.nix
@@ -45,7 +45,8 @@ stdenv.mkDerivation {
     "--with-gd"
     "--with-glib"
   ];
-  CFLAGS = [
+
+  env.CFLAGS = toString [
     "-Wall"
     "-std=c90"
   ];
diff --git a/pkgs/by-name/li/libspf2/package.nix b/pkgs/by-name/li/libspf2/package.nix
index cd77d8072305..3873102de1b6 100644
--- a/pkgs/by-name/li/libspf2/package.nix
+++ b/pkgs/by-name/li/libspf2/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
       -e '/bin_PROGRAMS/s/spf_example_static//' src/spf_example/Makefile.am
   '';
 
-  CFLAGS = "-Wno-error=implicit-function-declaration";
+  env.CFLAGS = "-Wno-error=implicit-function-declaration";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/li/libxmi/package.nix b/pkgs/by-name/li/libxmi/package.nix
index b9c9cf118f30..8373958b7751 100644
--- a/pkgs/by-name/li/libxmi/package.nix
+++ b/pkgs/by-name/li/libxmi/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "03d4ikh29l38rl1wavb0icw7m5pp7yilnv7bb2k8qij1dinsymlx";
   };
 
-  CFLAGS = "-std=gnu89";
+  env.CFLAGS = "-std=gnu89";
 
   # For the x86_64 GNU/Linux arch to be recognized by 'configure'
   preConfigure = "cp ${libtool}/share/libtool/build-aux/config.sub .";
diff --git a/pkgs/by-name/li/lilypond/package.nix b/pkgs/by-name/li/lilypond/package.nix
index c81b8a6df53d..3c583d8d96e9 100644
--- a/pkgs/by-name/li/lilypond/package.nix
+++ b/pkgs/by-name/li/lilypond/package.nix
@@ -147,7 +147,11 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
   };
 
-  FONTCONFIG_FILE = lib.optional stdenv.hostPlatform.isDarwin (makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
-  });
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    FONTCONFIG_FILE = (
+      makeFontsConf {
+        fontDirectories = [ freefont_ttf ];
+      }
+    );
+  };
 })
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index 8d05f31cf4ac..fbdb9cf03a8e 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -42,7 +42,9 @@ buildGoModule rec {
 
   tags = lib.optional withGoolm "goolm";
 
-  CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
+  env = lib.optionalAttrs withGoolm {
+    CGO_LDFLAGS = toString [ cppStdLib ];
+  };
 
   vendorHash = "sha256-TFz5P8czj8J9+QTFHjffCldw8Je2+DiM49W7jv5rY/I=";
 
diff --git a/pkgs/by-name/mi/midisheetmusic/package.nix b/pkgs/by-name/mi/midisheetmusic/package.nix
index b5cce6f2adaf..4ce1d6558f35 100644
--- a/pkgs/by-name/mi/midisheetmusic/package.nix
+++ b/pkgs/by-name/mi/midisheetmusic/package.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation {
   '';
 
