diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index 737d142d25324..ba046882392fe 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -2,7 +2,7 @@
 
 pkgs.runCommandNoCC "nixpkgs-lib-tests" {
   buildInputs = [ pkgs.nix (import ./check-eval.nix) ];
-  NIX_PATH="nixpkgs=${pkgs.path}";
+  env.NIX_PATH="nixpkgs=${pkgs.path}";
 } ''
     datadir="${pkgs.nix}/share"
     export TEST_ROOT=$(pwd)/test-tmp
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 57e0c52e64061..95f194ed2eed9 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ];
 
   # audacity only looks for lame and ffmpeg at runtime, so we need to link them in manually
-  NIX_LDFLAGS = toString [
+  env.NIX_LDFLAGS = toString [
     # LAME
     "-lmp3lame"
     # ffmpeg
diff --git a/pkgs/applications/audio/audio-recorder/default.nix b/pkgs/applications/audio/audio-recorder/default.nix
index 534b87e9fa743..a93f3f893ff56 100644
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # https://bugs.launchpad.net/audio-recorder/+bug/1784622
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
 
diff --git a/pkgs/applications/audio/axoloti/libusb1.nix b/pkgs/applications/audio/axoloti/libusb1.nix
index 1a6ebd346ccab..65e84e41233dd 100644
--- a/pkgs/applications/audio/axoloti/libusb1.nix
+++ b/pkgs/applications/audio/axoloti/libusb1.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
   preFixup = stdenv.lib.optionalString stdenv.isLinux ''
     sed 's,-ludev,-L${systemd.lib}/lib -ludev,' -i $out/lib/libusb-1.0.la
diff --git a/pkgs/applications/audio/bs1770gain/default.nix b/pkgs/applications/audio/bs1770gain/default.nix
index 2dee463aeee23..b8b0ad1e9d6cc 100644
--- a/pkgs/applications/audio/bs1770gain/default.nix
+++ b/pkgs/applications/audio/bs1770gain/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ffmpeg sox ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "A audio/video loudness scanner implementing ITU-R BS.1770";
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index 04b31ae2c0b32..367f60a6e43c1 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin-limits.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
     substituteInPlace src/core/makefile.x/makefile.osx \
diff --git a/pkgs/applications/audio/easytag/default.nix b/pkgs/applications/audio/easytag/default.nix
index 4c2b97e727f47..9f983ee41ad1c 100644
--- a/pkgs/applications/audio/easytag/default.nix
+++ b/pkgs/applications/audio/easytag/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1mbxnqrw1fwcgraa1bgik25vdzvf97vma5pzknbwbqq5ly9fwlgw";
   };
 
-  NIX_LDFLAGS = "-lid3tag -lz";
+  env.NIX_LDFLAGS = "-lid3tag -lz";
 
   nativeBuildInputs = [ pkgconfig intltool itstool libxml2 wrapGAppsHook ];
   buildInputs = [
diff --git a/pkgs/applications/audio/freewheeling/default.nix b/pkgs/applications/audio/freewheeling/default.nix
index 34494871f29c1..deffbb3a3fbf2 100644
--- a/pkgs/applications/audio/freewheeling/default.nix
+++ b/pkgs/applications/audio/freewheeling/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       configureFlags = oldAttrs.configureFlags ++ [ "--enable-openssl-compatibility" ];
     }))
   ];
-  NIX_CFLAGS_COMPILE = toString
+  env.NIX_CFLAGS_COMPILE = toString
     (makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ]);
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index 41b40223b87fb..16db812c6a79b 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libjack2 ladspaH gtk2 alsaLib libxml2 librdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  env.NIX_LDFLAGS = "-ldl -lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 818630585cfdf..0b3f4af31557a 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 makeWrapper ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_LDFLAGS = "-ldl";
 
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
diff --git a/pkgs/applications/audio/kid3/default.nix b/pkgs/applications/audio/kid3/default.nix
index 75ffd083a5a48..c53d13775bcec 100644
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     qtbase qttools qtmultimedia qtquickcontrols ];
 
   cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
-  NIX_LDFLAGS = "-lm -lpthread";
+  env.NIX_LDFLAGS = "-lm -lpthread";
 
   preConfigure = ''
     export DOCBOOKDIR="${docbook_xsl}/xml/xsl/docbook/"
diff --git a/pkgs/applications/audio/klick/default.nix b/pkgs/applications/audio/klick/default.nix
index f33245d8f1c95..eb5fa2cecaad8 100644
--- a/pkgs/applications/audio/klick/default.nix
+++ b/pkgs/applications/audio/klick/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ sconsPackages.scons_3_0_1 pkgconfig ];
   buildInputs = [ libsamplerate libsndfile liblo libjack2 boost ];
   prefixKey = "PREFIX=";
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = http://das.nasophon.de/klick/;
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index 0dbe60b6a6154..f9797a2f84cd4 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation  rec {
   buildInputs = [ alsaLib gtk2 libjack2 libxml2 makeWrapper
     pkgconfig readline ];
   propagatedBuildInputs = [ libuuid ];
-  NIX_LDFLAGS = "-lm -lpthread -luuid";
+  env.NIX_LDFLAGS = "-lm -lpthread -luuid";
 
   postInstall = ''
     for i in lash_control lash_panel
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index b146fcecc8ec7..15c387a97baef 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder ''out''}"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
+  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
 
   doCheck = true;
 
diff --git a/pkgs/applications/audio/pianobooster/default.nix b/pkgs/applications/audio/pianobooster/default.nix
index f2130fe55590b..e56622657e75c 100644
--- a/pkgs/applications/audio/pianobooster/default.nix
+++ b/pkgs/applications/audio/pianobooster/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation  {
   preConfigure = "cd src";
 
   buildInputs = [ alsaLib cmake makeWrapper libGLU libGL qt4 ];
-  NIX_LDFLAGS = "-lGL -lpthread";
+  env.NIX_LDFLAGS = "-lGL -lpthread";
 
   postInstall = ''
     wrapProgram $out/bin/pianobooster \
diff --git a/pkgs/applications/audio/sayonara/default.nix b/pkgs/applications/audio/sayonara/default.nix
index c4258174500fd..89ad9b05b7a9c 100644
--- a/pkgs/applications/audio/sayonara/default.nix
+++ b/pkgs/applications/audio/sayonara/default.nix
@@ -66,7 +66,7 @@ mkDerivation rec {
   ];
 
   # gstreamer cannot otherwise be found
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   postInstall = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/applications/audio/sound-juicer/default.nix b/pkgs/applications/audio/sound-juicer/default.nix
index 7f22a03c1bb4b..0819da45d5044 100644
--- a/pkgs/applications/audio/sound-juicer/default.nix
+++ b/pkgs/applications/audio/sound-juicer/default.nix
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec{
     gst_all_1.gst-libav
   ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=format-nonliteral";
+  env.NIX_CFLAGS_COMPILE="-Wno-error=format-nonliteral";
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/applications/audio/soundscape-renderer/default.nix b/pkgs/applications/audio/soundscape-renderer/default.nix
index 5b5f01eef5cc8..29c093f7152b3 100644
--- a/pkgs/applications/audio/soundscape-renderer/default.nix
+++ b/pkgs/applications/audio/soundscape-renderer/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   # Without it doesn't find all of the boost libraries.
   BOOST_LIB_DIR="${boost}/lib";
   # uses the deprecated get_generic_category() in boost_system
-  NIX_CFLAGS_COMPILE="-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
+  env.NIX_CFLAGS_COMPILE="-DBOOST_SYSTEM_ENABLE_DEPRECATED=1";
 
   LC_ALL = "en_US.UTF-8";
 
diff --git a/pkgs/applications/audio/squishyball/default.nix b/pkgs/applications/audio/squishyball/default.nix
index 496ce779ffb57..4df9c8243d00c 100644
--- a/pkgs/applications/audio/squishyball/default.nix
+++ b/pkgs/applications/audio/squishyball/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flac libao libvorbis ncurses opusfile ];
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS";
 
   patches = [ ./gnu-screen.patch ];
 
diff --git a/pkgs/applications/audio/svox/default.nix b/pkgs/applications/audio/svox/default.nix
index 3e9fe4725afd4..3060c80a38ec4 100644
--- a/pkgs/applications/audio/svox/default.nix
+++ b/pkgs/applications/audio/svox/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     cp lang/*.bin $out/share/pico/lang
   '';
 
-  NIX_CFLAGS_COMPILE = "-include stdint.h";
+  env.NIX_CFLAGS_COMPILE = "-include stdint.h";
 
   meta = with stdenv.lib; {
     description = "Text-to-speech engine";
diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
index 48dd3f39e88fe..4b2e974caf130 100644
--- a/pkgs/applications/audio/timemachine/default.nix
+++ b/pkgs/applications/audio/timemachine/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/applications/blockchains/dcrd.nix b/pkgs/applications/blockchains/dcrd.nix
index 16d39e85da153..8bfa90633e134 100644
--- a/pkgs/applications/blockchains/dcrd.nix
+++ b/pkgs/applications/blockchains/dcrd.nix
@@ -9,7 +9,7 @@ buildGoPackage rec {
   buildInputs = [ go git dep cacert ];
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   src = fetchgit {
     inherit rev;
diff --git a/pkgs/applications/blockchains/dcrwallet.nix b/pkgs/applications/blockchains/dcrwallet.nix
index 163ed2615d33e..798d1b09f59f2 100644
--- a/pkgs/applications/blockchains/dcrwallet.nix
+++ b/pkgs/applications/blockchains/dcrwallet.nix
@@ -9,7 +9,7 @@ buildGoPackage rec {
   buildInputs = [ go git dep cacert ];
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   src = fetchgit {
     inherit rev;
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index be586bdac9bce..f31b0bc6f9130 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     configureFlagsArray+=( --enable-at-spi-command="${at-spi2-core}/libexec/at-spi-bus-launcher --launch-immediately" )
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installFlags = [
     "localstatedir=\${TMPDIR}"
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index e15da80b3b1bc..7bce847df2b92 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -129,7 +129,7 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
           preConfigure = ''
             cd server
           '';
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index bda0552e7529a..f32885a76581f 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation rec {
     patchShebangs build-aux/meson/post_install.py
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   mesonFlags = [
     "-Dpython_libprefix=${python3.libPrefix}"
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index cfd3a4289901f..833ed08e53b53 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -11,7 +11,7 @@ in stdenv.mkDerivation {
     sha256 = "1jdca9yhm7mm1aijd1a5amphgn15142kngky3id2am379ixrq1hg";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
   configureFlags = ["--disable-dconf-migration"];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/nedit/default.nix b/pkgs/applications/editors/nedit/default.nix
index e1d1fa3070a91..796a7abdaf4ea 100644
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # the linux config works fine on darwin too!
   buildFlags = stdenv.lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";
 
-  NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
+  env.NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/texmacs/darwin.nix b/pkgs/applications/editors/texmacs/darwin.nix
index 5d5843890e14b..33c2efa316725 100644
--- a/pkgs/applications/editors/texmacs/darwin.nix
+++ b/pkgs/applications/editors/texmacs/darwin.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   GUILE_CPPFLAGS="-D_THREAD_SAFE -I${guile_1_8.dev}/include -I${guile_1_8.dev}/include/guile ";
 
-  NIX_LDFLAGS="${zlib}/lib/libz.dylib";
+  env.NIX_LDFLAGS="${zlib}/lib/libz.dylib";
 
   buildPhase = ''
     substituteInPlace Makefile \
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 91e2427a6c84a..c227e8c1f767e 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     git
     python3
   ];
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
   postInstall = "wrapProgram $out/bin/texmacs --suffix PATH : " +
         (if ghostscriptX == null then "" else "${ghostscriptX}/bin:") +
diff --git a/pkgs/applications/editors/texmaker/default.nix b/pkgs/applications/editors/texmaker/default.nix
index c45025dd80cc1..dcc3cc60b36f5 100644
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@@ -11,7 +11,7 @@ mkDerivation rec {
 
   buildInputs = [ qtbase qtscript poppler zlib ];
   nativeBuildInputs = [ pkgconfig poppler qmake ];
-  NIX_CFLAGS_COMPILE="-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE="-I${poppler.dev}/include/poppler";
 
   qmakeFlags = [
     "DESKTOPDIR=${placeholder "out"}/share/applications"
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index 8734fabfdcf91..2259a29ad3848 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   postInstall = ''
     wrapProgram $out/bin/grass76 \
diff --git a/pkgs/applications/graphics/ahoviewer/default.nix b/pkgs/applications/graphics/ahoviewer/default.nix
index 87bddf9099ee2..00a5e88f84135 100644
--- a/pkgs/applications/graphics/ahoviewer/default.nix
+++ b/pkgs/applications/graphics/ahoviewer/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
   ] ++ stdenv.lib.optional useUnrar unrar;
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postPatch = ''patchShebangs version.sh'';
 
diff --git a/pkgs/applications/graphics/freepv/default.nix b/pkgs/applications/graphics/freepv/default.nix
index 57321220fb144..4598aabc560fe 100644
--- a/pkgs/applications/graphics/freepv/default.nix
+++ b/pkgs/applications/graphics/freepv/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
       --replace png_set_gray_1_2_4_to_8 png_set_expand_gray_1_2_4_to_8
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive -Wno-narrowing";
 
   meta = {
     description = "Open source panorama viewer using GL";
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 0a06c42b5fc01..6a9b96d6d36c0 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -48,7 +48,7 @@ stdenv.lib.makeScope pkgs.newScope (self: with self; {
       url = https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2;
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
     };
-    NIX_LDFLAGS = "-lm";
+    env.NIX_LDFLAGS = "-lm";
     patchPhase = ''
       sed -e 's,^\(GIMP_PLUGIN_DIR=\).*,\1'"$out/${gimp.name}-plugins", \
        -e 's,^\(GIMP_DATA_DIR=\).*,\1'"$out/share/${gimp.name}", -i configure
@@ -141,7 +141,7 @@ stdenv.lib.makeScope pkgs.newScope (self: with self; {
       Filters/Enhance/Wavelet sharpen
     */
     name = "wavelet-sharpen-0.1.2";
-    NIX_LDFLAGS = "-lm";
+    env.NIX_LDFLAGS = "-lm";
     src = fetchurl {
       url = http://registry.gimp.org/files/wavelet-sharpen-0.1.2.tar.gz;
       sha256 = "0vql1k67i21g5ivaa1jh56rg427m0icrkpryrhg75nscpirfxxqw";
diff --git a/pkgs/applications/graphics/gnuclad/default.nix b/pkgs/applications/graphics/gnuclad/default.nix
index 5b6dd42e09e55..1f369fb1e35e7 100644
--- a/pkgs/applications/graphics/gnuclad/default.nix
+++ b/pkgs/applications/graphics/gnuclad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ka2kscpjff7gflsargv3r9fdaxhkf3nym9mfaln3pnq6q7fwdki";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index e870df4bc6efb..d515c55ee1339 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkgconfig wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
     make release
diff --git a/pkgs/applications/graphics/gqview/default.nix b/pkgs/applications/graphics/gqview/default.nix
index d82238f925b38..be21f06f4fec2 100644
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     description = "A fast image viewer";
diff --git a/pkgs/applications/graphics/hugin/default.nix b/pkgs/applications/graphics/hugin/default.nix
index 8f7800a7323a6..4041b43a66e7f 100644
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   postInstall = ''
     for p in $out/bin/*; do
diff --git a/pkgs/applications/graphics/imgcat/default.nix b/pkgs/applications/graphics/imgcat/default.nix
index 1fa3ec8ccc689..320f50612c75c 100644
--- a/pkgs/applications/graphics/imgcat/default.nix
+++ b/pkgs/applications/graphics/imgcat/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "0frz40rjwi73nx2dlqvmnn56zwr29bmnngfb11hhwr7v58yfajdi";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "It's like cat, but for images";
diff --git a/pkgs/applications/graphics/k3d/default.nix b/pkgs/applications/graphics/k3d/default.nix
index 31085cd8023dc..99ed39ce95339 100644
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   #doCheck = false;
 
