diff --git a/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix b/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
index 5ac38f7db782..61cae422b3a3 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     xapian
     zlib
   ];
-  XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
+  env.XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
   meta = {
     description = "Synchronize maildirs and notmuch databases";
     mainProgram = "muchsync";
diff --git a/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix b/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix
index ddbd9a2d9f0c..6695557259d2 100644
--- a/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix
+++ b/pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix
@@ -62,8 +62,10 @@ stdenv.mkDerivation (finalAttrs: {
     touch $XDG_CONFIG_HOME/icedtea-web/deployment.properties
   '';
 
-  HOME = "/build";
-  XDG_CONFIG_HOME = "/build";
+  env = {
+    HOME = "/build";
+    XDG_CONFIG_HOME = "/build";
+  };
 
   configureFlags = [
     "--with-itw-libs=DISTRIBUTION"
diff --git a/pkgs/by-name/av/avalonia/package.nix b/pkgs/by-name/av/avalonia/package.nix
index 5f61347de915..df352c0eab12 100644
--- a/pkgs/by-name/av/avalonia/package.nix
+++ b/pkgs/by-name/av/avalonia/package.nix
@@ -70,11 +70,21 @@ stdenvNoCC.mkDerivation (
         ./0004-disable-windows-desktop.patch
       ];
 
-      # this needs to be match the version being patched above
-      UNICODE_CHARACTER_DATABASE = fetchzip {
-        url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
-        hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
-        stripRoot = false;
+      env = {
+        # this needs to be match the version being patched above
+        UNICODE_CHARACTER_DATABASE = fetchzip {
+          url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
+          hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
+          stripRoot = false;
+        };
+        FONTCONFIG_FILE =
+          let
+            fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
+          in
+          runCommand "fonts.conf" { } ''
+            substitute ${fc} $out \
+            --replace-fail "/etc/" "${fontconfig.out}/etc/"
+          '';
       };
 
       postPatch = ''
@@ -142,15 +152,6 @@ stdenvNoCC.mkDerivation (
       #  - NuGet packages config '/build/source/nukebuild/_build.csproj'
       linkNuGetPackagesAndSources = true;
 
-      FONTCONFIG_FILE =
-        let
-          fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
-        in
-        runCommand "fonts.conf" { } ''
-          substitute ${fc} $out \
-            --replace-fail "/etc/" "${fontconfig.out}/etc/"
-        '';
-
       preConfigure = ''
         # closed source (telemetry?) https://github.com/AvaloniaUI/Avalonia/discussions/16878
         dotnet remove packages/Avalonia/Avalonia.csproj package Avalonia.BuildServices
diff --git a/pkgs/by-name/de/deadlock-mod-manager/package.nix b/pkgs/by-name/de/deadlock-mod-manager/package.nix
index 68510994039c..66fa7a6a4829 100644
--- a/pkgs/by-name/de/deadlock-mod-manager/package.nix
+++ b/pkgs/by-name/de/deadlock-mod-manager/package.nix
@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-updater-artifacts.patch
   ];
 
-  VITE_API_URL = "https://api.deadlockmods.app";
+  env.VITE_API_URL = "https://api.deadlockmods.app";
 
   # Skip tests that require network access
   checkFlags = [
diff --git a/pkgs/by-name/di/digitalbitbox/package.nix b/pkgs/by-name/di/digitalbitbox/package.nix
index c07c6f8df244..737916a5f516 100644
--- a/pkgs/by-name/di/digitalbitbox/package.nix
+++ b/pkgs/by-name/di/digitalbitbox/package.nix
@@ -84,12 +84,14 @@ stdenv.mkDerivation (finalAttrs: {
     libsForQt5.qtmultimedia
   ];
 
-  LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
-  LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
-  MOC = "${libsForQt5.qtbase.dev}/bin/moc";
-  QTDIR = libsForQt5.qtbase.dev;
-  RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
-  UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  env = {
+    LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
+    LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
+    MOC = "${libsForQt5.qtbase.dev}/bin/moc";
+    QTDIR = libsForQt5.qtbase.dev;
+    RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
+    UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  };
 
   configureFlags = [
     "--enable-libusb"
diff --git a/pkgs/by-name/ev/evdev-proto/package.nix b/pkgs/by-name/ev/evdev-proto/package.nix
index ed4e1acf7f50..db41ff6b7ac8 100644
--- a/pkgs/by-name/ev/evdev-proto/package.nix
+++ b/pkgs/by-name/ev/evdev-proto/package.nix
@@ -19,28 +19,30 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ freebsd.makeMinimal ];
 