   # This fixes tests that fail because of missing fonts
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+  env.FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   installPhase = ''
     mkdir -p $out/share/applications $out/share/pixmaps $out/bin
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index acf407b845a6..0a4a371900a6 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.187.0",
+  "version": "3.189.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.187.0/mirrord_linux_x86_64",
-      "hash": "sha256-3a3xCVn0j4UgV5TIRu95TwEnUdKZX/usWInW6XGPa98="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.189.0/mirrord_linux_x86_64",
+      "hash": "sha256-tZHYPPCOFbWuohpTloc9ugUytal3KJDYXvu1CnXxTxI="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.187.0/mirrord_linux_aarch64",
-      "hash": "sha256-3pA3LvHEeg1maRRNoEKkYlbBAn9eXh59EcuxjLpcFTs="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.189.0/mirrord_linux_aarch64",
+      "hash": "sha256-4WQTq5Jnmi8T7EbPFNvkirGQgcDmB6P9pT/3oXBC87k="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.187.0/mirrord_mac_universal",
-      "hash": "sha256-C4lV7fh/BdawZ1P26EcigaJ/v75BSApqu6csEH27uz8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.189.0/mirrord_mac_universal",
+      "hash": "sha256-oEAfW/4Dlbv6pc8W8sRaBqS2g144W3DsNN+AJpu+eP0="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.187.0/mirrord_mac_universal",
-      "hash": "sha256-C4lV7fh/BdawZ1P26EcigaJ/v75BSApqu6csEH27uz8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.189.0/mirrord_mac_universal",
+      "hash": "sha256-oEAfW/4Dlbv6pc8W8sRaBqS2g144W3DsNN+AJpu+eP0="
     }
   }
 }
diff --git a/pkgs/by-name/mi/mission-planner/package.nix b/pkgs/by-name/mi/mission-planner/package.nix
index fcc76a92180a..662ae3430fa9 100644
--- a/pkgs/by-name/mi/mission-planner/package.nix
+++ b/pkgs/by-name/mi/mission-planner/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     runHook postUnpack
   '';
 
-  AOT_FILES = [
+  env.AOT_FILES = toString [
     "MissionPlanner.exe"
     "MissionPlanner.*.dll"
   ];
diff --git a/pkgs/by-name/n2/n2n/package.nix b/pkgs/by-name/n2/n2n/package.nix
index 3900b2da8268..5e5ffccc2ec8 100644
--- a/pkgs/by-name/n2/n2n/package.nix
+++ b/pkgs/by-name/n2/n2n/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./autogen.sh
   '';
 
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   meta = {
     description = "Peer-to-peer VPN";
diff --git a/pkgs/by-name/na/nasty/package.nix b/pkgs/by-name/na/nasty/package.nix
index d29c224af1ef..fcdfe5cceebe 100644
--- a/pkgs/by-name/na/nasty/package.nix
+++ b/pkgs/by-name/na/nasty/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # does not apply cleanly with patchPhase/fetchpatch
   # https://sources.debian.net/src/nasty/0.6-3/debian/patches/02_add_largefile_support.patch
-  CFLAGS = "-D_FILE_OFFSET_BITS=64";
+  env.CFLAGS = "-D_FILE_OFFSET_BITS=64";
 
   buildInputs = [ gpgme ];
 
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index 0aba55f33e3e..d1b8ce1c8f47 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -64,7 +64,9 @@ buildGoModule (finalAttrs: {
     "-X github.com/navidrome/navidrome/consts.gitTag=v${finalAttrs.version}"
   ];
 
-  CGO_CFLAGS = lib.optionals stdenv.cc.isGNU [ "-Wno-return-local-addr" ];
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    CGO_CFLAGS = toString [ "-Wno-return-local-addr" ];
+  };
 
   postPatch = ''
     patchShebangs ui/bin/update-workbox.sh
diff --git a/pkgs/by-name/ne/netcap/package.nix b/pkgs/by-name/ne/netcap/package.nix
index f08dfe02bcfa..92768c3334e3 100644
--- a/pkgs/by-name/ne/netcap/package.nix
+++ b/pkgs/by-name/ne/netcap/package.nix
@@ -40,22 +40,27 @@ buildGoModule (finalAttrs: {
   ];
 
   ldflags = [
-    "-s -w"
+    "-s"
+    "-w"
   ];
 
   tags = lib.optionals (!withDpi) [
     "nodpi"
   ];
 
-  CGO_LDFLAGS = lib.optionalString withDpi ''
-    -L${ndpi}/lib -lndpi
-    -L${libprotoident}/lib -lndpi
-  '';
+  env = lib.optionalAttrs withDpi {
+    CGO_LDFLAGS = toString [
+      "-L${ndpi}/lib"
+      "-lndpi"
+      "-L${libprotoident}/lib"
+      "-lndpi"
+    ];
 