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
 
   meta = with stdenv.lib; {
     description = "A 3D editor with support for procedural editing";
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index 52397ac33c4f9..096b0314da3ab 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -28,7 +28,7 @@ mkDerivation rec {
     python3Packages.pyqt5
   ] ++ lib.optional (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) vc;
 
-  NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ];
+  env.NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ];
 
   cmakeFlags = [
     "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/share/sip/PyQt5"
diff --git a/pkgs/applications/graphics/luminance-hdr/default.nix b/pkgs/applications/graphics/luminance-hdr/default.nix
index 94899c937a86b..11a4a8b793449 100644
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1izmgjjp8mgyxv57sjjr05z7g7059ykb5wchlcn4wrnnb6aslnvn";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   buildInputs = [
     qtbase qtdeclarative qttools qtwebengine eigen
diff --git a/pkgs/applications/graphics/xournal/default.nix b/pkgs/applications/graphics/xournal/default.nix
index 6d10a7cae231c..cf3db5882881f 100644
--- a/pkgs/applications/graphics/xournal/default.nix
+++ b/pkgs/applications/graphics/xournal/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
 
-  NIX_LDFLAGS = "-lz"
+  env.NIX_LDFLAGS = "-lz"
     + stdenv.lib.optionalString (!isGdkQuartzBackend) " -lX11";
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/kde/print-manager.nix b/pkgs/applications/kde/print-manager.nix
index f0501ffadee48..1f21ad8829e83 100644
--- a/pkgs/applications/kde/print-manager.nix
+++ b/pkgs/applications/kde/print-manager.nix
@@ -22,5 +22,5 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   # Fix build with cups deprecations etc.
   # See: https://github.com/NixOS/nixpkgs/issues/73334
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
 }
diff --git a/pkgs/applications/misc/apvlv/default.nix b/pkgs/applications/misc/apvlv/default.nix
index b5af1af91f36c..8afc6cf818517 100644
--- a/pkgs/applications/misc/apvlv/default.nix
+++ b/pkgs/applications/misc/apvlv/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n4xiic8lqnv3mqi7wpdv866gyyakax71gffv3n9427rmcld465i";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   nativeBuildInputs = [
     pkgconfig
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 0af78852204d6..a5eed422a3b31 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -66,11 +66,11 @@ stdenv.mkDerivation rec {
     ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON"
     ++ optional colladaSupport "-DWITH_OPENCOLLADA=ON";
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
 
   # Since some dependencies are built with gcc 6, we need gcc 6's
   # libstdc++ in our RPATH. Sigh.
-  NIX_LDFLAGS = optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
+  env.NIX_LDFLAGS = optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/misc/cgminer/default.nix b/pkgs/applications/misc/cgminer/default.nix
index c05c7423d9a56..fca1fd90c3cc3 100644
--- a/pkgs/applications/misc/cgminer/default.nix
+++ b/pkgs/applications/misc/cgminer/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   ];
   configureScript = "./autogen.sh";
   configureFlags = [ "--enable-scrypt" "--enable-opencl" ];
-  NIX_LDFLAGS = "-lgcc_s -lX11 -lXext -lXinerama";
+  env.NIX_LDFLAGS = "-lgcc_s -lX11 -lXext -lXinerama";
 
   postBuild = ''
     gcc api-example.c -o cgminer-api
diff --git a/pkgs/applications/misc/doomseeker/default.nix b/pkgs/applications/misc/doomseeker/default.nix
index fbe21dd9a5b2d..07abb21bddeb9 100644
--- a/pkgs/applications/misc/doomseeker/default.nix
+++ b/pkgs/applications/misc/doomseeker/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with stdenv.lib; {
     homepage = http://doomseeker.drdteam.org/;
diff --git a/pkgs/applications/misc/fbreader/default.nix b/pkgs/applications/misc/fbreader/default.nix
index 857ef9ac27bb6..7e6230a6fe9d8 100644
--- a/pkgs/applications/misc/fbreader/default.nix
+++ b/pkgs/applications/misc/fbreader/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "INSTALLDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   meta = with stdenv.lib; {
     description = "An e-book reader for Linux";
diff --git a/pkgs/applications/misc/getxbook/default.nix b/pkgs/applications/misc/getxbook/default.nix
index aa901a7ba513a..3698688ca66dc 100644
--- a/pkgs/applications/misc/getxbook/default.nix
+++ b/pkgs/applications/misc/getxbook/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ihwrx4gspj8l7fc8vxch6dpjrw1lvv9z3c19f0wxnmnxhv1cjvs";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=format-truncation"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=stringop-overflow"
diff --git a/pkgs/applications/misc/gnome-recipes/default.nix b/pkgs/applications/misc/gnome-recipes/default.nix
index 01f5af339ff08..32ec77e9f373a 100644
--- a/pkgs/applications/misc/gnome-recipes/default.nix
+++ b/pkgs/applications/misc/gnome-recipes/default.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation rec {
 
   # https://github.com/NixOS/nixpkgs/issues/36468
   # https://gitlab.gnome.org/GNOME/recipes/issues/76
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   postPatch = ''
     chmod +x src/list_to_c.py
diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix
index 3dffc5c77c2ad..178bd8f51d4ed 100644
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@@ -31,7 +31,7 @@ in mkDerivation rec {
   ];
   nativeBuildInputs = [ flex makeWrapper qmake yacc ];
 
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
   qtWrapperArgs = [ "--set LD_LIBRARY_PATH ${zlib.out}/lib" ];
 
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index 4416e1e62c2d3..6398aba96cd2c 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = {
     description = "GTK-based audio CD player/ripper";
diff --git a/pkgs/applications/misc/gxneur/default.nix b/pkgs/applications/misc/gxneur/default.nix
index c44523a8b751e..6dc7aa99a4c05 100644
--- a/pkgs/applications/misc/gxneur/default.nix
+++ b/pkgs/applications/misc/gxneur/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   nativeBuildInputs = [ pkgconfig intltool ];
   buildInputs = [
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index 69d78575e2a36..249d645cc23dd 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_C_FLAGS=-I${src}/include_mod" ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   installPhase = ''
     install -D -m 755 k2pdfopt $out/bin/k2pdfopt
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index 06fc04ba8fb46..389ccba46fb63 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     sha256 = "0dkya9smx81c5cgcwk2gi2m1pabfff1v9gd3ngl42sdvyb63wgdq";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang [
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
       --replace "/usr/local/bin" "../bin" \
       --replace "/usr/local/share/man" "../share/man"
   '';
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
 
   patches = [
     ./darwin.patch
diff --git a/pkgs/applications/misc/lsd2dsl/default.nix b/pkgs/applications/misc/lsd2dsl/default.nix
index 5dd5fa0f5122f..cd3cb4ecc6114 100644
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@@ -16,7 +16,7 @@ mkDerivation rec {
 
   buildInputs = [ boost libvorbis libsndfile minizip gtest ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   installPhase = ''
     install -Dm755 lsd2dsl $out/bin/lsd2dsl
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index 08643577b49e1..ab29d5b87bbbd 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   postInstall = ''
     wrapProgram $out/bin/merkaartor \
diff --git a/pkgs/applications/misc/mlterm/default.nix b/pkgs/applications/misc/mlterm/default.nix
index b2012801e1702..505eaa9c952e0 100644
--- a/pkgs/applications/misc/mlterm/default.nix
+++ b/pkgs/applications/misc/mlterm/default.nix
@@ -39,7 +39,8 @@ stdenv.mkDerivation rec {
       --replace "-m 2755 -g utmp" " " \
       --replace "-m 4755 -o root" " "
   '';
-  NIX_LDFLAGS = "
+
+  env.NIX_LDFLAGS = "
     -L${stdenv.cc.cc.lib}/lib
     -lX11 -lgdk_pixbuf-2.0 -lcairo -lfontconfig -lfreetype -lXft
     -lvte-2.91 -lgtk-3 -lharfbuzz -lfribidi -lm17n
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 531f8d851f1c8..50c9026f72dd3 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -63,7 +63,7 @@ in stdenv.mkDerivation rec {
   '';
 
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/navit/default.nix b/pkgs/applications/misc/navit/default.nix
index 2263dfc1fbc06..00e3f26903a15 100644
--- a/pkgs/applications/misc/navit/default.nix
+++ b/pkgs/applications/misc/navit/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./CMakeLists.txt.patch ];
 
-  NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
+  env.NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
     ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher");
 
   # we choose only cmdline and speech-dispatcher speech options.
diff --git a/pkgs/applications/misc/netsurf/libcss/default.nix b/pkgs/applications/misc/netsurf/libcss/default.nix
index ed0b7b12e9848..92c60708fb977 100644
--- a/pkgs/applications/misc/netsurf/libcss/default.nix
+++ b/pkgs/applications/misc/netsurf/libcss/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE= "-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE= "-Wno-error=implicit-fallthrough";
 
   meta = with stdenv.lib; {
     homepage = http://www.netsurf-browser.org/;
diff --git a/pkgs/applications/misc/netsurf/libwapcaplet/default.nix b/pkgs/applications/misc/netsurf/libwapcaplet/default.nix
index ad59b1be10e0e..2a82385a898f1 100644
--- a/pkgs/applications/misc/netsurf/libwapcaplet/default.nix
+++ b/pkgs/applications/misc/netsurf/libwapcaplet/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   meta = with stdenv.lib; {
     homepage = http://www.netsurf-browser.org/;
diff --git a/pkgs/applications/misc/osm2xmap/default.nix b/pkgs/applications/misc/osm2xmap/default.nix
index e5838dc1bbe62..1c6e6093a24ea 100644
--- a/pkgs/applications/misc/osm2xmap/default.nix
+++ b/pkgs/applications/misc/osm2xmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "INSTALL_MANDIR=${placeholder ''out''}/share/man/man1"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   buildInputs = [ libroxml proj libyamlcpp boost ];
 
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index caf4f270a1512..d01bad577ceed 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   # Disable compiler warnings that clutter the build log
   # It seems to be a known issue for Eigen:
   # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
-  NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
+  env.NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
 
   prePatch = ''
     # In nix ioctls.h isn't available from the standard kernel-headers package
diff --git a/pkgs/applications/misc/sdcv/default.nix b/pkgs/applications/misc/sdcv/default.nix
index 3cebcc0101f87..82fb0a86185c5 100644
--- a/pkgs/applications/misc/sdcv/default.nix
+++ b/pkgs/applications/misc/sdcv/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     mkdir locale
   '';
 
-  NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
+  env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
   meta = with stdenv.lib; {
     homepage = https://dushistov.github.io/sdcv/;
diff --git a/pkgs/applications/misc/tangogps/default.nix b/pkgs/applications/misc/tangogps/default.nix
index 10b487828ea54..4d4a8adfcda5d 100644
--- a/pkgs/applications/misc/tangogps/default.nix
+++ b/pkgs/applications/misc/tangogps/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext gtk2 gconf curl libexif sqlite libxml2 ];
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   # bogus includes fail with newer library version
   postPatch = ''
diff --git a/pkgs/applications/misc/vp/default.nix b/pkgs/applications/misc/vp/default.nix
index a59a25a144e92..36dd60d80dc90 100644
--- a/pkgs/applications/misc/vp/default.nix
+++ b/pkgs/applications/misc/vp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image ];
 
-  NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
 
   meta = with stdenv.lib; {
     homepage = http://brlcad.org/~erik/;
diff --git a/pkgs/applications/misc/xfontsel/default.nix b/pkgs/applications/misc/xfontsel/default.nix
index 5d2b70a80ee41..e4e03fde712fa 100644
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libX11 makeWrapper libXaw];
 
   # Without this, it gets Xmu as a dependency, but without rpath entry
-  NIX_LDFLAGS = "-lXmu";
+  env.NIX_LDFLAGS = "-lXmu";
 
   # This will not make xfontsel find its app-defaults, but at least the $out
   # directory will contain them.
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index b6f05ea3094a3..412e843f0eadd 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -21,7 +21,7 @@ stdenv'.mkDerivation rec {
     sha256 = "0ilx5mhh91ks7dwvykfyynh53l6vkkignjpwkkss8ss6b2k8gdbj";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   cmakeFlags = lib.optional (!cudaSupport) "-DCUDA_ENABLE=OFF"
     ++ lib.optional (!openclSupport) "-DOpenCL_ENABLE=OFF";
diff --git a/pkgs/applications/misc/xsw/default.nix b/pkgs/applications/misc/xsw/default.nix
index c7c10254c0ca0..40a51987a6ae2 100644
--- a/pkgs/applications/misc/xsw/default.nix
+++ b/pkgs/applications/misc/xsw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
+  env.NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
 
   patches = [
     ./parse.patch # Fixes compilation error by avoiding redundant definitions.
diff --git a/pkgs/applications/misc/xterm/default.nix b/pkgs/applications/misc/xterm/default.nix
index 83ba28bfce37d..053b0e774f2bb 100644
--- a/pkgs/applications/misc/xterm/default.nix
+++ b/pkgs/applications/misc/xterm/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableDecLocator "--enable-dec-locator";
 
