diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index a6942445fc5f..599e6586ea03 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -5,7 +5,6 @@
 , meson
 , ninja
 , gettext
-, gobject-introspection
 , python3
 , gstreamer
 , orc
@@ -37,6 +36,8 @@
 , enableCdparanoia ? (!stdenv.isDarwin)
 , cdparanoia
 , glib
+, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -50,6 +51,7 @@ stdenv.mkDerivation rec {
     sha256 = "0162ly7pscymq6bsf1d5fva2k9s16zvfwyi1q6z4yfd97d0sdn4n";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
@@ -58,10 +60,11 @@ stdenv.mkDerivation rec {
     gettext
     orc
     glib
-    gobject-introspection
-
+    gstreamer
     # docs
     # TODO add hotdoc here
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optional enableWayland wayland;
 
   buildInputs = [
@@ -88,6 +91,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals enableWayland [
     wayland
     wayland-protocols
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optional enableCocoa Cocoa
     ++ lib.optional enableCdparanoia cdparanoia;
 
@@ -101,8 +106,8 @@ stdenv.mkDerivation rec {
     "-Dgl-graphene=disabled" # not packaged in nixpkgs as of writing
     # See https://github.com/GStreamer/gst-plugins-base/blob/d64a4b7a69c3462851ff4dcfa97cc6f94cd64aef/meson_options.txt#L15 for a list of choices
     "-Dgl_winsys=${lib.concatStringsSep "," (lib.optional enableX11 "x11" ++ lib.optional enableWayland "wayland" ++ lib.optional enableCocoa "cocoa")}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
     "-Dtests=disabled"
   ]
   ++ lib.optional (!enableX11) "-Dx11=disabled"
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index dcb4fcaef93f..c5f836f26a46 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -4,7 +4,6 @@
 , ninja
 , pkg-config
 , gettext
-, gobject-introspection
 , bison
 , flex
 , python3
@@ -17,6 +16,8 @@
 , bash-completion
 , lib
 , CoreServices
+, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cghi6n4nhdbajz3wqcgbh5xm94myvnqgsi9g2bz9n1s9904l2fy";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
@@ -47,11 +49,14 @@ stdenv.mkDerivation rec {
     python3
     makeWrapper
     glib
-    gobject-introspection
     bash-completion
 
     # documentation
     # TODO add hotdoc here
+  ] ++ lib.optionals stdenv.isLinux [
+    libcap # for setcap binary
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -60,6 +65,8 @@ stdenv.mkDerivation rec {
     libcap
     libunwind
     elfutils
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     CoreServices
   ];
@@ -72,8 +79,7 @@ stdenv.mkDerivation rec {
     "-Ddbghelp=disabled" # not needed as we already provide libunwind and libdw, and dbghelp is a fallback to those
     "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
     "-Ddoc=disabled" # `hotdoc` not packaged in nixpkgs as of writing
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals stdenv.isDarwin [
     # darwin.libunwind doesn't have pkg-config definitions so meson doesn't detect it.
     "-Dlibunwind=disabled"
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 77c595c9184a..02c02b607e5c 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -13,7 +13,7 @@
 , python3
 , tzdata
 , fixDarwinDylibNames
-, introspectionSupport ? stdenv.buildPlatform == stdenv.hostPlatform
+, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , gobject-introspection
 , vala
 }:
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gZ6IBjG5pNKJ+hWcTzXMP7yxL4he4LTklZGoC9vXra8=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     cmake
     ninja
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # provides ical-glib-src-generator that runs during build
     libical
-  ] ++ lib.optionals introspectionSupport [
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
     vala
   ] ++ lib.optionals stdenv.isDarwin [
@@ -60,13 +61,14 @@ stdenv.mkDerivation rec {
     glib
     libxml2
     icu
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   cmakeFlags = [
     "-DENABLE_GTK_DOC=False"
-  ] ++ lib.optionals introspectionSupport [
-    "-DGOBJECT_INTROSPECTION=True"
-    "-DICAL_GLIB_VAPI=True"
+    "-DGOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
+    "-DICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DIMPORT_ICAL_GLIB_SRC_GENERATOR=${lib.getDev buildPackages.libical}/lib/cmake/LibIcal/IcalGlibSrcGenerator.cmake"
   ];
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 6d14a3293fca..bda8d8ab30c5 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -2,7 +2,7 @@
   lib, stdenv, buildPackages, fetchurl, fetchpatch,
   runCommand,
   autoreconfHook,
-  autoconf, automake, libtool,
+  autoconf, automake, libtool, bash,
   # Enabling python support while cross compiling would be possible, but
   # the configure script tries executing python to gather info instead of
   # relying on python3-config exclusively
@@ -21,9 +21,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "man" ];
 
+  strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = lib.optionals enablePython [ python3 swig ];
+  nativeBuildInputs = [ autoreconfHook ]
+    ++ lib.optionals enablePython [ python3 swig ];
+  buildInputs = [ bash ];
 
   configureFlags = [
     # z/OS plugin is not useful on Linux,