-  CGO_CFLAGS = lib.optionalString withDpi ''
-    -I${ndpi}/include
-    -I${libprotoident}/include
-  '';
+    CGO_CFLAGS = toString [
+      "-I${ndpi}/include"
+      "-I${libprotoident}/include"
+    ];
+  };
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/net
diff --git a/pkgs/by-name/pa/pango/package.nix b/pkgs/by-name/pa/pango/package.nix
index 0f6edca0299a..964396c84070 100644
--- a/pkgs/by-name/pa/pango/package.nix
+++ b/pkgs/by-name/pa/pango/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [ freefont_ttf ];
   };
 
diff --git a/pkgs/by-name/pi/pick/package.nix b/pkgs/by-name/pi/pick/package.nix
index b6e8d6390302..aa00357abe68 100644
--- a/pkgs/by-name/pi/pick/package.nix
+++ b/pkgs/by-name/pi/pick/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ ncurses ];
 
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   meta = {
     inherit (finalAttrs.src.meta) homepage;
diff --git a/pkgs/by-name/pr/pragha/package.nix b/pkgs/by-name/pr/pragha/package.nix
index e4d45b2e43c1..c6acc17d9575 100644
--- a/pkgs/by-name/pr/pragha/package.nix
+++ b/pkgs/by-name/pr/pragha/package.nix
@@ -103,9 +103,10 @@ stdenv.mkDerivation (finalAttrs: {
   # ++ lib.optional withRygel rygel
   ;
 
-  CFLAGS = [ "-DHAVE_PARANOIA_NEW_INCLUDES" ];
-
-  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
+  env = {
+    CFLAGS = toString [ "-DHAVE_PARANOIA_NEW_INCLUDES" ];
+    NIX_CFLAGS_COMPILE = "-I${lib.getDev gst_all_1.gst-plugins-base}/include/gstreamer-1.0";
+  };
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/by-name/pr/professor/package.nix b/pkgs/by-name/pr/professor/package.nix
index 3c9765514cb0..63221b12a055 100644
--- a/pkgs/by-name/pr/professor/package.nix
+++ b/pkgs/by-name/pr/professor/package.nix
@@ -49,8 +49,10 @@ stdenv.mkDerivation {
     yoda
   ];
 
-  CPPFLAGS = [ "-I${eigen}/include/eigen3" ];
-  PREFIX = placeholder "out";
+  env = {
+    CPPFLAGS = toString [ "-I${eigen}/include/eigen3" ];
+    PREFIX = placeholder "out";
+  };
 
   postInstall = ''
     for prog in "$out"/bin/*; do
diff --git a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
index 5016e1ae3b7e..ea877b581c35 100644
--- a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
     hash = "sha256-NafQWP1NxHTwmOND8ovy3oVia7qq0rCwZYE3VNlMBKQ=";
   };
 
-  CGO_LDFLAGS = "-ldcgm";
+  env.CGO_LDFLAGS = "-ldcgm";
 
   buildInputs = [
     dcgm
diff --git a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
index 12ed985a6260..3ae9843f851a 100644
--- a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
@@ -38,7 +38,7 @@ buildGoModule.override { stdenv = clangStdenv; } (finalAttrs: {
     libz
   ];
 
-  CGO_LDFLAGS = "-l bpf";
+  env.CGO_LDFLAGS = "-l bpf";
 
   hardeningDisable = [ "zerocallusedregs" ];
 
diff --git a/pkgs/by-name/qb/qbootctl/package.nix b/pkgs/by-name/qb/qbootctl/package.nix
index d7f8607fb5c0..aace7b25fe1a 100644
--- a/pkgs/by-name/qb/qbootctl/package.nix
+++ b/pkgs/by-name/qb/qbootctl/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     linuxHeaders
   ];
 