   # Work around broken "plink.sh".
-  NIX_LDFLAGS = "-lXmu -lXt -lICE -lX11 -lfontconfig";
+  env.NIX_LDFLAGS = "-lXmu -lXt -lICE -lX11 -lfontconfig";
 
   # Hack to get xterm built with the feature of releasing a possible setgid of 'utmp',
   # decided by the sysadmin to allow the xterm reporting to /var/run/utmp
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 66d499e779e7f..b5c4d6fd362f6 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
                                      AVFoundation MediaToolbox CoreLocation
                                      Foundation libobjc AddressBook cups ];
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-I${glib.dev}/include/gio-unix-2.0"
   ]
   ++ lib.optionals (!isTorBrowserLike) [
diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index 373fa43c72c3e..b1720df5ed718 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -35,12 +35,16 @@ in stdenv.mkDerivation rec {
     sha256 = "1fbg2p8qh2gvi3g4iz4q6vc0k70pf248r4yndi5lcn2m3mzvjx0i";
   };
 
-  NIX_LDFLAGS = optionalString stdenv.isSunOS "-lsocket -lnsl";
-
-  # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
-  # the correct paths.
-  PERL = "${perl}/bin/perl";
-  MAN = "${man}/bin/man";
+  env = {
+    NIX_LDFLAGS = optionalString stdenv.isSunOS "-lsocket -lnsl";
+    # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
+    # the correct paths.
+    PERL = "${perl}/bin/perl";
+    MAN = "${man}/bin/man";
+    # for w3mimgdisplay
+    # see: https://bbs.archlinux.org/viewtopic.php?id=196093
+    LIBS = optionalString x11Support "-lX11";
+  };
 
   makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
 
@@ -86,10 +90,6 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = false;
 
-  # for w3mimgdisplay
-  # see: https://bbs.archlinux.org/viewtopic.php?id=196093
-  LIBS = optionalString x11Support "-lX11";
-
   meta = {
     homepage = http://w3m.sourceforge.net/;
     description = "A text-mode web browser";
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index f852c3ac0a3a9..451b2c5afa6ea 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # go env breaks the sandbox
     substituteInPlace "hack/lib/golang.sh" \
-      --replace 'echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"' 'echo "${go.GOOS}/${go.GOARCH}"'
+      --replace 'echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"' 'echo "${go.env.GOOS}/${go.env.GOARCH}"'
 
     substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
     # hack/update-munge-docs.sh only performs some tests on the documentation.
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 1ad30335b94d6..8db704223c5ee 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     pythonProtobuf
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=class-memaccess";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=class-memaccess";
 
   preConfigure = ''
     # https://issues.apache.org/jira/browse/MESOS-6616
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index e01e4c4fc44fd..2f46430fda0c2 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     make
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=sign-compare"
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=sign-compare"
     + stdenv.lib.optionalString stdenv.isDarwin " -Wno-error=format-security";
 
   doCheck = true;
diff --git a/pkgs/applications/networking/gopher/gopherclient/default.nix b/pkgs/applications/networking/gopher/gopherclient/default.nix
index 45d9235afc98d..6271d501ab227 100644
--- a/pkgs/applications/networking/gopher/gopherclient/default.nix
+++ b/pkgs/applications/networking/gopher/gopherclient/default.nix
@@ -24,7 +24,7 @@ buildGoPackage rec {
     PATH="$(pwd):$PATH" go generate ${goPackagePath}
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = [
     # go-qml needs private Qt headers.
     "-I${qtbase.dev}/include/QtCore/${qtbase.version}"
   ];
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index a3497df1716cd..1fdbffa693b6e 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optional (stdenv.cc.libc != null) "SYSROOT=${stdenv.cc.libc}"
   ;
 
-  NIX_CFLAGS_COMPILE='' -I${librem}/include/rem -I${gsm}/include/gsm
+  env.NIX_CFLAGS_COMPILE='' -I${librem}/include/rem -I${gsm}/include/gsm
     -DHAVE_INTTYPES_H -D__GLIBC__
     -D__need_timeval -D__need_timespec -D__need_time_t '';
   meta = {
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index b155f31296421..7128fe21777d6 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     (python.withPackages (ps: [ ps.pystache ps.six ]))
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = [
     "-Wno-error"
     "-I${glib.dev}/include/glib-2.0"
     "-I${glib.out}/lib/glib-2.0/include"
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
index e9a0812e925b1..e43329869793c 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gjm0z4wa5vi9x1xk43rany5pffrwg958n180ahdj9a7sa8a4hpm";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     # glib-2.62 deprecations
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
     # override "-O0 -Werror" set by build system
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
index 6657ff96b11fd..49cf7df105b20 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/skype4pidgin/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "116jfh5ravaixivqx4a4bz0lbb9c49d5r83nwmripja56zdbpgr0";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${libnotify}/include/libnotify";
+  env.NIX_CFLAGS_COMPILE = "-I${libnotify}/include/libnotify";
 
   patchPhase = ''
     sed -i -e 's/ [^ ]*-gcc/ gcc/' -e 's/-march[^ ]*//' \
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
index c38ff8f454e9d..8b169d2d98ab2 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0p93jpjpx7hszwffzgixw04zkrpsiyzz4za3gfr4j07krc4771fp";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin libwebp libgcrypt gettext ];
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
index 41f205514e763..2cb347f3744d1 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ms367l2f7x83k407c93bmhpyc820f1css61fh2gx4jq13cxqq3p";
   };
 
-  NIX_LDFLAGS = "-lssp -lsodium";
+  env.NIX_LDFLAGS = "-lssp -lsodium";
 
   postInstall = "mv $out/lib/purple-2 $out/lib/pidgin";
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 71168e1a692c2..755d2db9d418f 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -26,7 +26,7 @@ let unwrapped = stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
   buildInputs = [
     gtkspell2 aspell startupnotification
diff --git a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
index 8093f91feb3e4..74eb73965cd57 100644
--- a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   patches = [ ./conference.patch ];
 
   buildInputs = [ cmake lame id3lib libvorbis qt4 libogg ];
-  NIX_LDFLAGS = "-lvorbis";
+  env.NIX_LDFLAGS = "-lvorbis";
 
   meta = {
     homepage = http://atdot.ch/scr/;
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index d47b7d00af92d..c568c7c2c45de 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ GConf ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${libxml2.dev}/include/libxml2"
     "-I${miniupnpc}/include/miniupnpc"
     "-I${qtwebkit.dev}/include/QtWebKit"
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index e57ff881af34c..2a42c93eebbfa 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -70,22 +70,24 @@ mkDerivation rec {
     "TDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-DTDESKTOP_DISABLE_CRASH_REPORTS"
-    "-DTDESKTOP_DISABLE_AUTOUPDATE"
-    "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
-    "-I${minizip}/include/minizip"
-    # See Telegram/gyp/qt.gypi
-    "-I${getDev qtbase}/mkspecs/linux-g++"
-  ] ++ concatMap (x: [
-    "-I${getDev qtbase}/include/${x}"
-    "-I${getDev qtbase}/include/${x}/${qtbase.version}"
-    "-I${getDev qtbase}/include/${x}/${qtbase.version}/${x}"
-    "-I${getDev libopus}/include/opus"
-    "-I${getDev alsaLib}/include/alsa"
-    "-I${getDev libpulseaudio}/include/pulse"
-    ]) [ "QtCore" "QtGui" "QtDBus" ];
-  CPPFLAGS = NIX_CFLAGS_COMPILE;
+  env = rec {
+    NIX_CFLAGS_COMPILE = builtins.toString ([
+      "-DTDESKTOP_DISABLE_CRASH_REPORTS"
+      "-DTDESKTOP_DISABLE_AUTOUPDATE"
+      "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
+      "-I${minizip}/include/minizip"
+      # See Telegram/gyp/qt.gypi
+      "-I${getDev qtbase}/mkspecs/linux-g++"
+    ] ++ concatMap (x: [
+      "-I${getDev qtbase}/include/${x}"
+      "-I${getDev qtbase}/include/${x}/${qtbase.version}"
+      "-I${getDev qtbase}/include/${x}/${qtbase.version}/${x}"
+      "-I${getDev libopus}/include/opus"
+      "-I${getDev alsaLib}/include/alsa"
+      "-I${getDev libpulseaudio}/include/pulse"
+      ]) [ "QtCore" "QtGui" "QtDBus" ]);
+    CPPFLAGS = NIX_CFLAGS_COMPILE;
+  };
 
   preConfigure = ''
     # Patches to revert:
diff --git a/pkgs/applications/networking/instant-messengers/vacuum/default.nix b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
index 923ce3737532b..c7b464c2b8ce1 100644
--- a/pkgs/applications/networking/instant-messengers/vacuum/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vacuum/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   # hack: needed to fix build issues in
   # http://hydra.nixos.org/build/38322959/nixlog/1
   # should be an upstream issue but it's easy to fix
-  NIX_LDFLAGS = "-lz";
+  env.NIX_LDFLAGS = "-lz";
 
   nativeBuildInputs = [ qmake4Hook ];
 
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index 43ec0910cc2b8..2c7182c1c4936 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
 
   meta = {
     description = "An IRC proxy (bouncer)";
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index f78053bdc37b3..630197be73fc2 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -46,7 +46,7 @@ in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   enableParallelBuilding = true;
 
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
-  NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   buildInputs =
        [ cmake makeWrapper qtbase ]
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 13ac80677ee9b..75be3ab70bd9b 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -56,7 +56,7 @@ let
         ++ concatMap (p: p.buildInputs) enabledPlugins
         ++ extraBuildInputs;
 
-      NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
+      env.NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
         # Fix '_res_9_init: undefined symbol' error
         + (stdenv.lib.optionalString stdenv.isDarwin "-DBIND_8_COMPAT=1 -lresolv");
 
diff --git a/pkgs/applications/networking/mailreaders/balsa/default.nix b/pkgs/applications/networking/mailreaders/balsa/default.nix
index e7c9d50cb9be1..a20c7f0b787eb 100644
--- a/pkgs/applications/networking/mailreaders/balsa/default.nix
+++ b/pkgs/applications/networking/mailreaders/balsa/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     "--with-spell-checker=gtkspell"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 274d9d4718e2a..f75275d8b0a14 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   # Fix missing libidn in mutt;
   # this fix is ugly since it links all binaries in mutt against libidn
   # like pgpring, pgpewrap, ...
-  NIX_LDFLAGS = "-lidn";
+  env.NIX_LDFLAGS = "-lidn";
 
   postInstall = ''
     wrapProgram "$out/bin/neomutt" --prefix PATH : "$out/libexec/neomutt"
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index dfb49e14133f9..b92fa4b4741c4 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -85,7 +85,7 @@ let
       "CONFIG+=no-server"
     ];
 
-    NIX_CFLAGS_COMPILE = optional speechdSupport "-I${speechd}/include/speech-dispatcher";
+    env.NIX_CFLAGS_COMPILE = optional speechdSupport "-I${speechd}/include/speech-dispatcher";
 
     installPhase = ''
       # bin stuff
diff --git a/pkgs/applications/networking/p2p/transgui/default.nix b/pkgs/applications/networking/p2p/transgui/default.nix
index 51d591995b768..07a4d661238af 100644
--- a/pkgs/applications/networking/p2p/transgui/default.nix
+++ b/pkgs/applications/networking/p2p/transgui/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     libX11 glib gtk2 gdk-pixbuf pango atk cairo openssl
   ];
 
-  NIX_LDFLAGS = "
+  env.NIX_LDFLAGS = "
     -L${stdenv.cc.cc.lib}/lib
     -lX11 -lglib-2.0 -lgtk-x11-2.0 -lgdk-x11-2.0
     -lgdk_pixbuf-2.0 -lpango-1.0 -latk-1.0 -lcairo -lc -lcrypto
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 25996953e11ac..9c75804ed7bfe 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     ++ optional enableSystemd "--with-systemd-daemon"
     ++ optional enableGTK3 "--with-gtk";
 
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation";
+  env.NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation";
 
   meta = with stdenv.lib; {
     description = "A fast, easy and free BitTorrent client";
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index 49182ec182fef..d6a6bfb016058 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isUnix ''
     perl mkfiles.pl
diff --git a/pkgs/applications/office/calligra/default.nix b/pkgs/applications/office/calligra/default.nix
index 4855fbc63c3e4..317317caff4e7 100644
--- a/pkgs/applications/office/calligra/default.nix
+++ b/pkgs/applications/office/calligra/default.nix
@@ -41,7 +41,7 @@ mkDerivation rec {
 
   propagatedUserEnvPkgs = [ kproperty ];
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   postInstall = ''
     for i in $out/bin/*; do
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 4373278adab07..990c456fa5740 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ dconf ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   patches = [ ./cmake_check_symbol_exists.patch ];
 
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index c7b4377c3dcbd..d04bb0862654b 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   # Hidden dependency that wasn't included in CMakeLists.txt:
-  NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
+  env.NIX_CFLAGS_COMPILE = "-I${kitemmodels.dev}/include/KF5";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index c8bb58d29213c..46f4868120d53 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -57,7 +57,7 @@ in (stdenv.mkDerivation rec {
 
   # For some reason librdf_redland sometimes refers to rasqal.h instead
   # of rasqal/rasqal.h
-  NIX_CFLAGS_COMPILE = "-I${librdf_rasqal}/include/rasqal";
+  env.NIX_CFLAGS_COMPILE = "-I${librdf_rasqal}/include/rasqal";
 
   patches = [
     ./xdg-open-brief.patch
diff --git a/pkgs/applications/office/libreoffice/src-fresh/override.nix b/pkgs/applications/office/libreoffice/src-fresh/override.nix
index 464965121d97a..17ee0d1b8a06f 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/override.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/override.nix
@@ -1,4 +1,6 @@
 { stdenv, ... }:
 attrs: {
-  NIX_CFLAGS_COMPILE = attrs.NIX_CFLAGS_COMPILE + stdenv.lib.optionalString stdenv.isx86_64 " -mno-fma";
+  env = attrs.env // {
+    NIX_CFLAGS_COMPILE = attrs.env.NIX_CFLAGS_COMPILE + stdenv.lib.optionalString stdenv.isx86_64 " -mno-fma";
+  };
 }
diff --git a/pkgs/applications/office/planner/default.nix b/pkgs/applications/office/planner/default.nix
index 6189132d0f949..ff4880c702893 100644
--- a/pkgs/applications/office/planner/default.nix
+++ b/pkgs/applications/office/planner/default.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation {
   ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = ''./autogen.sh'';
   configureFlags = [
diff --git a/pkgs/applications/office/wordgrinder/default.nix b/pkgs/applications/office/wordgrinder/default.nix
index 199f17afda799..3f36e3229e538 100644
--- a/pkgs/applications/office/wordgrinder/default.nix
+++ b/pkgs/applications/office/wordgrinder/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   # To be able to find <Xft.h>
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isLinux "-I${libXft.dev}/include/X11";
 