-  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
-  OPSYS = "FreeBSD";
-  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+  env = {
+    ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+    OPSYS = "FreeBSD";
+    _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
 
-  AWK = "awk";
-  CHMOD = "chmod";
-  FIND = "find";
-  MKDIR = "mkdir -p";
-  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
-  RM = "rm -f";
-  SED = "${buildPackages.freebsd.sed}/bin/sed";
-  SETENV = "env";
-  SH = "sh";
-  TOUCH = "touch";
-  XARGS = "xargs";
+    AWK = "awk";
+    CHMOD = "chmod";
+    FIND = "find";
+    MKDIR = "mkdir -p";
+    PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+    RM = "rm -f";
+    SED = "${buildPackages.freebsd.sed}/bin/sed";
+    SETENV = "env";
+    SH = "sh";
+    TOUCH = "touch";
+    XARGS = "xargs";
 
-  ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
-  CLEAN_FETCH_ENV = true;
-  INSTALL_AS_USER = true;
-  NO_CHECKSUM = true;
-  NO_MTREE = true;
-  SRC_BASE = freebsd.source;
+    ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
+    CLEAN_FETCH_ENV = true;
+    INSTALL_AS_USER = true;
+    NO_CHECKSUM = true;
+    NO_MTREE = true;
+    SRC_BASE = freebsd.source;
+  };
 
   preUnpack = ''
     export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
diff --git a/pkgs/by-name/gi/git-cinnabar/package.nix b/pkgs/by-name/gi/git-cinnabar/package.nix
index 8cb3f3b54b2e..637d68cf2f9e 100644
--- a/pkgs/by-name/gi/git-cinnabar/package.nix
+++ b/pkgs/by-name/gi/git-cinnabar/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IVizzc2dKZ83dz3KBMDDiaFNdnS40cS++k8AywyvakQ=";
   };
 
-  ZSTD_SYS_USE_PKG_CONFIG = true;
+  env.ZSTD_SYS_USE_PKG_CONFIG = true;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/hi/hiredis/package.nix b/pkgs/by-name/hi/hiredis/package.nix
index 2ad7a1c14aac..c692c92fd0ec 100644
--- a/pkgs/by-name/hi/hiredis/package.nix
+++ b/pkgs/by-name/hi/hiredis/package.nix
@@ -20,8 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ];
 
-  PREFIX = "\${out}";
-  USE_SSL = 1;
+  env = {
+    PREFIX = "\${out}";
+    USE_SSL = 1;
+  };
 
   meta = {
     homepage = "https://github.com/redis/hiredis";
diff --git a/pkgs/by-name/ke/keyscope/package.nix b/pkgs/by-name/ke/keyscope/package.nix
index 2a3ee5db8dcf..7ad7b8bb246b 100644
--- a/pkgs/by-name/ke/keyscope/package.nix
+++ b/pkgs/by-name/ke/keyscope/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     echo "fn main() {}" > build.rs
   '';
 
-  VERGEN_GIT_SEMVER = "v${finalAttrs.version}";
+  env.VERGEN_GIT_SEMVER = "v${finalAttrs.version}";
 
   # Test require network access
   doCheck = false;
diff --git a/pkgs/by-name/ku/kubectl/package.nix b/pkgs/by-name/ku/kubectl/package.nix
index b446f21cfdd5..a4a76bc4b211 100644
--- a/pkgs/by-name/ku/kubectl/package.nix
+++ b/pkgs/by-name/ku/kubectl/package.nix
@@ -9,7 +9,7 @@ kubernetes.overrideAttrs (_: {
     "convert"
   ];
 
-  WHAT = lib.concatStringsSep " " [
+  env.WHAT = toString [
     "cmd/kubectl"
     "cmd/kubectl-convert"
   ];
diff --git a/pkgs/by-name/ku/kubernetes/package.nix b/pkgs/by-name/ku/kubernetes/package.nix
index 4f3451cbab3d..adcb906fcac5 100644
--- a/pkgs/by-name/ku/kubernetes/package.nix
+++ b/pkgs/by-name/ku/kubernetes/package.nix
@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {
 
   patches = [ ./fixup-addonmanager-lib-path.patch ];
 