-  CFLAGS = [ "-I${linuxHeaders}/include" ];
+  env.CFLAGS = toString [ "-I${linuxHeaders}/include" ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ro/routino/package.nix b/pkgs/by-name/ro/routino/package.nix
index 1eca5a57a1f9..f237c5246024 100644
--- a/pkgs/by-name/ro/routino/package.nix
+++ b/pkgs/by-name/ro/routino/package.nix
@@ -46,7 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
-  CLANG = lib.optionalString stdenv.cc.isClang "1";
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    CLANG = "1";
+  };
 
   makeFlags = [ "prefix=$(out)" ];
 
diff --git a/pkgs/by-name/si/sile/package.nix b/pkgs/by-name/si/sile/package.nix
index cc8254927814..3d8b5c8f60e5 100644
--- a/pkgs/by-name/si/sile/package.nix
+++ b/pkgs/by-name/si/sile/package.nix
@@ -97,13 +97,16 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm0644 documentation/sile.pdf $out/share/doc/sile/manual.pdf
   '';
 
-  FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [
-      gentium-plus
-    ];
+  env = {
+    FONTCONFIG_FILE = makeFontsConf {
+      fontDirectories = [
+        gentium-plus
+      ];
+    };
+    LUA = "${finalAttrs.finalPackage.passthru.luaEnv}/bin/lua";
   };
+
   strictDeps = true;
-  env.LUA = "${finalAttrs.finalPackage.passthru.luaEnv}/bin/lua";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/st/stardust-xr-server/package.nix b/pkgs/by-name/st/stardust-xr-server/package.nix
index 1dd85f7337d8..fce5180c1cda 100644
--- a/pkgs/by-name/st/stardust-xr-server/package.nix
+++ b/pkgs/by-name/st/stardust-xr-server/package.nix
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     libxfixes
   ];
 
-  CPM_SOURCE_CACHE = "./build";
+  env.CPM_SOURCE_CACHE = "./build";
 
   postPatch = ''
     install -D ${cpm-cmake}/share/cpm/CPM.cmake $(echo $cargoDepsCopy/stereokit-sys-*/StereoKit)/build/cpm/CPM_0.32.2.cmake
diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index 5a061773979f..e06231993204 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     "-X github.com/smallstep/step-kms-plugin/cmd.Version=${version}"
   ];
 
-  CGO_CFLAGS = "-I${lib.getDev pcsclite}/include/PCSC/";
+  env.CGO_CFLAGS = "-I${lib.getDev pcsclite}/include/PCSC/";
 
   meta = {
     description = "Step plugin to manage keys and certificates on cloud KMSs and HSMs";
diff --git a/pkgs/by-name/st/stp/package.nix b/pkgs/by-name/st/stp/package.nix
index 45eb1b76ca84..e0aeae745c26 100644
--- a/pkgs/by-name/st/stp/package.nix
+++ b/pkgs/by-name/st/stp/package.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
   #
   # TODO: Remove these CFLAGS when they update to the version that pulls `abc` in with a submodule.
   # https://github.com/stp/stp/issues/498#issuecomment-2611251631
-  CFLAGS = [ "-fsigned-char" ];
+  env.CFLAGS = toString [ "-fsigned-char" ];
 
   outputs = [
     "dev"
diff --git a/pkgs/by-name/sy/symmetrica/package.nix b/pkgs/by-name/sy/symmetrica/package.nix
index 44abbae5d9ae..8ce216072e8b 100644
--- a/pkgs/by-name/sy/symmetrica/package.nix
+++ b/pkgs/by-name/sy/symmetrica/package.nix
@@ -29,7 +29,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   # clang warning: passing arguments to '...' without a prototype is deprecated
   # in all versions of C and is not supported in C23.
-  CFLAGS = "-std=c99 -Wno-deprecated-non-prototype";
+  env.CFLAGS = toString [
+    "-std=c99"
+    "-Wno-deprecated-non-prototype"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/sy/syncterm/package.nix b/pkgs/by-name/sy/syncterm/package.nix
index 09c4701290a6..1f85ae6b7bd4 100644
--- a/pkgs/by-name/sy/syncterm/package.nix
+++ b/pkgs/by-name/sy/syncterm/package.nix
@@ -24,16 +24,18 @@ stdenv.mkDerivation (finalAttrs: {
   # We can't use sourceRoot, as the cherry-picked patches apply to files outside of it.
   postPatch = "cd src/syncterm";
 