   # Binaries look for LuaFileSystem library (lfs.so) at runtime
   postInstall = ''
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index f5c89ae51cef8..68871f2e411cd 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     Mako cheetah numpy scipy matplotlib pyqt4 pygtk wxPython pyopengl
   ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 2268cdf725dbb..c0ddea73fd060 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   buildInputs = [ glib pkgconfig gtk2 hamlib ];
 
diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
index 4bb3c7b34fe82..e264253ab7cc7 100644
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./wrapper.patch ./clang.patch ./aarch64.patch ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");
 
   configurePhase=''
     substituteInPlace admin/wrapper.sh --replace '%%OUT%%' $out
diff --git a/pkgs/applications/science/astronomy/xplanet/default.nix b/pkgs/applications/science/astronomy/xplanet/default.nix
index f306f9265abad..d3d1891184d01 100644
--- a/pkgs/applications/science/astronomy/xplanet/default.nix
+++ b/pkgs/applications/science/astronomy/xplanet/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with stdenv.lib; {
     description = "Renders an image of the earth or other planets into the X root window";
diff --git a/pkgs/applications/science/biology/cmtk/default.nix b/pkgs/applications/science/biology/cmtk/default.nix
index 1ebfa2fca57a1..ef0d83eec95bf 100644
--- a/pkgs/applications/science/biology/cmtk/default.nix
+++ b/pkgs/applications/science/biology/cmtk/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   buildInputs = [cmake];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with stdenv.lib; {
     description     = "Computational Morphometry Toolkit ";
diff --git a/pkgs/applications/science/chemistry/avogadro/default.nix b/pkgs/applications/science/chemistry/avogadro/default.nix
index 6aca678480dae..7d52b43a2d4e8 100644
--- a/pkgs/applications/science/chemistry/avogadro/default.nix
+++ b/pkgs/applications/science/chemistry/avogadro/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig doxygen ];
 
-  NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
+  env.NIX_CFLAGS_COMPILE = "-include ${libGLU.dev}/include/GL/glu.h";
 
   patches = [
     (fetchurl {
diff --git a/pkgs/applications/science/chemistry/pymol/default.nix b/pkgs/applications/science/chemistry/pymol/default.nix
index b1bd01fb2f7fe..8fe855c3281b0 100644
--- a/pkgs/applications/science/chemistry/pymol/default.nix
+++ b/pkgs/applications/science/chemistry/pymol/default.nix
@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication {
   };
 
   buildInputs = [ python3Packages.numpy glew freeglut libpng libxml2 tk freetype msgpack ];
-  NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
 
   installPhase = ''
     python setup.py install --home=$out
diff --git a/pkgs/applications/science/logic/avy/default.nix b/pkgs/applications/science/logic/avy/default.nix
index b43e0c6fbf1a6..4a4d74ea43eea 100644
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ cmake zlib boost.out boost.dev ];
-  NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
+  env.NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
     # Squelch endless stream of warnings on same few things
     ++ stdenv.lib.optionals stdenv.cc.isClang [
       "-Wno-empty-body"
diff --git a/pkgs/applications/science/math/calculix/default.nix b/pkgs/applications/science/math/calculix/default.nix
index 6f2d61cd80f00..848c554c77543 100644
--- a/pkgs/applications/science/math/calculix/default.nix
+++ b/pkgs/applications/science/math/calculix/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ arpack spooles openblas ];
 
-  NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
+  env.NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
 
   patches = [
     ./calculix.patch
diff --git a/pkgs/applications/science/math/giac/default.nix b/pkgs/applications/science/math/giac/default.nix
index b3777528ecda1..ea88acc335f7e 100644
--- a/pkgs/applications/science/math/giac/default.nix
+++ b/pkgs/applications/science/math/giac/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   configure:16230: g++ -o conftest -g -O2   conftest.cpp -lntl  -llapack -lblas -lgfortran -ldl -lpng16 -lm -lmpfi -lmpfr -lgmp  >&5
   /nix/store/y9c1v4x7y39j2rfbg17agjwqdzxpsn18-ntl-11.3.2/lib/libntl.so: undefined reference to `pthread_key_create'
   */
-  NIX_CFLAGS_LINK="-lpthread";
+  env.NIX_CFLAGS_LINK="-lpthread";
 
   # xcas Phys and Turtle menus are broken with split outputs
   # and interactive use is likely to need docs
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index 38b9b8ec66d1a..afb5abfe413eb 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     libnotify patchelf libX11 libxcb xcbutil
   ];
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   preConfigure = ''
     ./_autosetup
diff --git a/pkgs/applications/science/misc/golly/beta.nix b/pkgs/applications/science/misc/golly/beta.nix
index 36de6a1d4c503..828509595b12c 100644
--- a/pkgs/applications/science/misc/golly/beta.nix
+++ b/pkgs/applications/science/misc/golly/beta.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   makeFlags=[
     "AM_LDFLAGS="
   ];
-  NIX_LDFLAGS="-l${python2.libPrefix} -lperl -ldl -lGL";
+  env.NIX_LDFLAGS="-l${python2.libPrefix} -lperl -ldl -lGL";
   preConfigure=''
     export NIX_LDFLAGS="$NIX_LDFLAGS -L$(dirname "$(find ${perl} -name libperl.so)")"
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE
diff --git a/pkgs/applications/science/misc/golly/default.nix b/pkgs/applications/science/misc/golly/default.nix
index 1478bb643181b..5c5fc25155786 100644
--- a/pkgs/applications/science/misc/golly/default.nix
+++ b/pkgs/applications/science/misc/golly/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   makeFlags=[
     "AM_LDFLAGS="
   ];
-  NIX_LDFLAGS="-l${python2.libPrefix} -lperl";
+  env.NIX_LDFLAGS="-l${python2.libPrefix} -lperl";
   preConfigure=''
     export NIX_LDFLAGS="$NIX_LDFLAGS -L$(dirname "$(find ${perl} -name libperl.so)")"
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE
diff --git a/pkgs/applications/science/misc/vite/default.nix b/pkgs/applications/science/misc/vite/default.nix
index 3e7c7a42eb826..c00637e398441 100644
--- a/pkgs/applications/science/misc/vite/default.nix
+++ b/pkgs/applications/science/misc/vite/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ cmake qt4 libGLU libGL ];
 
-  NIX_LDFLAGS = "-lGLU";
+  env.NIX_LDFLAGS = "-lGLU";
 
   meta = {
     description = "Visual Trace Explorer (ViTE), a tool to visualize execution traces";
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 7c46d26bf5b31..142b805821dc4 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -74,8 +74,8 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optionals withLibsecret [ pkgconfig glib libsecret ];
 
   # required to support pthread_cancel()
-  NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.cc.isClang) "-lgcc_s"
-              + stdenv.lib.optionalString (stdenv.isFreeBSD) "-lthr";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.cc.isClang) "-lgcc_s"
+              + stdenv.lib.optionalString (stdenv.isFreeBSD) " -lthr";
 
   configureFlags = stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 45b427341a214..643dd044adca5 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     "SVN_INCLUDE=${subversion.dev}/include/subversion-1"
   ];
 
-  NIX_LDFLAGS = "-lsvn_fs-1";
+  env.NIX_LDFLAGS = "-lsvn_fs-1";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/svn-all-fast-export/svn2git;
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index 3283a3c046a4e..254058c760e7d 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     make $checkFlags check || print_logs_and_fail
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=c99";
+  env.NIX_CFLAGS_COMPILE = "-std=c99";
 
   hardeningDisable = stdenv.lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 123308babeae3..88b3949dccaf9 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation
 
   # this is fixed upstream though not yet in an officially released version,
   # should be fine remove on next release (if one ever happens)
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";
 
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index 10685a72f1098..78b43d52f077f 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     ./autogen.sh --prefix=$out
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ which gnome3.gnome-common glib intltool libtool cairo gtk3 xorg.xwininfo ]
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 59a8c2377ce9d..3ddf275e43e9b 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
   ];
 
   # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
-  NIX_LDFLAGS = toString [
+  env.NIX_LDFLAGS = toString [
     "-lx265"
     # NOTE: The -ldl flag was fixed upstream for a release after 1.3.0
     "-ldl"
diff --git a/pkgs/applications/video/kino/default.nix b/pkgs/applications/video/kino/default.nix
index 2a0af3ed59e4c..bee5e110ebf96 100644
--- a/pkgs/applications/video/kino/default.nix
+++ b/pkgs/applications/video/kino/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = "-lavcodec -lavutil";
+  env.NIX_LDFLAGS = "-lavcodec -lavutil";
 
   patches = [ ./kino-1.3.4-v4l1.patch ./kino-1.3.4-libav-0.7.patch ./kino-1.3.4-libav-0.8.patch ]; #./kino-1.3.4-libavcodec-pkg-config.patch ];
 
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index f5559e3fb6c00..07c01c5bb1b73 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -195,7 +195,7 @@ stdenv.mkDerivation rec {
     echo CONFIG_MPEGAUDIODSP=yes >> config.mak
   '';
 
-  NIX_LDFLAGS = with stdenv.lib; toString (
+  env.NIX_LDFLAGS = with stdenv.lib; toString (
        optional  fontconfigSupport "-lfontconfig"
     ++ optional  fribidiSupport "-lfribidi"
     ++ optionals x11Support [ "-lX11" "-lXext" ]
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index c333790d6a670..36bb396e055a6 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -118,7 +118,7 @@ in stdenv.mkDerivation rec {
     patchShebangs ./TOOLS/
   '';
 
-  NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
+  env.NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
               + optionalString stdenv.isDarwin "-framework CoreFoundation";
 
   configureFlags = [
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index 33ce5c18028fa..edaba11f534ef 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -25,7 +25,7 @@ mkDerivation rec {
     qtgraphicaleffects
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${libmlt}/include/mlt++ -I${libmlt}/include/mlt";
+  env.NIX_CFLAGS_COMPILE = "-I${libmlt}/include/mlt++ -I${libmlt}/include/mlt";
   qmakeFlags = [ "QMAKE_LRELEASE=${stdenv.lib.getDev qttools}/bin/lrelease" "SHOTCUT_VERSION=${version}" ];
 
   prePatch = ''
diff --git a/pkgs/applications/video/wxcam/default.nix b/pkgs/applications/video/wxcam/default.nix
index 176d9a87aed0d..cb5d6e5ae1d95 100644
--- a/pkgs/applications/video/wxcam/default.nix
+++ b/pkgs/applications/video/wxcam/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = with stdenv.lib;
   [ pkgconfig intltool libX11 libXv libSM gtk libglade wxGTK perlPackages.XMLParser xvidcore mjpegtools alsaLib libv4l cimg ];
 
-  NIX_CFLAGS_COMPILE="-I ${cimg}/include/cimg";
+  env.NIX_CFLAGS_COMPILE="-I ${cimg}/include/cimg";
 
   postUnpack = ''
     sed -ie 's|/usr/share/|'"$out/share/"'|g' $sourceRoot/Makefile.in
diff --git a/pkgs/applications/video/xvidcap/default.nix b/pkgs/applications/video/xvidcap/default.nix
index 6e07fbb105b63..9f92d973e6d4e 100644
--- a/pkgs/applications/video/xvidcap/default.nix
+++ b/pkgs/applications/video/xvidcap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   ] ++ (with perlPackages; [ perl XMLParser ]);
 
   # !!! don't know why this is necessary
-  NIX_LDFLAGS = "-lXext -lX11 -lz -lgcc_s";
+  env.NIX_LDFLAGS = "-lXext -lX11 -lz -lgcc_s";
 
   meta = with stdenv.lib; {
     description = "Screencast video catpuring tool";
diff --git a/pkgs/applications/virtualization/bochs/default.nix b/pkgs/applications/virtualization/bochs/default.nix
index f6e202ac49985..3421cbfdd2537 100644
--- a/pkgs/applications/virtualization/bochs/default.nix
+++ b/pkgs/applications/virtualization/bochs/default.nix
@@ -104,8 +104,8 @@ stdenv.mkDerivation rec {
          "--enable-es1370"
          "--enable-busmouse" ];
 
-  NIX_CFLAGS_COMPILE="-I${gtk2.dev}/include/gtk-2.0/ -I${libtool}/include/";
-  NIX_LDFLAGS="-L${libtool.lib}/lib";
+  env.NIX_CFLAGS_COMPILE="-I${gtk2.dev}/include/gtk-2.0/ -I${libtool}/include/";
+  env.NIX_LDFLAGS="-L${libtool.lib}/lib";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index f6fc999269e37..f72b527be75f4 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -39,7 +39,7 @@ rec {
       };
     });
 
-    docker-tini = tini.overrideAttrs  (oldAttrs: {
+    docker-tini = tini.overrideAttrs (oldAttrs: {
       name = "docker-init-${version}";
       inherit version;
       src = fetchFromGitHub {
@@ -53,7 +53,7 @@ rec {
       patchPhase = ''
       '';
 
-      NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
+      env = oldAttrs.env // { NIX_CFLAGS_COMPILE = "-DMINIMAL=ON"; };
     });
   in
     stdenv.mkDerivation ((optionalAttrs (stdenv.isLinux) {
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index cf160d8af53ea..f9abf8d370af4 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     # igrone glib-2.62 deprecations
     # Drop in next stable release.
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index fcc599b451f0e..8aaf6ee18378c 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
 
-  NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
+  env.NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
 
   buildInputs = [ cmake glibc glibc.static ];
 
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 690b72f3eeb01..ca0c6c937e2c1 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
 
   nativeBuildInputs = [ patchelf makeWrapper ];
   buildInputs = [ cdrkit ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index f15a7ef0f9d41..3a0324ff4a317 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -148,7 +148,7 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24.
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC 8
diff --git a/pkgs/applications/virtualization/xen/4.5.nix b/pkgs/applications/virtualization/xen/4.5.nix
index af4721516eca5..49b36ebfaf878 100644
--- a/pkgs/applications/virtualization/xen/4.5.nix
+++ b/pkgs/applications/virtualization/xen/4.5.nix
@@ -243,7 +243,7 @@ callPackage (import ./generic.nix (rec {
   ];
 
   # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postPatch = ''
     # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix
index 1d0e01fcb8222..c29d68829216f 100644
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@@ -167,7 +167,7 @@ callPackage (import ./generic.nix (rec {
     xenpmdpatch
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC8
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index cf45dfa86407f..34073ff7922dd 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
 
