diff --git a/pkgs/by-name/te/teapot/package.nix b/pkgs/by-name/te/teapot/package.nix
index 89fdd6b4b214..31a2fefaec79 100644
--- a/pkgs/by-name/te/teapot/package.nix
+++ b/pkgs/by-name/te/teapot/package.nix
@@ -32,9 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ];
 
-  # By no known reason libtirpc is not detected
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
-  NIX_LDFLAGS = [ "-ltirpc" ];
+  env = {
+    # By no known reason libtirpc is not detected
+    NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+    NIX_LDFLAGS = [ "-ltirpc" ];
+  };
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
diff --git a/pkgs/by-name/te/tenacity/package.nix b/pkgs/by-name/te/tenacity/package.nix
index be4b431566fc..eefa424ddbdf 100644
--- a/pkgs/by-name/te/tenacity/package.nix
+++ b/pkgs/by-name/te/tenacity/package.nix
@@ -108,18 +108,20 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH"
   '';
 
-  # Tenacity only looks for ffmpeg at runtime, so we need to link it in manually.
-  # On darwin, these are ignored by the ffmpeg search even when linked.
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux (toString [
-    "-lavcodec"
-    "-lavdevice"
-    "-lavfilter"
-    "-lavformat"
-    "-lavutil"
-    "-lpostproc"
-    "-lswresample"
-    "-lswscale"
-  ]);
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # Tenacity only looks for ffmpeg at runtime, so we need to link it in manually.
+    # On darwin, these are ignored by the ffmpeg search even when linked.
+    NIX_LDFLAGS = toString [
+      "-lavcodec"
+      "-lavdevice"
+      "-lavfilter"
+      "-lavformat"
+      "-lavutil"
+      "-lpostproc"
+      "-lswresample"
+      "-lswscale"
+    ];
+  };
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ti/timemachine/package.nix b/pkgs/by-name/ti/timemachine/package.nix
index 53a088d01167..72f4afa55e41 100644
--- a/pkgs/by-name/ti/timemachine/package.nix
+++ b/pkgs/by-name/ti/timemachine/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/by-name/tr/transgui/package.nix b/pkgs/by-name/tr/transgui/package.nix
index 706d43f47009..0add18952d72 100644
--- a/pkgs/by-name/tr/transgui/package.nix
+++ b/pkgs/by-name/tr/transgui/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     openssl
   ];
 
-  NIX_LDFLAGS = ''
+  env.NIX_LDFLAGS = ''
     -L${lib.getLib stdenv.cc.cc}/lib -lX11 -lglib-2.0 -lgtk-x11-2.0
     -lgdk-x11-2.0 -lgdk_pixbuf-2.0 -lpango-1.0 -latk-1.0 -lcairo
     -lc -lcrypto
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     "INSTALL_PREFIX=$(out)"
   ];
 
-  LCL_PLATFORM = "gtk2";
+  env.LCL_PLATFORM = "gtk2";
 
   desktopItem = makeDesktopItem {
     name = pname;
diff --git a/pkgs/by-name/tr/trickle/package.nix b/pkgs/by-name/tr/trickle/package.nix
index 822c250c1ad7..f1d606714a0f 100644
--- a/pkgs/by-name/tr/trickle/package.nix
+++ b/pkgs/by-name/tr/trickle/package.nix
@@ -44,14 +44,16 @@ stdenv.mkDerivation {
     sed -i 's|^_select(int|select(int|' trickle-overload.c
   '';
 
-  NIX_LDFLAGS = [
-    "-levent"
-    "-ltirpc"
-  ];
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-I${libtirpc.dev}/include/tirpc"
-    "-Wno-error=incompatible-pointer-types"
-  ];
+  env = {
+    NIX_LDFLAGS = toString [
+      "-levent"
+      "-ltirpc"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      "-I${libtirpc.dev}/include/tirpc"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
 
   configureFlags = [ "--with-libevent" ];
 
diff --git a/pkgs/by-name/un/unicorn-angr/package.nix b/pkgs/by-name/un/unicorn-angr/package.nix
index bb076522518d..061b9120ec04 100644
--- a/pkgs/by-name/un/unicorn-angr/package.nix
+++ b/pkgs/by-name/un/unicorn-angr/package.nix
@@ -23,8 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  env = lib.optionalAttrs stdenv.hostPlatform.isRiscV {
+    # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
+    NIX_LDFLAGS = "-latomic";
+  };
 
   cmakeFlags = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Some x86 tests are interrupted by signal 10
diff --git a/pkgs/by-name/un/unicorn/package.nix b/pkgs/by-name/un/unicorn/package.nix
index 54d524e33ff8..156ca182d110 100644
--- a/pkgs/by-name/un/unicorn/package.nix
+++ b/pkgs/by-name/un/unicorn/package.nix
@@ -26,8 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
     cctools
   ];
 