-  CFLAGS = [
-    "-DHAS_INTTYPES_H"
-    "-DXPDEV_DONT_DEFINE_INTTYPES"
+  env.CFLAGS = toString (
+    [
+      "-DHAS_INTTYPES_H"
+      "-DXPDEV_DONT_DEFINE_INTTYPES"
 
-    "-Wno-unused-result"
-    "-Wformat-overflow=0"
-  ]
-  ++ (lib.optionals stdenv.hostPlatform.isLinux [
-    "-DUSE_ALSA_SOUND" # Don't use OSS for beeps.
-  ]);
+      "-Wno-unused-result"
+      "-Wformat-overflow=0"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "-DUSE_ALSA_SOUND" # Don't use OSS for beeps.
+    ]
+  );
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index d694e00b0340..4d405112e548 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
     "-w"
   ];
 
-  CGO_CFLAGS = [ "-Wno-format-security" ];
+  env.CGO_CFLAGS = toString [ "-Wno-format-security" ];
 
   preCheck = ''
     # Remove tests that require additional services.
diff --git a/pkgs/by-name/te/telepathy-glib/package.nix b/pkgs/by-name/te/telepathy-glib/package.nix
index def1350fefff..ad602c4e47da 100644
--- a/pkgs/by-name/te/telepathy-glib/package.nix
+++ b/pkgs/by-name/te/telepathy-glib/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-vala-bindings"
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/to/tokstat/package.nix b/pkgs/by-name/to/tokstat/package.nix
index 0dacafa6e359..e7688e83a882 100644
--- a/pkgs/by-name/to/tokstat/package.nix
+++ b/pkgs/by-name/to/tokstat/package.nix
@@ -35,7 +35,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   # For keyring support
-  PKG_CONFIG_PATH = lib.optionalString stdenv.hostPlatform.isLinux "${dbus.dev}/lib/pkgconfig";
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    PKG_CONFIG_PATH = "${dbus.dev}/lib/pkgconfig";
+  };
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # Generate shell completions
diff --git a/pkgs/by-name/to/topydo/package.nix b/pkgs/by-name/to/topydo/package.nix
index 785b08f1113f..e25dad19a277 100644
--- a/pkgs/by-name/to/topydo/package.nix
+++ b/pkgs/by-name/to/topydo/package.nix
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     substituteInPlace test/test_revert_command.py --replace 'test_revert_ls' 'dont_test_revert_ls'
   '';
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   meta = {
     description = "Cli todo application compatible with the todo.txt format";
diff --git a/pkgs/by-name/tu/turses/package.nix b/pkgs/by-name/tu/turses/package.nix
index 93e689feb27c..a24ee8d7dcb5 100644
--- a/pkgs/by-name/tu/turses/package.nix
+++ b/pkgs/by-name/tu/turses/package.nix
@@ -71,7 +71,7 @@ buildPythonPackage rec {
     tox
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/by-name/un/unixcw/package.nix b/pkgs/by-name/un/unixcw/package.nix
index 913bd71693bf..b5b0d148600e 100644
--- a/pkgs/by-name/un/unixcw/package.nix
+++ b/pkgs/by-name/un/unixcw/package.nix
@@ -43,7 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ];
 
-  CFLAGS = "-lasound -lpulse-simple";
+  env.CFLAGS = toString [
+    "-lasound"
+    "-lpulse-simple"
+  ];
 
   meta = {
     description = "Sound characters as Morse code on the soundcard or console speaker";
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index a4739e8b5b43..c1999351dc10 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./vtsls-build-patch.patch ];
 
