diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index ba93166c2b66..4bbe05b0e4f0 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -14,10 +14,12 @@
 
   # runtime dependencies
   bzip2,
+  withExpat ? true,
   expat,
   libffi,
   libuuid,
   libxcrypt,
+  withMpdecimal ? true,
   mpdecimal,
   ncurses,
   openssl,
@@ -92,6 +94,9 @@
   # tests
   testers,
 
+  # allow pythonMinimal to prevent accidental dependencies it doesn't want
+  allowedReferenceNames ? [ ],
+
 }@inputs:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -216,17 +221,21 @@ let
   buildInputs = lib.filter (p: p != null) (
     [
       bzip2
-      expat
       libffi
       libuuid
       libxcrypt
-      mpdecimal
       ncurses
       openssl
       sqlite
       xz
       zlib
     ]
+    ++ optionals withMpdecimal [
+      mpdecimal
+    ]
+    ++ optionals withExpat [
+      expat
+    ]
     ++ optionals bluezSupport [
       bluez
     ]
@@ -420,7 +429,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
     LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-    LIBS = "${optionalString (!stdenv.hostPlatform.isDarwin) "-lcrypt"}";
+    LIBS = "${optionalString (!stdenv.hostPlatform.isDarwin && libxcrypt != null) "-lcrypt"}";
     NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) (
       {
         "glibc" = "-lgcc_s";
@@ -436,7 +445,11 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags =
     [
       "--without-ensurepip"
+    ]
+    ++ optionals withExpat [
       "--with-system-expat"
+    ]
+    ++ optionals withMpdecimal [
       "--with-system-libmpdec"
     ]
     ++ optionals (openssl != null) [
@@ -743,6 +756,19 @@ stdenv.mkDerivation (finalAttrs: {
       buildPackages.bashNonInteractive
     ];
 
+  # Optionally set allowedReferences to guarantee minimal dependencies
+  # Allows python3Minimal to stay minimal and not have deps added by accident
+  # Doesn't do anything if allowedReferenceNames is empty (was not set)
+  ${if allowedReferenceNames != [ ] then "allowedReferences" else null} =
+    # map allowed names to their derivations
+    (map (name: inputs.${name}) allowedReferenceNames) ++ [
+      # any version of python depends on libc and libgcc
+      stdenv.cc.cc.lib
+      stdenv.cc.libc
+      # allows python referring to its own store path
+      "out"
+    ];
+
   separateDebugInfo = true;
 
   passthru = passthru // {
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index d738e391ea86..127bc8f87912 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -113,6 +113,10 @@
           sqlite = null;
           tzdata = null;
           libuuid = null;
+          bzip2 = null;
+          libxcrypt = null;
+          xz = null;
+          zlib = null;
           libffi = libffiBoot; # without test suite
           stripConfig = true;
           stripIdlelib = true;
@@ -124,6 +128,16 @@
           enableOptimizations = false;
           enableLTO = false;
           mimetypesSupport = false;
+          withExpat = false;
+          withMpdecimal = false;
+          /*
+            The actual 'allowedReferences' attribute is set inside the cpython derivation.
+            This is necessary in order to survive overrides of dependencies.
+          */
+          allowedReferenceNames = [
+            "bashNonInteractive"
+            "libffi"
+          ];
         }
         // sources.python312
       )).overrideAttrs