-  NIX_LDFLAGS="-lX11";
+  env.NIX_LDFLAGS="-lX11";
 
   meta = with stdenv.lib; {
     description = "A stand-alone panel";
diff --git a/pkgs/applications/window-managers/matchbox/default.nix b/pkgs/applications/window-managers/matchbox/default.nix
index 3c537d6c931b3..8a1200ae26450 100644
--- a/pkgs/applications/window-managers/matchbox/default.nix
+++ b/pkgs/applications/window-managers/matchbox/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libmatchbox ];
-  NIX_LDFLAGS = "-lX11 -L${libX11}/lib -lXext -L${libXext}/lib";
+  env.NIX_LDFLAGS = "-lX11 -L${libX11}/lib -lXext -L${libXext}/lib";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/matchbox/matchbox-window-manager/${version}/matchbox-window-manager-${version}.tar.bz2";
diff --git a/pkgs/applications/window-managers/picom/default.nix b/pkgs/applications/window-managers/picom/default.nix
index ad5f73ab17394..6d3d50d52bfe4 100644
--- a/pkgs/applications/window-managers/picom/default.nix
+++ b/pkgs/applications/window-managers/picom/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     libxdg_basedir
   ];
 
-  NIX_CFLAGS_COMPILE = "-fno-strict-aliasing";
+  env.NIX_CFLAGS_COMPILE = "-fno-strict-aliasing";
 
   mesonFlags = [
     "-Dbuild_docs=true"
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm.app.nix b/pkgs/applications/window-managers/windowmaker/dockapps/wmsm.app.nix
index 3e8b3f7f1584d..17910ffdab538 100644
--- a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm.app.nix
+++ b/pkgs/applications/window-managers/windowmaker/dockapps/wmsm.app.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   postUnpack = "sourceRoot=\${sourceRoot}/wmsm";
 
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   installPhase = ''
     substituteInPlace Makefile --replace "PREFIX	= /usr/X11R6/bin" "" --replace "/usr/bin/install" "install"
diff --git a/pkgs/data/misc/scowl/default.nix b/pkgs/data/misc/scowl/default.nix
index f15a7534e267e..8ce60a11817aa 100644
--- a/pkgs/data/misc/scowl/default.nix
+++ b/pkgs/data/misc/scowl/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip zip perl aspell dos2unix ];
   buildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/desktops/deepin/dde-kwin/default.nix b/pkgs/desktops/deepin/dde-kwin/default.nix
index 850186953f635..348ef95709ec8 100644
--- a/pkgs/desktops/deepin/dde-kwin/default.nix
+++ b/pkgs/desktops/deepin/dde-kwin/default.nix
@@ -74,7 +74,7 @@ mkDerivation rec {
 
   # Need to add kwayland around:
   # * https://github.com/linuxdeepin/dde-kwin/blob/5226bb984c844129f9fa589da56e77decb7b39a1/plugins/kwineffects/blur/CMakeLists.txt#L14
-  NIX_CFLAGS_COMPILE = "-I${kwayland.dev}/include/KF5";
+  env.NIX_CFLAGS_COMPILE = "-I${kwayland.dev}/include/KF5";
 
   cmakeFlags = [
     "-DKWIN_VERSION=${(builtins.parseDrvName kwin.name).version}"
diff --git a/pkgs/desktops/deepin/deepin-movie-reborn/default.nix b/pkgs/desktops/deepin/deepin-movie-reborn/default.nix
index b3930c8e399ee..31ac4b33f65df 100644
--- a/pkgs/desktops/deepin/deepin-movie-reborn/default.nix
+++ b/pkgs/desktops/deepin/deepin-movie-reborn/default.nix
@@ -46,7 +46,7 @@ mkDerivation rec {
     })
   ];
 
-  NIX_LDFLAGS = "-ldvdnav";
+  env.NIX_LDFLAGS = "-ldvdnav";
 
 
   postPatch = ''
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 183e72565d3d9..2393ff54b9d33 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
     source "$setupHook"
   '';
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   postInstall = ''
     # fix use of $out variable
diff --git a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
index c12d50d792f2c..8aeca2a4e620d 100644
--- a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ];
 
   patchFlags = [ "-p0" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = "./jb configure prefix=$out";
 
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 3c89f9ff0fccb..fd228f74b1a8f 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -16,5 +16,5 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtk2 intltool GConf enchant isocodes gnome_icon_theme ];
 
-  NIX_LDFLAGS = "-lgthread-2.0";
+  env.NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-2/platform/libglade/default.nix b/pkgs/desktops/gnome-2/platform/libglade/default.nix
index d51cccf790664..a3a012f5d8226 100644
--- a/pkgs/desktops/gnome-2/platform/libglade/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libglade/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   buildInputs = [ gtk2 gettext ]
     ++ stdenv.lib.optional withLibgladeConvert python2;
 
-  NIX_LDFLAGS = "-lgmodule-2.0";
+  env.NIX_LDFLAGS = "-lgmodule-2.0";
 
   propagatedBuildInputs = [ libxml2 ];
 }
diff --git a/pkgs/desktops/gnome-3/apps/vinagre/default.nix b/pkgs/desktops/gnome-3/apps/vinagre/default.nix
index c5377157ef0c9..223bb98bcf708 100644
--- a/pkgs/desktops/gnome-3/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome-3/apps/vinagre/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     gtk3 vte libxml2 gtk-vnc libsecret gnome3.adwaita-icon-theme librsvg
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/gnome-3/core/evince/default.nix b/pkgs/desktops/gnome-3/core/evince/default.nix
index bab84eeb78cea..b887a7f7c4352 100644
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
     "-Dps=enabled"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   preFixup = ''
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
diff --git a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
index 01127853a86f0..cd0fdc938557b 100644
--- a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
   # /nix/store/*-cheese-3.28.0/include/cheese/cheese-widget.h:26:10: fatal error: clutter-gtk/clutter-gtk.h: No such file or directory
   #  #include <clutter-gtk/clutter-gtk.h>
   #           ^~~~~~~~~~~~~~~~~~~~~~~~~~~
-  NIX_CFLAGS_COMPILE = "-I${stdenv.lib.getDev clutter-gtk}/include/clutter-gtk-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${stdenv.lib.getDev clutter-gtk}/include/clutter-gtk-1.0";
 
   doCheck = true;
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
index c388c4f7211b4..430d59c812065 100644
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
 
   # Default for release buildtype but passed manually because
   # we're using plain
-  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   # So the polkit policy can reference /run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper
   postFixup = ''
diff --git a/pkgs/desktops/mate/atril/default.nix b/pkgs/desktops/mate/atril/default.nix
index ecb9ea2e377ec..5f9ea4d6d2572 100644
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [ "cajaextensiondir=$$out/lib/caja/extensions-2.0" ];
 
diff --git a/pkgs/desktops/mate/mate-applets/default.nix b/pkgs/desktops/mate/mate-applets/default.nix
index 3b5a4ccf2a2b2..49c7d8d922a1e 100644
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-suid=no" ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = with stdenv.lib; {
     description = "Applets for use with the MATE panel";
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index a83bbcb3ffbf1..48bc71bf85987 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = with stdenv.lib; {
     description = "Notification daemon for MATE";
diff --git a/pkgs/desktops/mate/mate-panel/default.nix b/pkgs/desktops/mate/mate-panel/default.nix
index 06e9b386adb4b..7c5d8ac7d72c9 100644
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [
     "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0/"
diff --git a/pkgs/desktops/mate/mate-settings-daemon/default.nix b/pkgs/desktops/mate/mate-settings-daemon/default.nix
index f126918afca8f..21d91e11f14f3 100644
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optional pulseaudioSupport "--enable-pulse";
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = with stdenv.lib; {
     description = "MATE settings daemon";
diff --git a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index 582793ff5906f..67ef209e35edc 100644
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
 
     # Default for release buildtype but passed manually because
     # we're using plain
-  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index b7c4015320913..e4a63ddbc39c5 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  env.NIX_LDFLAGS = "-ldl -lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
diff --git a/pkgs/desktops/xfce/applications/mousepad/default.nix b/pkgs/desktops/xfce/applications/mousepad/default.nix
index 6f841958c7959..03cad2982eeaa 100644
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@@ -11,7 +11,7 @@ mkXfceDerivation {
   buildInputs = [ glib gtk3 gtksourceview3 xfconf ];
 
   # See https://github.com/NixOS/nixpkgs/issues/36468
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = {
     description = "A simple text editor for Xfce";
diff --git a/pkgs/desktops/xfce/core/exo/default.nix b/pkgs/desktops/xfce/core/exo/default.nix
index 59ab5823314ee..30b6a3a841997 100644
--- a/pkgs/desktops/xfce/core/exo/default.nix
+++ b/pkgs/desktops/xfce/core/exo/default.nix
@@ -12,7 +12,7 @@ mkXfceDerivation {
   buildInputs = [ gtk3 glib libxfce4ui libxfce4util ];
 
   # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   meta = {
     description = "Application library for Xfce";
diff --git a/pkgs/desktops/xfce/core/xfce4-session/default.nix b/pkgs/desktops/xfce/core/xfce4-session/default.nix
index 0ab362aa21d07..f8e8342eed88c 100644
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@@ -12,7 +12,7 @@ mkXfceDerivation {
   configureFlags = [ "--with-xsession-prefix=${placeholder "out"}" ];
 
   # See https://github.com/NixOS/nixpkgs/issues/36468
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   passthru.xinitrc = "${xfce4-session}/etc/xdg/xfce4/xinitrc";
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 83778aa8fffd9..28556091bfda9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -9,7 +9,7 @@ mkXfceDerivation {
 
   nativeBuildInputs = [ automakeAddFlags ];
 
-  NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
+  env.NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
 
   postPatch = ''
     substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
diff --git a/pkgs/development/compilers/avian/default.nix b/pkgs/development/compilers/avian/default.nix
index 34d1e64c484f2..fe62114c054cd 100644
--- a/pkgs/development/compilers/avian/default.nix
+++ b/pkgs/development/compilers/avian/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib jdk ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices Foundation ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   postPatch = ''
     substituteInPlace makefile \
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index c0fd742082f3b..97999d91a96dd 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
 
   /*
   ** We patch out a very annoying 'feature' in ./configure, which
diff --git a/pkgs/development/compilers/clasp/default.nix b/pkgs/development/compilers/clasp/default.nix
index 664d849211350..01349ff4e28ae 100644
--- a/pkgs/development/compilers/clasp/default.nix
+++ b/pkgs/development/compilers/clasp/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
       (x: {configureFlags = (x.configureFlags or []) ++ ["--enable-static"];}))
   ];
 
-  NIX_CXXSTDLIB_COMPILE = " -frtti ";
+  env.NIX_CXXSTDLIB_COMPILE = " -frtti ";
 
   postPatch = ''
     echo "
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 97af433d60676..81d8607ab1bbe 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -26,7 +26,7 @@ edk2 = stdenv.mkDerivation {
   buildInputs = [ libuuid pythonEnv ];
 
   makeFlags = [ "-C BaseTools" ];
-  NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
 
   hardeningDisable = [ "format" "fortify" ];
 
diff --git a/pkgs/development/compilers/eql/default.nix b/pkgs/development/compilers/eql/default.nix
index aac619126896c..a8822237dde95 100644
--- a/pkgs/development/compilers/eql/default.nix
+++ b/pkgs/development/compilers/eql/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ecl qt4 xorgserver xkbcomp xkeyboard_config ];
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   postPatch = ''
     sed -re 's@[(]in-home "gui/.command-history"[)]@(concatenate '"'"'string (ext:getenv "HOME") "/.eql-gui-command-history")@' -i gui/gui.lisp
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index ef697b74bbe3e..6ac1c6941af32 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -127,7 +127,7 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 2f85fc4b7e8cb..ff2726d872cca 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -133,7 +133,7 @@ stdenv.mkDerivation ({
   outputs = if langJava || langGo then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index f68ddc81f81f0..abb654b9fdbfd 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -196,7 +196,7 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index b1a981cfdf7f9..41cbc29229a53 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation ({
   outputs = if langJava || langGo then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -204,7 +204,7 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 22d772cff6d6c..4a49fc545adfa 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -173,8 +173,8 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index c6b785f84a4e4..545eb3dca6e30 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -84,7 +84,6 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -165,8 +164,6 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
     inherit version hostPlatform langGo;
@@ -210,31 +207,33 @@ stdenv.mkDerivation ({
 
   installTargets = optional stripped "install-strip";
 
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
-    ;
+  env = {
+    NIX_NO_SELF_RPATH = true;
+
+    inherit
+      (import ../common/extra-target-flags.nix {
+        inherit stdenv crossStageStatic libcCross threadsCross;
+      })
+      EXTRA_TARGET_FLAGS
+      EXTRA_TARGET_LDFLAGS
+      ;
+  } // optionalAttrs (targetPlatform == hostPlatform) {
+    # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
+    # library headers and binaries, regarless of the language being compiled.
+    #
+    # Likewise, the LTO code doesn't find zlib.
+    #
+    # Cross-compiling, we need gcc not to read ./specs in order to build the g++
+    # compiler (after the specs for the cross-gcc are created). Having
+    # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
+    CPATH = makeSearchPathOutput "dev" "include" (optional (zlib != null) zlib);
+    LIBRARY_PATH = makeLibraryPath (optional (zlib != null) zlib);
+  } // optionalAttrs (hostPlatform.system == "x86_64-solaris") {
+    # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+    CC = "gcc -m64";
+  } // optionalAttrs hostPlatform.isSunOS {
+    NIX_LDFLAGS = "-lm -ldl";
+  };
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 7ff8d7529ca37..5cb19c44f83b0 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -164,7 +164,7 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
diff --git a/pkgs/development/compilers/gcc/common/extra-target-flags.nix b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
index bce9a8d47381a..6a37f3d1202f1 100644
--- a/pkgs/development/compilers/gcc/common/extra-target-flags.nix
+++ b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
@@ -5,7 +5,7 @@ let
 in
 
 {
-  EXTRA_TARGET_FLAGS = let
+  EXTRA_TARGET_FLAGS = builtins.toString (let
       mkFlags = dep: lib.optionals (targetPlatform != hostPlatform && dep != null) ([
         "-idirafter ${lib.getDev dep}${dep.incdir or "/include"}"
       ] ++ stdenv.lib.optionals (! crossStageStatic) [
@@ -13,9 +13,9 @@ in
       ]);
     in mkFlags libcCross
     ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross)
-    ;
+    );
 