   # Skips manual confirmations during build
-  CI = true;
+  env.CI = true;
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/ya/yafetch/package.nix b/pkgs/by-name/ya/yafetch/package.nix
index a52d9d0660cb..5515650b8f0c 100644
--- a/pkgs/by-name/ya/yafetch/package.nix
+++ b/pkgs/by-name/ya/yafetch/package.nix
@@ -24,7 +24,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   '';
 
   # Fixes installation path
-  PREFIX = placeholder "out";
+  env.PREFIX = placeholder "out";
 
   meta = {
     homepage = "https://github.com/kira64xyz/yafetch";
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 76889dfef407..0652a31dee30 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.224.6";
+  version = "0.224.8";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GbTWkD+JVYr+jem9MBQ4bTtPDogIU1XfQy2RmsnY9uI=";
+    hash = "sha256-rY2g35gRtuQ9si9GYPjmq3boPsTkTD0OZET6dmR597A=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-FTbxMJrub0l0hL8zisD2Ov9JXIRwZjOuTkzjmrImOd4=";
+  cargoHash = "sha256-eJwvUtZobIRXKJOyERczTRQzDR7ml3uqgWMd+vXStQE=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 863684149df2..2e4d3c1b1997 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -16,17 +16,7 @@
   fetchpatch,
   fetchFromGitHub,
   makeSetupHook,
-  makeWrapper,
-  bison,
-  cups ? null,
-  harfbuzz,
-  libGL,
-  perl,
   python3,
-  gstreamer,
-  gst-plugins-base,
-  gtk3,
-  dconf,
   llvmPackages_19,
   darwin,
 
@@ -282,14 +272,7 @@ let
       qtbase = callPackage ../modules/qtbase.nix {
         inherit (srcs.qtbase) src version;
         patches = patches.qtbase;
-        inherit
-          bison
-          cups
-          harfbuzz
-          libGL
-          ;
         withGtk3 = !stdenv.hostPlatform.isDarwin;
-        inherit dconf gtk3;
         inherit developerBuild decryptSslTraffic;
       };
 
@@ -305,9 +288,7 @@ let
       qtlocation = callPackage ../modules/qtlocation.nix { };
       qtlottie = callPackage ../modules/qtlottie.nix { };
       qtmacextras = callPackage ../modules/qtmacextras.nix { };
-      qtmultimedia = callPackage ../modules/qtmultimedia.nix {
-        inherit gstreamer gst-plugins-base;
-      };
+      qtmultimedia = callPackage ../modules/qtmultimedia.nix { };
       qtnetworkauth = callPackage ../modules/qtnetworkauth.nix { };
       qtpim = callPackage ../modules/qtpim.nix { };
       qtpositioning = callPackage ../modules/qtpositioning.nix { };
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 5e39b035877e..028b9e4e2d93 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -56,7 +56,6 @@
   withGtk3 ? false,
   dconf,
   gtk3,
-  withQttranslation ? true,
   qttranslations ? null,
   withLibinput ? false,
   libinput,
@@ -492,8 +491,7 @@ stdenv.mkDerivation (
             "-I"
             "${libmysqlclient}/include"
           ]
-          ++ lib.optional (withQttranslation && (qttranslations != null)) [
-            # depends on x11
+          ++ lib.optional (qttranslations != null) [
             "-translationdir"
             "${qttranslations}/translations"
           ]
diff --git a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
index d54bbd0a9284..b4ff43033bc2 100644
--- a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
@@ -6,8 +6,7 @@
   qtdeclarative,
   pkg-config,
   alsa-lib,
-  gstreamer,
-  gst-plugins-base,
+  gst_all_1,
   libpulseaudio,
   wayland,
 }:
@@ -19,16 +18,18 @@ qtModule {
     qtdeclarative
   ];
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    gstreamer
-    gst-plugins-base
-  ]
-  # https://github.com/NixOS/nixpkgs/pull/169336 regarding libpulseaudio
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libpulseaudio
-    alsa-lib
-    wayland
-  ];
+  buildInputs =
+    with gst_all_1;
+    [
+      gstreamer
+      gst-plugins-base
+    ]
+    # https://github.com/NixOS/nixpkgs/pull/169336 regarding libpulseaudio
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libpulseaudio
+      alsa-lib
+      wayland
+    ];
   outputs = [
     "bin"
     "dev"
diff --git a/pkgs/development/libraries/waylandpp/default.nix b/pkgs/development/libraries/waylandpp/default.nix
index 6d0b9dea1dd0..61ac0a51cfdc 100644
--- a/pkgs/development/libraries/waylandpp/default.nix
+++ b/pkgs/development/libraries/waylandpp/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Complains about not being able to find the fontconfig config file otherwise
-  FONTCONFIG_FILE = lib.optional docSupport (makeFontsConf {
+  env.FONTCONFIG_FILE = lib.optional docSupport (makeFontsConf {
     fontDirectories = [ ];
   });
 