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  env = lib.optionalAttrs stdenv.hostPlatform.isRiscV {
+    # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
+    NIX_LDFLAGS = "-latomic";
+  };
 
   cmakeFlags = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Some x86 tests are interrupted by signal 10
diff --git a/pkgs/by-name/un/unified-memory-framework/package.nix b/pkgs/by-name/un/unified-memory-framework/package.nix
index eee9ed639a9f..a41bf4644056 100644
--- a/pkgs/by-name/un/unified-memory-framework/package.nix
+++ b/pkgs/by-name/un/unified-memory-framework/package.nix
@@ -125,11 +125,13 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   dontUseNinjaCheck = true;
 
-  NIX_LDFLAGS = lib.optionalString finalAttrs.doCheck "-rpath ${
-    lib.makeLibraryPath [
-      onetbb
-    ]
-  }";
+  env = lib.optionalAttrs finalAttrs.doCheck {
+    NIX_LDFLAGS = "-rpath ${
+      lib.makeLibraryPath [
+        onetbb
+      ]
+    }";
+  };
 
   disabledTests = [
     # These tests try to access sysfs, which is unavailable in the sandbox
diff --git a/pkgs/by-name/un/unzip/package.nix b/pkgs/by-name/un/unzip/package.nix
index efe3226d6cdd..985daead4d35 100644
--- a/pkgs/by-name/un/unzip/package.nix
+++ b/pkgs/by-name/un/unzip/package.nix
@@ -79,7 +79,16 @@ stdenv.mkDerivation rec {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = "-lbz2" + lib.optionalString enableNLS " -lnatspec";
+  env = {
+    NIX_LDFLAGS = toString (
+      [
+        "-lbz2"
+      ]
+      ++ lib.optionals enableNLS [
+        "-lnatspec"
+      ]
+    );
+  };
 
   buildFlags = [
     "generic"
diff --git a/pkgs/by-name/vs/vsftpd/package.nix b/pkgs/by-name/vs/vsftpd/package.nix
index 1e9b8c79d155..33bca86ea867 100644
--- a/pkgs/by-name/vs/vsftpd/package.nix
+++ b/pkgs/by-name/vs/vsftpd/package.nix
@@ -56,7 +56,14 @@ stdenv.mkDerivation (finalAttrs: {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
-  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap -lseccomp";
+  env.NIX_LDFLAGS = toString [
+    "-lcrypt"
+    "-lssl"
+    "-lcrypto"
+    "-lpam"
+    "-lcap"
+    "-lseccomp"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/wa/watchexec/package.nix b/pkgs/by-name/wa/watchexec/package.nix
index e43e6c7ccf1c..d3553f90056f 100644
--- a/pkgs/by-name/wa/watchexec/package.nix
+++ b/pkgs/by-name/wa/watchexec/package.nix
@@ -22,7 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework AppKit";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = toString [
+      "-framework"
+      "AppKit"
+    ];
+  };
 
   checkFlags = [
     "--skip=help"
diff --git a/pkgs/by-name/x1/x11spice/package.nix b/pkgs/by-name/x1/x11spice/package.nix
index 1e3d42e4dc31..df02a65b80a7 100644
--- a/pkgs/by-name/x1/x11spice/package.nix
+++ b/pkgs/by-name/x1/x11spice/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     spice-protocol
   ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = {
     description = "Enable a running X11 desktop to be available via a Spice server";
diff --git a/pkgs/by-name/xd/xdg-user-dirs/package.nix b/pkgs/by-name/xd/xdg-user-dirs/package.nix
index c0423a044442..3b87f75c7f07 100644
--- a/pkgs/by-name/xd/xdg-user-dirs/package.nix
+++ b/pkgs/by-name/xd/xdg-user-dirs/package.nix
@@ -37,7 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
     libintl
   ];
 
-  NIX_LDFLAGS = if stdenv.isDarwin then "-liconv" else null;
+  env = lib.optionalAttrs stdenv.isDarwin {
+    NIX_LDFLAGS = "-liconv";
+  };
 
   preFixup = ''
     # fallback values need to be last
diff --git a/pkgs/by-name/xf/xfitter/package.nix b/pkgs/by-name/xf/xfitter/package.nix
index c867258bbaee..57530ebc6768 100644
--- a/pkgs/by-name/xf/xfitter/package.nix
+++ b/pkgs/by-name/xf/xfitter/package.nix
@@ -66,10 +66,10 @@ stdenv.mkDerivation {
                      'cmake_minimum_required(VERSION 3.10)'
   '';
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.hostPlatform.libc == "glibc"
-  ) "-I${libtirpc.dev}/include/tirpc";
-  NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
+  env = lib.optionalAttrs (stdenv.hostPlatform.libc == "glibc") {
+    NIX_CFLAGS_COMPILE = "-I${libtirpc.dev}/include/tirpc";
+    NIX_LDFLAGS = "-ltirpc";
+  };
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/by-name/xi/xidel/package.nix b/pkgs/by-name/xi/xidel/package.nix
index b28e17732440..703b77bf50b1 100644
--- a/pkgs/by-name/xi/xidel/package.nix
+++ b/pkgs/by-name/xi/xidel/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ fpc ];
   buildInputs = [ openssl ];
 