-  EXTRA_TARGET_LDFLAGS = let
+  EXTRA_TARGET_LDFLAGS = builtins.toString (let
       mkFlags = dep: lib.optionals (targetPlatform != hostPlatform && dep != null) ([
         "-Wl,-L${lib.getLib dep}${dep.libdir or "/lib"}"
       ] ++ (if crossStageStatic then [
@@ -26,5 +26,5 @@ in
       ]));
     in mkFlags libcCross
     ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross)
-    ;
+    );
 }
diff --git a/pkgs/development/compilers/gcc/snapshot/default.nix b/pkgs/development/compilers/gcc/snapshot/default.nix
index 0441296ef179a..fc0452c4ae0ae 100644
--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation ({
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
+  env.NIX_NO_SELF_RPATH = true;
 
   libc_dev = stdenv.cc.libc_dev;
 
@@ -131,7 +131,7 @@ stdenv.mkDerivation ({
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
@@ -173,7 +173,7 @@ stdenv.mkDerivation ({
     (if profiledCompiler then "profiledbootstrap" else "bootstrap");
 
   dontStrip = !stripped;
-  NIX_STRIP_DEBUG = !stripped;
+  env.NIX_STRIP_DEBUG = !stripped;
 
   installTargets =
     if stripped
diff --git a/pkgs/development/compilers/gcl/default.nix b/pkgs/development/compilers/gcl/default.nix
index e3c2d0e09de3c..fb8c140350a6e 100644
--- a/pkgs/development/compilers/gcl/default.nix
+++ b/pkgs/development/compilers/gcl/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "bindnow" ];
 
-  NIX_CFLAGS_COMPILE = "-fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-fgnu89-inline";
 
   meta = with stdenv.lib; {
     description = "GNU Common Lisp compiler working via GCC";
diff --git a/pkgs/development/compilers/gerbil/build.nix b/pkgs/development/compilers/gerbil/build.nix
index e2ab09764827a..afe224dad8e10 100644
--- a/pkgs/development/compilers/gerbil/build.nix
+++ b/pkgs/development/compilers/gerbil/build.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gambit rsync bash ]
     ++ buildInputs_libraries ++ buildInputs_staticLibraries;
 
-  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
+  env.NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   postPatch = ''
     echo '(define (gerbil-version-string) "v${git-version}")' > src/gerbil/runtime/gx-version.scm
diff --git a/pkgs/development/compilers/ghc/8.2.2-binary.nix b/pkgs/development/compilers/ghc/8.2.2-binary.nix
index d68bf7e24b5e0..683100140cf95 100644
--- a/pkgs/development/compilers/ghc/8.2.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.2.2-binary.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/
-  ${libEnvVar} = libPath;
+  env.${libEnvVar} = libPath;
 
   postUnpack =
     # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib
diff --git a/pkgs/development/compilers/ghc/8.6.3-binary.nix b/pkgs/development/compilers/ghc/8.6.3-binary.nix
index 152bd5e4874c7..8efecd2917ca7 100644
--- a/pkgs/development/compilers/ghc/8.6.3-binary.nix
+++ b/pkgs/development/compilers/ghc/8.6.3-binary.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/
-  ${libEnvVar} = libPath;
+  env.${libEnvVar} = libPath;
 
   postUnpack =
     # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib
diff --git a/pkgs/development/compilers/go/1.12.nix b/pkgs/development/compilers/go/1.12.nix
index b3b66fde2a153..16a66885d73de 100644
--- a/pkgs/development/compilers/go/1.12.nix
+++ b/pkgs/development/compilers/go/1.12.nix
@@ -149,36 +149,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc";
+    CXX_FOR_TARGET = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++";
+
+    GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = 387; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -212,13 +210,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 6b7c99c074367..6b64759d6a5c1 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -146,36 +146,34 @@ stdenv.mkDerivation rec {
     find . -name '*.orig' -exec rm {} ';'
   '';
 
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then
-      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  env = {
+    GOOS = stdenv.targetPlatform.parsed.kernel.name;
+    GOARCH = goarch stdenv.targetPlatform;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+    GOHOSTARCH = goarch stdenv.buildPlatform;
+
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc";
+    CXX_FOR_TARGET = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform)
+      "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++";
+
+    GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
+    GO386 = 387; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 1;
+    # Hopefully avoids test timeouts on Hydra
+    GO_TEST_TIMEOUT_SCALE = 3;
+
+    # Indicate that we are running on build infrastructure
+    # Some tests assume things like home directories and users exists
+    GO_BUILDER_NAME = "nix";
+
+    GOROOT_BOOTSTRAP="${goBootstrap}/share/go";
+  };
 
   postConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
@@ -209,13 +207,13 @@ stdenv.mkDerivation rec {
   '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
     mv bin/*_*/* bin
     rmdir bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOHOSTOS}_${env.GOHOSTARCH} pkg/tool/${env.GOHOSTOS}_${env.GOHOSTARCH}
     ''}
   '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
     rm -rf bin/*_*
-    ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ${optionalString (!(env.GOHOSTARCH == env.GOARCH && env.GOOS == env.GOHOSTOS)) ''
+      rm -rf pkg/${env.GOOS}_${env.GOARCH} pkg/tool/${env.GOOS}_${env.GOARCH}
     ''}
   '' else "");
 
diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
index 0dd852a1ef168..71b84470871d6 100644
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@@ -128,15 +128,17 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  GOOS = if stdenv.isDarwin then "darwin" else "linux";
-  GOARCH = if stdenv.isDarwin then "amd64"
-           else if stdenv.hostPlatform.system == "i686-linux" then "386"
-           else if stdenv.hostPlatform.system == "x86_64-linux" then "amd64"
-           else if stdenv.isAarch32 then "arm"
-           else throw "Unsupported system";
-  GOARM = stdenv.lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux") "5";
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 0;
+  env = {
+    GOOS = if stdenv.isDarwin then "darwin" else "linux";
+    GOARCH = if stdenv.isDarwin then "amd64"
+             else if stdenv.hostPlatform.system == "i686-linux" then "386"
+             else if stdenv.hostPlatform.system == "x86_64-linux" then "amd64"
+             else if stdenv.isAarch32 then "arm"
+             else throw "Unsupported system";
+    GOARM = stdenv.lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux") "5";
+    GO386 = 387; # from Arch: don't assume sse2 on i686
+    CGO_ENABLED = 0;
+  };
 
   # The go build actually checks for CC=*/clang and does something different, so we don't
   # just want the generic `cc` here.
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 438c899f51685..91bf80e8f6ab4 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -242,7 +242,7 @@ in rec {
                   'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 08ba9e4681475..5e6d38d344826 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -33,10 +33,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   dontUseCmakeBuildDir = true;
-  NIX_LDFLAGS = "-lpam -L${pam}/lib";
+  env.NIX_LDFLAGS = "-lpam -L${pam}/lib";
 
   # work around broken build system
-  NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
+  env.NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
 
   # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
   # (setting it to an absolute path causes include files to go to $out/$out/include,
diff --git a/pkgs/development/compilers/iasl/default.nix b/pkgs/development/compilers/iasl/default.nix
index e98d7cc27dbf2..adcc4616980fe 100644
--- a/pkgs/development/compilers/iasl/default.nix
+++ b/pkgs/development/compilers/iasl/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1ip684is3dplf7snkn024vv6bg3dv5msx8v7pz6x9lrnk3gk0j9h";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   buildFlags = [ "iasl" ];
 
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index 44687ead4d1c3..3658014d4d1b2 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index e0cfe247b23a9..16c84b93a4927 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [glib];
 
-  NIX_LDFLAGS = if stdenv.isDarwin then "" else "-lgcc_s" ;
+  env.NIX_LDFLAGS = if stdenv.isDarwin then "" else "-lgcc_s" ;
 
   # To overcome the bug https://bugzilla.novell.com/show_bug.cgi?id=644723
   dontDisableStatic = true;
diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index f5645ae021921..20e8865a015c6 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     make golden && make test
   '';
 
-  NIX_CFLAGS_COMPILE="-Wno-error=attributes";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=attributes";
 
   meta = with stdenv.lib; {
     homepage = https://www.nasm.us/;
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index bdb16c9220719..a96972e58fe01 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lcrypto -lpcre -lreadline -lgc -lsqlite3";
+  env.NIX_LDFLAGS = "-lcrypto -lpcre -lreadline -lgc -lsqlite3";
 
   # we could create a separate derivation for the "written in c" version of nim
   # used for bootstrapping, but koch insists on moving the nim compiler around
diff --git a/pkgs/development/compilers/ocaml/3.11.2.nix b/pkgs/development/compilers/ocaml/3.11.2.nix
index f582ef9834a62..2229a1bf0a082 100644
--- a/pkgs/development/compilers/ocaml/3.11.2.nix
+++ b/pkgs/development/compilers/ocaml/3.11.2.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   # Needed to avoid a SIGBUS on the final executable on mips
-  NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
+  env.NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
 
   patches = optionals stdenv.isDarwin [ ./gnused-on-osx-fix.patch ] ++
     [ (fetchurl {
diff --git a/pkgs/development/compilers/opa/default.nix b/pkgs/development/compilers/opa/default.nix
index da1df6f30bbd8..402ac9e3ccc3f 100644
--- a/pkgs/development/compilers/opa/default.nix
+++ b/pkgs/development/compilers/opa/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     ocaml findlib ssl cryptokit camlzip ulex ocamlgraph camlp4
   ]);
 
-  NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
 
   postInstall = ''
     # Have compiler use same tools for code generation as used to build it.
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index b8381feef0954..4c4bf727e230b 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -61,9 +61,9 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = "-Wno-error";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index c6b3644feccab..44e9e2b26b991 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -140,7 +140,7 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = toString ([
+    env.NIX_CFLAGS_COMPILE = toString ([
       # glibc 2.24 deprecated readdir_r so we need this
       # See https://www.mail-archive.com/openembedded-devel@lists.openembedded.org/msg49006.html
       "-Wno-error=deprecated-declarations"
@@ -153,7 +153,7 @@ let
       "-Wno-error"
     ]);
 
-    NIX_LDFLAGS= toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS= toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/default.nix b/pkgs/development/compilers/openjdk/default.nix
index b2d511173c45a..84d6216d2d2d5 100644
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@@ -69,9 +69,9 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = "-Wno-error";
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+    env.NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index c6bff3961088e..cfa43badb896f 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -84,7 +84,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/12.nix b/pkgs/development/compilers/openjdk/openjfx/12.nix
index 30c8d36fdfca9..332aac816966e 100644
--- a/pkgs/development/compilers/openjdk/openjfx/12.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/12.nix
@@ -84,7 +84,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index f639d330566de..f5f7d1126d2f7 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -21,10 +21,12 @@ rustPlatform.buildRustPackage {
   buildInputs = [ cacert file curl python3 openssl zlib libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation Security libiconv ];
 
-  LIBGIT2_SYS_USE_PKG_CONFIG = 1;
+  env = {
+    LIBGIT2_SYS_USE_PKG_CONFIG = 1;
 
-  # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
-  RUSTC_BOOTSTRAP = 1;
+    # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
+    RUSTC_BOOTSTRAP = 1;
+  };
 
   postInstall = ''
     # NOTE: We override the `http.cainfo` option usually specified in
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index e5c8a709a900f..451960fcbc930 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -41,14 +41,14 @@ in stdenv.mkDerivation rec {
   # See: https://github.com/NixOS/nixpkgs/pull/56540#issuecomment-471624656
   stripDebugList = [ "bin" ];
 
-  NIX_LDFLAGS = toString (
+  env.NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
        optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++"
     ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
-  RUSTFLAGS = "-Ccodegen-units=10";
+  env.RUSTFLAGS = "-Ccodegen-units=10";
 
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index e6fdd03bb6781..75ada17aee0e2 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = http://www.dcc.fc.up.pt/~vsc/Yap/;
diff --git a/pkgs/development/compilers/z88dk/default.nix b/pkgs/development/compilers/z88dk/default.nix
index 2d62bfede093d..e77e5c47dd292 100644
--- a/pkgs/development/compilers/z88dk/default.nix
+++ b/pkgs/development/compilers/z88dk/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   doCheck = stdenv.hostPlatform.system != "aarch64-linux";
 
   #_FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O";
+  env.NIX_CFLAGS_COMPILE = "-O";
 
   short_rev = builtins.substring 0 7 src.rev;
   makeFlags = [
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 1bffb71e8f9db..b7b2a82d1fca5 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -49,12 +49,13 @@ let
     nativeBuildInputs = [ go git cacert ];
 
     inherit (args) src;
-    inherit (go) GOOS GOARCH;
+    env = {
+      inherit (go.env) GOOS GOARCH;
+      GO111MODULE = "on";
+    };
 
     patches = args.patches or [];
 
-    GO111MODULE = "on";
-
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND" "SOCKS_SERVER"
     ];
@@ -88,7 +89,7 @@ let
     '';
 
     dontFixup = true;
-  }; in modArgs // (
+  }; in lib.recursiveUpdate (modArgs // (
     if modSha256 == null then
       { __noChroot = true; }
     else
@@ -97,14 +98,15 @@ let
         outputHashAlgo = "sha256";
         outputHash = modSha256;
       }
-  ) // overrideModAttrs modArgs);
+  )) (overrideModAttrs modArgs));
 
   package = go.stdenv.mkDerivation (args // {
     nativeBuildInputs = [ removeReferencesTo go ] ++ nativeBuildInputs;
 
-    inherit (go) GOOS GOARCH;
-
-    GO111MODULE = "on";
+    env = {
+      inherit (go.env) GOOS GOARCH;
+      GO111MODULE = "on";
+    };
 
     configurePhase = args.configurePhase or ''
       runHook preConfigure
diff --git a/pkgs/development/go-packages/generic/default.nix b/pkgs/development/go-packages/generic/default.nix
index 03d777d5c8801..691177d4a6f02 100644
--- a/pkgs/development/go-packages/generic/default.nix
+++ b/pkgs/development/go-packages/generic/default.nix
@@ -79,10 +79,10 @@ let
       ++ (lib.optional (!dontRenameImports) govers) ++ nativeBuildInputs;
     buildInputs = buildInputs;
 
-    inherit (go) GOOS GOARCH GO386 CGO_ENABLED;
+    inherit (go.env) GOOS GOARCH GO386 CGO_ENABLED;
 
-    GOHOSTARCH = go.GOHOSTARCH or null;
-    GOHOSTOS = go.GOHOSTOS or null;
+    GOHOSTARCH = go.env.GOHOSTARCH or null;
+    GOHOSTOS = go.env.GOHOSTOS or null;
 
     GO111MODULE = "off";
 