-  WHAT = lib.concatStringsSep " " components;
+  env.WHAT = toString components;
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/li/lingua-franca/package.nix b/pkgs/by-name/li/lingua-franca/package.nix
index 1950d43a33b0..cf62ecd7d974 100644
--- a/pkgs/by-name/li/lingua-franca/package.nix
+++ b/pkgs/by-name/li/lingua-franca/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ jdk17_headless ];
 
-  _JAVA_HOME = "${jdk17_headless}/";
+  env._JAVA_HOME = "${jdk17_headless}/";
 
   postPatch = ''
     substituteInPlace bin/lfc \
diff --git a/pkgs/by-name/mu/mudlet/package.nix b/pkgs/by-name/mu/mudlet/package.nix
index e7b7e0e26883..981ca5159bf8 100644
--- a/pkgs/by-name/mu/mudlet/package.nix
+++ b/pkgs/by-name/mu/mudlet/package.nix
@@ -103,8 +103,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
-  WITH_FONTS = "NO";
-  WITH_UPDATER = "NO";
+  env = {
+    WITH_FONTS = "NO";
+    WITH_UPDATER = "NO";
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/ng/ngt/package.nix b/pkgs/by-name/ng/ngt/package.nix
index f892bfde284b..bf59304befe7 100644
--- a/pkgs/by-name/ng/ngt/package.nix
+++ b/pkgs/by-name/ng/ngt/package.nix
@@ -25,8 +25,10 @@ stdenv.mkDerivation (finalAttrs: {
     openblas
   ];
 
-  NIX_ENFORCE_NO_NATIVE = !enableAVX;
-  __AVX2__ = if enableAVX then 1 else 0;
+  env = {
+    NIX_ENFORCE_NO_NATIVE = !enableAVX;
+    __AVX2__ = if enableAVX then 1 else 0;
+  };
 
   meta = {
     homepage = "https://github.com/yahoojapan/NGT";
diff --git a/pkgs/by-name/ni/nitrocli/package.nix b/pkgs/by-name/ni/nitrocli/package.nix
index b94ac382b00c..81ee54667807 100644
--- a/pkgs/by-name/ni/nitrocli/package.nix
+++ b/pkgs/by-name/ni/nitrocli/package.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage {
   doCheck = false;
 
   # link against packaged libnitrokey
-  USE_SYSTEM_LIBNITROKEY = 1;
+  env.USE_SYSTEM_LIBNITROKEY = 1;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/rq/rq/package.nix b/pkgs/by-name/rq/rq/package.nix
index c47be258500f..33c3be604056 100644
--- a/pkgs/by-name/rq/rq/package.nix
+++ b/pkgs/by-name/rq/rq/package.nix
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm build.rs
   '';
 
-  VERGEN_SEMVER = finalAttrs.version;
+  env.VERGEN_SEMVER = finalAttrs.version;
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/sa/salt/package.nix b/pkgs/by-name/sa/salt/package.nix
index dffa0fd87f5f..9d15aa93d6e8 100644
--- a/pkgs/by-name/sa/salt/package.nix
+++ b/pkgs/by-name/sa/salt/package.nix
@@ -65,7 +65,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     ++ extraInputs;
 
   # Don't use fixed dependencies on Darwin
-  USE_STATIC_REQUIREMENTS = "0";
+  env.USE_STATIC_REQUIREMENTS = "0";
 
   # The tests fail due to socket path length limits at the very least;
   # possibly there are more issues but I didn't leave the test suite running
diff --git a/pkgs/by-name/sn/snapraid/package.nix b/pkgs/by-name/sn/snapraid/package.nix
index b4ec7d34f968..b280e5b6b68c 100644
--- a/pkgs/by-name/sn/snapraid/package.nix
+++ b/pkgs/by-name/sn/snapraid/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IoK37ZXlMRLDPjzsLUqcfcu4asdstFJYgHc2wAg9lno=";
   };
 