-  NIX_LDFLAGS = [ "-lcrypto" ];
+  env.NIX_LDFLAGS = toString [ "-lcrypto" ];
 
   patchPhase = ''
     patchShebangs \
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 0d0d713b443a..abf6cf39530e 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -79,7 +79,7 @@ lib.fix (
     configureFlags = [ "--enable-soap" ];
 
     # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-    NIX_LDFLAGS = "-lgcrypt";
+    env.NIX_LDFLAGS = "-lgcrypt";
 
     postInstall = ''
       moveToOutput "bin/xmlsec1-config" "$dev"
diff --git a/pkgs/by-name/zl/zlcompressor/package.nix b/pkgs/by-name/zl/zlcompressor/package.nix
index 9b8ce4235eb3..a7fff69c4ddd 100644
--- a/pkgs/by-name/zl/zlcompressor/package.nix
+++ b/pkgs/by-name/zl/zlcompressor/package.nix
@@ -67,24 +67,25 @@ clangStdenv.mkDerivation (finalAttrs: {
   ];
 
   # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZlEqualizer#clone-and-build
diff --git a/pkgs/by-name/zl/zlequalizer/package.nix b/pkgs/by-name/zl/zlequalizer/package.nix
index 91318d2abaa7..23c73cf7e126 100644
--- a/pkgs/by-name/zl/zlequalizer/package.nix
+++ b/pkgs/by-name/zl/zlequalizer/package.nix
@@ -66,25 +66,27 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxkbcommon
   ];
 
-  # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    # JUCE dlopen's these at runtime, crashes without them
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZLEqualizer#clone-and-build
diff --git a/pkgs/by-name/zl/zlsplitter/package.nix b/pkgs/by-name/zl/zlsplitter/package.nix
index fd2f7e4aa15f..2c2097366078 100644
--- a/pkgs/by-name/zl/zlsplitter/package.nix
+++ b/pkgs/by-name/zl/zlsplitter/package.nix
@@ -66,25 +66,26 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxkbcommon
   ];
 
-  # JUCE dlopen's these at runtime, crashes without them
-  NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    "-lX11"
-    "-lXext"
-    "-lXcursor"
-    "-lXinerama"
-    "-lXrandr"
-  ]);
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString clangStdenv.hostPlatform.isLinux (toString [
-    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
-    # a Link Time Optimization flag, and instructs the plugin compiled here to
-    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
-    # successful linking while still providing LTO benefits. If our build of
-    # `juce` was used as a dependency, we could have patched that `-flto` line
-    # in our juce's source, but that is not possible because it is used as a
-    # Git Submodule.
-    "-ffat-lto-objects"
-  ]);
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    # JUCE dlopen's these at runtime, crashes without them
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXext"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+    ];
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
 
   cmakeFlags = [
     # see: https://github.com/ZL-Audio/ZlEqualizer#clone-and-build
diff --git a/pkgs/by-name/zr/zrythm/package.nix b/pkgs/by-name/zr/zrythm/package.nix
index df928b135fd3..815fd6f3c795 100644
--- a/pkgs/by-name/zr/zrythm/package.nix
+++ b/pkgs/by-name/zr/zrythm/package.nix
@@ -178,11 +178,14 @@ stdenv.mkDerivation (finalAttrs: {
     # "-Duser_manual=true" # needs sphinx-intl
   ];
 
-  NIX_LDFLAGS = ''
-    -lfftw3_threads -lfftw3f_threads
-  '';
+  env = {
+    NIX_LDFLAGS = toString [
+      "-lfftw3_threads"
+      "-lfftw3f_threads"
+    ];
 
-  GUILE_AUTO_COMPILE = 0;
+    GUILE_AUTO_COMPILE = 0;
+  };
 
   dontStrip = true;
 
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index ad8fef2839c1..ce8fc1d8ea23 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -70,7 +70,13 @@ stdenv.mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl -L${libmysqlclient}/lib/mariadb";
+  env.NIX_LDFLAGS = toString [
+    "-lgvc"
+    "-lmysqlclient"
+    "-lecpg"
+    "-lssl"
+    "-L${libmysqlclient}/lib/mariadb"
+  ];
 
   qtWrapperArgs = [
     "--prefix PATH : ${lib.getBin graphviz}/bin"