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index 3af28161ba4e..c8793df35e88 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -62,10 +62,14 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
     fetchSubmodules = true;
   };
 
-  env.LDFLAGS = toString [
-    # Fake libcuda.so (the real one is deployed impurely)
-    "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"
-  ];
+  env = {
+    LDFLAGS = toString [
+      # Fake libcuda.so (the real one is deployed impurely)
+      "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"
+    ];
+    # NVCC = "${lib.getExe cudaPackages.cuda_nvcc}"; # FIXME: splicing/buildPackages
+    CUDA_PATH = "${cudatoolkit-joined}";
+  };
 
   # See https://docs.cupy.dev/en/v10.2.0/reference/environment.html. Setting both
   # CUPY_NUM_BUILD_JOBS and CUPY_NUM_NVCC_THREADS to NIX_BUILD_CORES results in
@@ -95,9 +99,6 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
     nccl
   ];
 
-  # NVCC = "${lib.getExe cudaPackages.cuda_nvcc}"; # FIXME: splicing/buildPackages
-  CUDA_PATH = "${cudatoolkit-joined}";
-
   dependencies = [
     fastrlock
     numpy
diff --git a/pkgs/development/python-modules/rainbowstream/default.nix b/pkgs/development/python-modules/rainbowstream/default.nix
index a99caaf67a2c..ef28ecfe3b36 100644
--- a/pkgs/development/python-modules/rainbowstream/default.nix
+++ b/pkgs/development/python-modules/rainbowstream/default.nix
@@ -57,7 +57,7 @@ buildPythonPackage {
     sed -i 's/requests.*"/requests"/' setup.py
   '';
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   postInstall = ''
     mkdir -p $out/lib
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 108f411a52ef..b9cf66d2e283 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -23,7 +23,7 @@
   writeText,
   debug ? false,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sgx-sdk";
   # Version as given in se_version.h
   version = "2.24.100.3";
@@ -33,15 +33,15 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
-    rev = "sgx_${versionTag}";
+    rev = "sgx_${finalAttrs.versionTag}";
     hash = "sha256-1urEdfMKNUqqyJ3wQ10+tvtlRuAKELpaCWIOzjCbYKw=";
     fetchSubmodules = true;
   };
 
   postUnpack = ''
     # Make sure this is the right version of linux-sgx
-    grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
-      || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
+    grep -q '"${finalAttrs.version}"' "$src/common/inc/internal/se_version.h" \
+      || (echo "Could not find expected version ${finalAttrs.version} in linux-sgx source" >&2 && exit 1)
   '';
 
   patches = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     openssl
   ];
 
-  BINUTILS_DIR = "${binutils}/bin";
+  env.BINUTILS_DIR = "${binutils}/bin";
 
   # Build external/ippcp_internal first. The Makefile is rewritten to make the
   # build faster by splitting different versions of ipp-crypto builds and to
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
     let
       ipp-crypto-no_mitigation = callPackage ./ipp-crypto.nix { };
 