-  VERSION = finalAttrs.version;
+  env.VERSION = finalAttrs.version;
 
   doCheck = true;
 
diff --git a/pkgs/by-name/uw/uwsgi/package.nix b/pkgs/by-name/uw/uwsgi/package.nix
index 9af8e230f42b..0da10531d2ff 100644
--- a/pkgs/by-name/uw/uwsgi/package.nix
+++ b/pkgs/by-name/uw/uwsgi/package.nix
@@ -126,11 +126,23 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optional withPAM "pam" ++ lib.optional withSystemd "systemd_logger"
   );
 
-  # UWSGI_INCLUDES environment variable required for "auto" plugins
-  # to be detected. See uwsgiconfig.py for more details.
-  UWSGI_INCLUDES = lib.concatStringsSep "," (
-    map (p: "${lib.getDev p}/include") finalAttrs.buildInputs
-  );
+  env = {
+    # UWSGI_INCLUDES environment variable required for "auto" plugins
+    # to be detected. See uwsgiconfig.py for more details.
+    UWSGI_INCLUDES = lib.concatStringsSep "," (
+      map (p: "${lib.getDev p}/include") finalAttrs.buildInputs
+    );
+  }
+  // lib.optionalAttrs (lib.any (x: x.name == "php") needed) {
+    # this is a hack to make the php plugin link with session.so (which on nixos is a separate package)
+    # the hack works in coordination with ./additional-php-ldflags.patch
+    UWSGICONFIG_PHP_LDFLAGS = lib.concatStringsSep "," [
+      "-Wl"
+      "-rpath=${php-embed.extensions.session}/lib/php/extensions/"
+      "--library-path=${php-embed.extensions.session}/lib/php/extensions/"
+      "-l:session.so"
+    ];
+  };
 
   passthru = {
     inherit python3;
@@ -154,17 +166,6 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postConfigure
   '';
 
-  # this is a hack to make the php plugin link with session.so (which on nixos is a separate package)
-  # the hack works in coordination with ./additional-php-ldflags.patch
-  UWSGICONFIG_PHP_LDFLAGS = lib.optionalString (lib.any (x: x.name == "php") needed) (
-    lib.concatStringsSep "," [
-      "-Wl"
-      "-rpath=${php-embed.extensions.session}/lib/php/extensions/"
-      "--library-path=${php-embed.extensions.session}/lib/php/extensions/"
-      "-l:session.so"
-    ]
-  );
-
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/by-name/ve/verilator/package.nix b/pkgs/by-name/ve/verilator/package.nix
index 6447dcf6ce70..6e416d440fad 100644
--- a/pkgs/by-name/ve/verilator/package.nix
+++ b/pkgs/by-name/ve/verilator/package.nix
@@ -21,10 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "verilator";
   version = "5.044";
 
-  # Verilator gets the version from this environment variable
-  # if it can't do git describe while building.
-  VERILATOR_SRC_VERSION = "v${finalAttrs.version}";
-
   src = fetchFromGitHub {
     owner = "verilator";
     repo = "verilator";
@@ -88,6 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   env = {
+    # Verilator gets the version from this environment variable
+    # if it can't do git describe while building.
+    VERILATOR_SRC_VERSION = "v${finalAttrs.version}";
+
     SYSTEMC_INCLUDE = "${lib.getDev systemc}/include";
     SYSTEMC_LIBDIR = "${lib.getLib systemc}/lib";
   };
diff --git a/pkgs/by-name/wa/waylyrics/package.nix b/pkgs/by-name/wa/waylyrics/package.nix
index 7bee7abea79e..b0fab4b9a6f6 100644
--- a/pkgs/by-name/wa/waylyrics/package.nix
+++ b/pkgs/by-name/wa/waylyrics/package.nix
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=tests::netease_lyric::get_netease_lyric" # Requires network access
   ];
 
-  WAYLYRICS_THEME_PRESETS_DIR = "${placeholder "out"}/share/waylyrics/themes";
+  env.WAYLYRICS_THEME_PRESETS_DIR = "${placeholder "out"}/share/waylyrics/themes";
 
   postInstall = ''
     # Install themes
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 7e0ddc4f4846..c111fb6e93d8 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "lix";
 
   version = "${version}${suffix}";
-  VERSION_SUFFIX = suffix;
+  env.VERSION_SUFFIX = suffix;
 
   inherit src patches;