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 5dcfa42c92fc8..6d3ad8fbd8ff7 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
       (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
       + stdenv.lib.concatMapStrings (x: " " + x) withModules);
 
-  NIX_CFLAGS_COMPILE = "-O0 ${stdenv.lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
+  env.NIX_CFLAGS_COMPILE = "-O0 ${stdenv.lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
 
   # TODO : make mod-check fails
   doCheck = false;
diff --git a/pkgs/development/interpreters/clisp/hg.nix b/pkgs/development/interpreters/clisp/hg.nix
index 550535f30aeed..7d150d17bce4a 100644
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
       (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
       + stdenv.lib.concatMapStrings (x: " " + x) withModules);
 
-  NIX_CFLAGS_COMPILE = "-O0 ${stdenv.lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
+  env.NIX_CFLAGS_COMPILE = "-O0 ${stdenv.lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
 
   # TODO : make mod-check fails
   doCheck = false;
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index c2a3556cfea25..aba9034bfef64 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline gettext ncurses ];
 
   # Needed with GCC 8
-  NIX_CFLAGS_COMPILE = with stdenv.lib; toString ((optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = with stdenv.lib; toString ((optionals stdenv.cc.isGNU [
     "-Wno-error=int-in-bool-context"
     "-Wno-error=class-memaccess"
     "-Wno-error=restrict"
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index f763274c15d74..e22c4a01ba4db 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
   '';
 
   # for gcc5; c11 inline semantics breaks the build
-  NIX_CFLAGS_COMPILE = "-fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-fgnu89-inline";
 
   meta = with stdenv.lib; {
     description = "Io programming language";
diff --git a/pkgs/development/interpreters/jimtcl/default.nix b/pkgs/development/interpreters/jimtcl/default.nix
index d803fe43fd7ad..a7ca3523d20c5 100644
--- a/pkgs/development/interpreters/jimtcl/default.nix
+++ b/pkgs/development/interpreters/jimtcl/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     "--ipv6"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_gfx ]);
+  env.NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_gfx ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/love/0.10.nix b/pkgs/development/interpreters/love/0.10.nix
index e1ca3ded20833..a325ea0c2f3fe 100644
--- a/pkgs/development/interpreters/love/0.10.nix
+++ b/pkgs/development/interpreters/love/0.10.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = http://love2d.org;
diff --git a/pkgs/development/interpreters/love/0.7.nix b/pkgs/development/interpreters/love/0.7.nix
index 3bf8aee0d07b2..0b8d1e09775a5 100644
--- a/pkgs/development/interpreters/love/0.7.nix
+++ b/pkgs/development/interpreters/love/0.7.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     } || true
   '';
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -I${SDL.dev}/include/SDL
     -I${freetype.dev}include/freetype2
   '';
diff --git a/pkgs/development/interpreters/love/0.8.nix b/pkgs/development/interpreters/love/0.8.nix
index 3a6c385ee5fc6..27f9c13e74493 100644
--- a/pkgs/development/interpreters/love/0.8.nix
+++ b/pkgs/development/interpreters/love/0.8.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     } || true
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${SDL.dev}/include/SDL"
     "-I${freetype.dev}include/freetype2"
     "-DGL_GLEXT_PROTOTYPES" # https://community.khronos.org/t/glgenbuffers-was-not-declared-in-this-scope/59283/2
diff --git a/pkgs/development/interpreters/love/0.9.nix b/pkgs/development/interpreters/love/0.9.nix
index a2182f4543616..e6a537913197e 100644
--- a/pkgs/development/interpreters/love/0.9.nix
+++ b/pkgs/development/interpreters/love/0.9.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = http://love2d.org;
diff --git a/pkgs/development/interpreters/love/11.1.nix b/pkgs/development/interpreters/love/11.1.nix
index 3629345baf6ae..84e62d859c0c5 100644
--- a/pkgs/development/interpreters/love/11.1.nix
+++ b/pkgs/development/interpreters/love/11.1.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = http://love2d.org;
diff --git a/pkgs/development/interpreters/lush/default.nix b/pkgs/development/interpreters/lush/default.nix
index a8db08e87a2cd..a569edcb2bae4 100644
--- a/pkgs/development/interpreters/lush/default.nix
+++ b/pkgs/development/interpreters/lush/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_LDFLAGS=" -lz ";
+  env.NIX_LDFLAGS=" -lz ";
 
   meta = {
     description = "Lisp Universal SHell";
diff --git a/pkgs/development/interpreters/nix-exec/default.nix b/pkgs/development/interpreters/nix-exec/default.nix
index bde2f5d9fa968..0d7885441a962 100644
--- a/pkgs/development/interpreters/nix-exec/default.nix
+++ b/pkgs/development/interpreters/nix-exec/default.nix
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ nix git ];
 
-  NIX_CFLAGS_COMPILE = "-std=c++1y";
+  env.NIX_CFLAGS_COMPILE = "-std=c++1y";
 
   meta = {
     description = "Run programs defined in nix expressions";
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 0fa605a4cac72..7cc214294f8c7 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -109,7 +109,7 @@ let
         ++ optional libzipSupport libzip
         ++ optional valgrindSupport valgrind;
 
-      CXXFLAGS = optionalString stdenv.cc.isClang "-std=c++11";
+      env.CXXFLAGS = optionalString stdenv.cc.isClang "-std=c++11";
 
       configureFlags = [
         "--with-config-file-scan-dir=/etc/php.d"
diff --git a/pkgs/development/interpreters/pixie/default.nix b/pkgs/development/interpreters/pixie/default.nix
index 02f6d34a0305d..220cd7a2631b3 100644
--- a/pkgs/development/interpreters/pixie/default.nix
+++ b/pkgs/development/interpreters/pixie/default.nix
@@ -58,19 +58,21 @@ let
       $PYTHON $RPYTHON ${common-flags} ${target}
       find pixie -name "*.pxi" -exec ./pixie-vm -c {} \;
     )'';
-    LD_LIBRARY_PATH = library-path;
-    C_INCLUDE_PATH = include-path;
-    LIBRARY_PATH = library-path;
-    PATH = bin-path;
+    env = {
+      LD_LIBRARY_PATH = library-path;
+      C_INCLUDE_PATH = include-path;
+      LIBRARY_PATH = library-path;
+      PATH = bin-path;
+    };
     installPhase = ''
       mkdir -p $out/share $out/bin
       cp pixie-src/pixie-vm $out/share/pixie-vm
       cp -R pixie-src/pixie $out/share/pixie
       makeWrapper $out/share/pixie-vm $out/bin/pixie \
-        --prefix LD_LIBRARY_PATH : ${LD_LIBRARY_PATH} \
-        --prefix C_INCLUDE_PATH : ${C_INCLUDE_PATH} \
-        --prefix LIBRARY_PATH : ${LIBRARY_PATH} \
-        --prefix PATH : ${PATH}
+        --prefix LD_LIBRARY_PATH : ${env.LD_LIBRARY_PATH} \
+        --prefix C_INCLUDE_PATH : ${env.C_INCLUDE_PATH} \
+        --prefix LIBRARY_PATH : ${env.LIBRARY_PATH} \
+        --prefix PATH : ${env.PATH}
     '';
     doCheck = true;
     checkPhase = ''
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 9c35fc3549765..8571df2116b54 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison flex makeWrapper ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
-  NIX_LDFLAGS = "-lLLVMJIT";
+  env.NIX_LDFLAGS = "-lLLVMJIT";
 
   postPatch = ''
     for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
diff --git a/pkgs/development/interpreters/python/cpython/2.7/boot.nix b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
index 0b9ddc0bb3457..b2761cca60002 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/boot.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
@@ -21,10 +21,12 @@ stdenv.mkDerivation rec {
     sha256 = "0y7rl603vmwlxm6ilkhc51rx2mfj14ckcz40xxgs0ljnvlhp30yp";
   };
 
-  inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
+  env = {
+    inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
+    LDFLAGS = optionalString (!stdenv.isDarwin) "-lgcc_s";
+    NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2";
+  };
 
-  LDFLAGS = optionalString (!stdenv.isDarwin) "-lgcc_s";
-  NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2";
 
   buildInputs = optionals stdenv.isDarwin [ CF configd ];
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index e6b3dff433b3a..483c0bc72e465 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -203,12 +203,13 @@ in with passthru; stdenv.mkDerivation ({
 
     inherit src patches buildInputs nativeBuildInputs preConfigure configureFlags;
 
-    LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
-    inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
-
-    NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2"
-      + optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
-    DETERMINISTIC_BUILD = 1;
+    env = {
+      LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+      inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
+      NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2"
+        + optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
+      DETERMINISTIC_BUILD = 1;
+    };
 
     setupHook = python-setup-hook sitePackages;
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e75bd0a09875e..cbedd8cde481a 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -130,12 +130,14 @@ in with passthru; stdenv.mkDerivation {
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
 
-  CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
-  LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
-  NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
-  # Determinism: We fix the hashes of str, bytes and datetime objects.
-  PYTHONHASHSEED=0;
+  env = {
+    CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
+    LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
+    LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
+    NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
+    # Determinism: We fix the hashes of str, bytes and datetime objects.
+    PYTHONHASHSEED = 0;
+  };
 
   configureFlags = [
     "--enable-shared"
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index b220bfa0f9345..cdbc07c628883 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -51,9 +51,11 @@ in with passthru; stdenv.mkDerivation rec {
 
   hardeningDisable = optional stdenv.isi686 "pic";
 
-  C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" buildInputs;
-  LIBRARY_PATH = makeLibraryPath buildInputs;
-  LD_LIBRARY_PATH = makeLibraryPath (filter (x : x.outPath != stdenv.cc.libc.outPath or "") buildInputs);
+  env = {
+    C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" buildInputs;
+    LIBRARY_PATH = makeLibraryPath buildInputs;
+    LD_LIBRARY_PATH = makeLibraryPath (filter (x : x.outPath != stdenv.cc.libc.outPath or "") buildInputs);
+  };
 
   patches = [
     (substituteAll {
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 3b3b91afd6f03..fe2b0f7d649db 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   FONTCONFIG_FILE = fontsConf;
   LD_LIBRARY_PATH = libPath;
-  NIX_LDFLAGS = stdenv.lib.concatStringsSep " " [
+  env.NIX_LDFLAGS = stdenv.lib.concatStringsSep " " [
     (stdenv.lib.optionalString (stdenv.cc.isGNU && ! stdenv.isDarwin) "-lgcc_s")
     (stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation")
   ];
diff --git a/pkgs/development/interpreters/renpy/default.nix b/pkgs/development/interpreters/renpy/default.nix
index 759a44b5760fc..5431298f38cb3 100644
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@@ -58,5 +58,5 @@ stdenv.mkDerivation rec {
       --add-flags "-O $out/share/renpy/renpy.py"
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${pygame_sdl2}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE = "-I${pygame_sdl2}/include/${python.libPrefix}";
 }
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index babfd6849a849..66672f7657667 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     # autoipd won't build on darwin
     ++ stdenv.lib.optional stdenv.isDarwin "--disable-autoipd";
 
-  NIX_CFLAGS_COMPILE = "-DAVAHI_SERVICE_DIR=\"/etc/avahi/services\"";
+  env.NIX_CFLAGS_COMPILE = "-DAVAHI_SERVICE_DIR=\"/etc/avahi/services\"";
 
   preBuild = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i '20 i\
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index b10797d3d56fb..1e629d4f1605b 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-Wno-nullability-extension -Wno-typedef-redefinition";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/bamf/default.nix b/pkgs/development/libraries/bamf/default.nix
index 60322f530166c..6e0b6365decf4 100644
--- a/pkgs/development/libraries/bamf/default.nix
+++ b/pkgs/development/libraries/bamf/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = with stdenv.lib; {
     description = "Application matching framework";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 0d3df37d8e097..ea9ec4a19df59 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 82bcd49592d4a..41437e6af5d5f 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -136,7 +136,7 @@ stdenv.mkDerivation {
     EOF
   '';
 
-  NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.isDarwin
                       "-headerpad_max_install_names";
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/boringssl/default.nix b/pkgs/development/libraries/boringssl/default.nix
index 67e2794c8a293..f38e83b559262 100644
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ cmake perl go ];
   enableParallelBuilding = true;
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [ "GOCACHE=$(TMPDIR)/go-cache" ];
 
diff --git a/pkgs/development/libraries/buddy/default.nix b/pkgs/development/libraries/buddy/default.nix
index 9b722602a65c3..5c9741382f647 100644
--- a/pkgs/development/libraries/buddy/default.nix
+++ b/pkgs/development/libraries/buddy/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison ];
   patches = [ ./gcc-4.3.3-fixes.patch ];
   configureFlags = [ "CFLAGS=-O3" "CXXFLAGS=-O3" ];
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix
index 5b4e37eff9f60..0b048c929cb19 100644
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
     "-Wno-error=argument-outside-range -Wno-error=c++11-narrowing";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/bzrtp/default.nix b/pkgs/development/libraries/bzrtp/default.nix
index b2dc295db5b7c..114c067e400c4 100644
--- a/pkgs/development/libraries/bzrtp/default.nix
+++ b/pkgs/development/libraries/bzrtp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bctoolbox sqlite ];
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   meta = with stdenv.lib; {
     description = "BZRTP is an opensource implementation of ZRTP keys exchange protocol";
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 91347813a24f5..120782160f93c 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   # /build/clucene-core-2.3.3.4/build/bin/cl_test"
   doCheck = false;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with stdenv.lib; {
     description = "Core library for full-featured text search engine";
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
index dc742a5c051ae..57386dcacf06c 100644
--- a/pkgs/development/libraries/cpp-hocon/default.nix
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/cppdb/default.nix b/pkgs/development/libraries/cppdb/default.nix
index bb521ba3ec0c9..aec2b7b2fe59e 100644
--- a/pkgs/development/libraries/cppdb/default.nix
+++ b/pkgs/development/libraries/cppdb/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ cmake sqlite libmysqlclient postgresql unixODBC ];
 
   cmakeFlags = [ "--no-warn-unused-cli" ];
-  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
+  env.NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   meta = with stdenv.lib; {
     homepage = http://cppcms.com/sql/cppdb/;
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index a7313c2055367..fa3e8b1085f00 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ gflags ];
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/google/crc32c;
diff --git a/pkgs/development/libraries/cre2/default.nix b/pkgs/development/libraries/cre2/default.nix
index a4313fa94d367..feee15ccaf990 100644
--- a/pkgs/development/libraries/cre2/default.nix
+++ b/pkgs/development/libraries/cre2/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [ re2 texinfo ];
 