-      sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
+      sgx-asm-pp = "python ${finalAttrs.src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
 
       nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
       ipp-crypto-cve_2020_0551_load = callPackage ./ipp-crypto.nix {
@@ -149,14 +149,14 @@ stdenv.mkDerivation rec {
   ];
 
   postBuild = ''
-    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${version}.bin
+    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin
   '';
 
   installPhase = ''
     runHook preInstall
 
     installDir=$TMPDIR
-    ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
+    ./linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin -prefix $installDir
     installDir=$installDir/sgxsdk
 
     echo "Move files created by installer"
@@ -239,7 +239,7 @@ stdenv.mkDerivation rec {
     echo "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
       --replace 'BINUTILS_DIR ?= /usr/local/bin' \
-                'BINUTILS_DIR ?= ${BINUTILS_DIR}'
+                'BINUTILS_DIR ?= ${finalAttrs.env.BINUTILS_DIR}'
 
     echo "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
@@ -301,4 +301,4 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" ];
     license = [ lib.licenses.bsd3 ];
   };
-}
+})
diff --git a/pkgs/tools/misc/dvtm/dvtm.nix b/pkgs/tools/misc/dvtm/dvtm.nix
index bf162bbce815..fcebb7734b36 100644
--- a/pkgs/tools/misc/dvtm/dvtm.nix
+++ b/pkgs/tools/misc/dvtm/dvtm.nix
@@ -17,7 +17,9 @@ stdenv.mkDerivation {
     patches
     ;
 
-  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CFLAGS = "-D_DARWIN_C_SOURCE";
+  };
 
   postPatch = lib.optionalString (customConfig != null) ''
     cp ${builtins.toFile "config.h" customConfig} ./config.h
diff --git a/pkgs/tools/networking/openvpn/update-systemd-resolved.nix b/pkgs/tools/networking/openvpn/update-systemd-resolved.nix
index 51ce93de31aa..a39e6db754c3 100644
--- a/pkgs/tools/networking/openvpn/update-systemd-resolved.nix
+++ b/pkgs/tools/networking/openvpn/update-systemd-resolved.nix
@@ -9,7 +9,7 @@
   util-linux,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "update-systemd-resolved";
   # when updating this, check if additional binaries need injecting into PATH
   version = "1.3.0";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "jonathanio";
     repo = "update-systemd-resolved";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-lYJTR3oBmpENcqNHa9PFXsw7ly6agwjBWf4UXf1d8Kc=";
   };
 
@@ -26,10 +26,10 @@ stdenv.mkDerivation rec {
     ./update-systemd-resolved.patch
   ];
 
-  PREFIX = "${placeholder "out"}/libexec/openvpn";
+  env.PREFIX = "${placeholder "out"}/libexec/openvpn";
 
   postInstall = ''
-    substituteInPlace ${PREFIX}/update-systemd-resolved \
+    substituteInPlace ${finalAttrs.env.PREFIX}/update-systemd-resolved \
       --subst-var-by PATH ${
         lib.makeBinPath [
           coreutils
@@ -48,4 +48,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ eadwu ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dece217a9351..82a7521b81af 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7380,35 +7380,7 @@ with pkgs;
     python3 = null;
   };
 
-  qt5 = recurseIntoAttrs (
-    makeOverridable (import ../development/libraries/qt-5/5.15) {
-      inherit (__splicedPackages)
-        makeScopeWithSplicing'
-        generateSplicesForMkScope
-        lib
-        stdenv
-        gcc14Stdenv
-        fetchurl
-        fetchpatch
-        fetchgit
-        fetchFromGitHub
-        makeSetupHook
-        makeWrapper
-        bison
-        cups
-        dconf
-        harfbuzz
-        libGL
-        perl
-        gtk3
-        python3
-        llvmPackages_19
-        darwin
-        ;
-      inherit (__splicedPackages.gst_all_1) gstreamer gst-plugins-base;
-      inherit config;
-    }
-  );
+  qt5 = recurseIntoAttrs (__splicedPackages.callPackage ../development/libraries/qt-5/5.15 { });
 
   libsForQt5 = recurseIntoAttrs (
     import ./qt5-packages.nix {