-  NIX_LDFLAGS="-lre2 -lpthread";
+  env.NIX_LDFLAGS="-lre2 -lpthread";
 
   configureFlags = [
     "--enable-maintainer-mode"
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index d9a17aff9418c..095d9478bdd98 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  NIX_LDFLAGS = "-lbluetooth";
+  env.NIX_LDFLAGS = "-lbluetooth";
 
   postInstall = ''
     # Some programs (for example, cabal-install) have problems with the double 0
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 5024ea3ef2494..5b508f47d4c3f 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -78,8 +78,10 @@ stdenv.mkDerivation rec {
   # Enable X11 autolaunch support in libdbus. This doesn't actually depend on X11
   # (it just execs dbus-launch in dbus.tools), contrary to what the configure script demands.
   # problems building without x11Support so disabled in that case for now
-  NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-DDBUS_ENABLE_X11_AUTOLAUNCH=1";
-  NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-DDBUS_ENABLE_X11_AUTOLAUNCH=1";
+    NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/directfb/default.nix b/pkgs/development/libraries/directfb/default.nix
index f7545bb03d56c..7e12c98589101 100644
--- a/pkgs/development/libraries/directfb/default.nix
+++ b/pkgs/development/libraries/directfb/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       libXrender
     ]);
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   configureFlags = [
     "--enable-sdl"
diff --git a/pkgs/development/libraries/easyloggingpp/default.nix b/pkgs/development/libraries/easyloggingpp/default.nix
index 028cd221614bc..3ec67b1620141 100644
--- a/pkgs/development/libraries/easyloggingpp/default.nix
+++ b/pkgs/development/libraries/easyloggingpp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [cmake];
   buildInputs = [gtest];
   cmakeFlags = [ "-Dtest=ON" ];
-  NIX_CFLAGS_COMPILE = "-std=c++11" +
+  env.NIX_CFLAGS_COMPILE = "-std=c++11" +
     stdenv.lib.optionalString stdenv.isLinux " -pthread";
   postInstall = ''
     mkdir -p $out/include
diff --git a/pkgs/development/libraries/epoxy/default.nix b/pkgs/development/libraries/epoxy/default.nix
index 362607eed181d..0af12d82ab91f 100644
--- a/pkgs/development/libraries/epoxy/default.nix
+++ b/pkgs/development/libraries/epoxy/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libgl-path.patch ];
 
-  NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
+  env.NIX_CFLAGS_COMPILE = ''-DLIBGL_PATH="${getLib libGL}/lib"'';
 
   doCheck = false; # needs X11
 
diff --git a/pkgs/development/libraries/ffms/default.nix b/pkgs/development/libraries/ffms/default.nix
index 30fb94aa24835..4293833ec3057 100644
--- a/pkgs/development/libraries/ffms/default.nix
+++ b/pkgs/development/libraries/ffms/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0dkz5b3gxq5p4xz0qqg6l2sigszrlsinz3skyf0ln4wf3zrvf8m5";
   };
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ zlib ffmpeg ];
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index c0a3d3718f345..d90919815b412 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # TODO: some issues with temporary files
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/flint/default.nix b/pkgs/development/libraries/flint/default.nix
index 462d186c72df6..7589404e7e01e 100644
--- a/pkgs/development/libraries/flint/default.nix
+++ b/pkgs/development/libraries/flint/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   # issues with ntl -- https://github.com/wbhart/flint2/issues/487
-  NIX_CXXSTDLIB_COMPILE = "-std=c++11";
+  env.NIX_CXXSTDLIB_COMPILE = "-std=c++11";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/gdal/gdal-1_11.nix b/pkgs/development/libraries/gdal/gdal-1_11.nix
index 6a086d9c998de..a1427651f4b22 100644
--- a/pkgs/development/libraries/gdal/gdal-1_11.nix
+++ b/pkgs/development/libraries/gdal/gdal-1_11.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Allow use of old proj_api.h
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   # Prevent this:
   #
diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix
index b3e8ec2e17808..651f70208d01c 100644
--- a/pkgs/development/libraries/gegl/4.0.nix
+++ b/pkgs/development/libraries/gegl/4.0.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
 
   # TODO: Fix missing math symbols in gegl seamless clone.
   # It only appears when we use packaged poly2tri-c instead of vendored one.
-  NIX_CFLAGS_COMPILE = "-lm";
+  env.NIX_CFLAGS_COMPILE = "-lm";
 
   postPatch = ''
     chmod +x tests/opencl/opencl_test.sh tests/buffer/buffer-tests-run.sh
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 1b3d5ba4b7c06..72d4376eb8f4e 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "1svhbjibm448ybq6gnjjzj0ak42srhihssafj0w402aj71lgaq4a";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 4a7d6cce90b07..ee23b0929e6a6 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -118,12 +118,13 @@ stdenv.mkDerivation rec {
     "-Ddevbindir=${placeholder ''dev''}/bin"
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=nonnull"
-    # Default for release buildtype but passed manually because
-    # we're using plain
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error=nonnull" +
+      # Default for release buildtype but passed manually because
+      # we're using plain
+      " -DG_DISABLE_CAST_CHECKS";
+    DETERMINISTIC_BUILD = 1;
+  };
 
   postPatch = ''
     # substitute fix-gio-launch-desktop-path.patch
@@ -138,8 +139,6 @@ stdenv.mkDerivation rec {
     patchShebangs tests/gen-casemap-txt.py
   '';
 
-  DETERMINISTIC_BUILD = 1;
-
   postInstall = ''
     moveToOutput "share/glib-2.0" "$dev"
     substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 32be2205bcc12..a15ef829c2ba5 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -37,12 +37,13 @@ let
   version = "2.27";
   patchSuffix = "";
   sha256 = "0wpwq7gsm7sd6ysidv0z575ckqdg13cr2njyfgrbgh4f65adwwji";
+  inherit (lib) foldl recursiveUpdate;
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
 assert withGd -> gd != null && libpng != null;
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation (foldl recursiveUpdate {} [ {
   inherit version;
   linuxHeaders = if withLinuxHeaders then linuxHeaders else null;
 
@@ -159,12 +160,12 @@ stdenv.mkDerivation ({
   # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
   # prevent a retained dependency on the bootstrap tools in the stdenv-linux
   # bootstrap.
-  BASH_SHELL = "/bin/sh";
+  env.BASH_SHELL = "/bin/sh";
 
   passthru = { inherit version; };
 }
 
-// (removeAttrs args [ "withLinuxHeaders" "withGd" ]) //
+(removeAttrs args [ "withLinuxHeaders" "withGd" ])
 
 {
   name = name + "-${version}${patchSuffix}";
@@ -227,11 +228,11 @@ stdenv.mkDerivation ({
   } // meta;
 }
 
-// lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+(lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
   preInstall = null; # clobber the native hook
 
   # To avoid a dependency on the build system 'bash'.
   preFixup = ''
     rm -f $bin/bin/{ldd,tzselect,catchsegv,xtrace}
   '';
-})
+}) ])
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 1a17595a1a32f..4dda625bea561 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -24,7 +24,24 @@ callPackage ./common.nix { inherit stdenv; } {
     # (For example, if you define `patches = [...]` here, it will
     # override the patches in `common.nix`.)
 
-    NIX_NO_SELF_RPATH = true;
+    env = {
+      NIX_NO_SELF_RPATH = true;
+      NIX_CFLAGS_COMPILE = stdenv.lib.concatStringsSep " "
+        (if !stdenv.hostPlatform.isMusl
+          # TODO: This (returning a string or `null`, instead of a list) is to
+          #       not trigger a mass rebuild due to the introduction of the
+          #       musl-specific flags below.
+          #       At next change to non-musl glibc builds, remove this `then`
+          #       and the above condition, instead keeping only the `else` below.
+          then stdenv.lib.optionals withGd gdCflags
+          else
+            builtins.concatLists [
+              (stdenv.lib.optionals withGd gdCflags)
+              # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
+              # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
+              (stdenv.lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
+            ]);
+    };
 
     postConfigure = ''
       # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
@@ -48,22 +65,6 @@ callPackage ./common.nix { inherit stdenv; } {
     #      limit rebuilds by only disabling pie w/musl
       ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "pie";
 
-    NIX_CFLAGS_COMPILE = stdenv.lib.concatStringsSep " "
-      (if !stdenv.hostPlatform.isMusl
-        # TODO: This (returning a string or `null`, instead of a list) is to
-        #       not trigger a mass rebuild due to the introduction of the
-        #       musl-specific flags below.
-        #       At next change to non-musl glibc builds, remove this `then`
-        #       and the above condition, instead keeping only the `else` below.
-        then (stdenv.lib.optionals withGd gdCflags)
-        else
-          (builtins.concatLists [
-            (stdenv.lib.optionals withGd gdCflags)
-            # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
-            # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
-            (stdenv.lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
-          ]));
-
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
     # store path than that determined when built (as a source for the
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index d39d6f0d7a36a..309302e798bf1 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     cp ${gcc7PlatformPatch} glm/simd/platform.h
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-DGLM_COMPILER=0";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-DGLM_COMPILER=0";
 
   postInstall = ''
     mkdir -p $doc/share/doc/glm
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index adbb714c7b29f..807a1aa437eb7 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     webkitgtk
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   postPatch = ''
     chmod +x meson_post_install.py
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index 0e98575498500..d77e842db50b5 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace libtool --replace stdc++ c++
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
     "-D_XOPEN_SOURCE -Wno-aligned-allocation-unavailable";
 
   # some packages want to link to the static tcmalloc_minimal
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index ed2b5563bd373..49edecc429ded 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   # fit in the limit. https://github.com/NixOS/nix/pull/1085
     ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
 
-  NIX_CFLAGS_COMPILE = toString (
+  env.NIX_CFLAGS_COMPILE = toString (
     # qgpgme uses Q_ASSERT which retains build inputs at runtime unless
     # debugging is disabled
     lib.optional (qtbase != null) "-DQT_NO_DEBUG"
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index abcd3abaf3097..a38934e188a5d 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     export LD_LIBRARY_PATH=$(pwd):$LD_LIBRARY_PATH
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
 
   enableParallelBuilds = true;
 
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 966d6a8ffd5de..8af4e991dc4d9 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
   doCheck = stdenv.hostPlatform.system != "i686-linux" && stdenv.hostPlatform.system != "aarch64-linux";
diff --git a/pkgs/development/libraries/gsl/gsl-1_16.nix b/pkgs/development/libraries/gsl/gsl-1_16.nix
index ae102ac60307c..842a59fdbabbb 100644
--- a/pkgs/development/libraries/gsl/gsl-1_16.nix
+++ b/pkgs/development/libraries/gsl/gsl-1_16.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index a7c2bcf838e7b..42b45e8ad13cd 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -127,11 +127,9 @@ stdenv.mkDerivation rec {
   ];
 
 
-  NIX_LDFLAGS = [
-    # linking error on Darwin
-    # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
-    "-lncurses"
-  ];
+  # linking error on Darwin
+  # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
+  env.NIX_LDFLAGS = "-lncurses";
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
   doCheck = false;
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 60432614433bf..67c3e7da2ab0e 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
+  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     files=(
diff --git a/pkgs/development/libraries/hiredis/default.nix b/pkgs/development/libraries/hiredis/default.nix
index 6dc3871e1c184..0f8beafcc81bc 100644
--- a/pkgs/development/libraries/hiredis/default.nix
+++ b/pkgs/development/libraries/hiredis/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ik38lwpmm780jqrry95ckf6flmvd172444p3q8d1k9n99jwij9c";
   };
 
-  PREFIX = "\${out}";
+  env.PREFIX = "\${out}";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/redis/hiredis;
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index 4b1a695ca551d..f8b4c6e967535 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     sha256 = "1qs6x3n2nrcj1wiik5pg5i16inykf7rcfdfdy7rwyzf40pvdl3c2";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
   patches = [ ./build-shared.patch ];
   makeFlags = [ "DESTDIR=" "PREFIX=$(out)" ];
   buildFlags = [ "library" ];
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 00cdda1e57084..64f866bb15677 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ automake autoconf libtool which ];
 
-  NIX_CFLAGS_LINK = "-pthread";
+  env.NIX_CFLAGS_LINK = "-pthread";
 
   patches = [
     ./bootstrap.patch
diff --git a/pkgs/development/libraries/java/swt/default.nix b/pkgs/development/libraries/java/swt/default.nix
index b0fdca1121867..6c14f283e33ce 100644
--- a/pkgs/development/libraries/java/swt/default.nix
+++ b/pkgs/development/libraries/java/swt/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip pkgconfig ];
   buildInputs = [ jdk gtk2 libXt libXtst libXi libGLU libGL webkitgtk libsoup ];
 
-  NIX_LFLAGS = toString (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) +
+  env.NIX_LFLAGS = toString (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) +
     " -lX11 -lpango-1.0 -lgdk_pixbuf-2.0 -lglib-2.0";
 
   buildPhase = ''
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index b7b9b019b639c..9dab53c3d528d 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=ignored-qualifiers"
     "-Wno-error=class-memaccess"
     "-Wno-error=catch-value"
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index daa349ca63096..50410d5be0126 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = optional withAACS libaacs;
 
-  NIX_LDFLAGS = toString [
+  env.NIX_LDFLAGS = toString [
     (optionalString withAACS   "-L${libaacs}/lib -laacs")
     (optionalString withBDplus "-L${libbdplus}/lib -lbdplus")
   ];
diff --git a/pkgs/development/libraries/libcaca/default.nix b/pkgs/development/libraries/libcaca/default.nix
index 7773fe46c0cea..07f7c388680e1 100644
--- a/pkgs/development/libraries/libcaca/default.nix
+++ b/pkgs/development/libraries/libcaca/default.nix
@@ -17,9 +17,9 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     (if x11Support then "--enable-x11" else "--disable-x11")
-    ];
+  ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!x11Support) "-DX_DISPLAY_MISSING";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!x11Support) "-DX_DISPLAY_MISSING";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 4949d657669b2..2fa5d2aca0b34 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
 
-  NIX_CFLAGS_COMPILE = "-fno-lto";
+  env.NIX_CFLAGS_COMPILE = "-fno-lto";
 
   meta = with stdenv.lib; {
     description = "CBOR protocol implementation for C and others";
diff --git a/pkgs/development/libraries/libclxclient/default.nix b/pkgs/development/libraries/libclxclient/default.nix
index d6e2ad398d778..be0f0f7057436 100644
--- a/pkgs/development/libraries/libclxclient/default.nix
+++ b/pkgs/development/libraries/libclxclient/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  NIX_CFLAGS_COMPILE = "-I${xorg.xorgproto}/include -I${libXft.dev}/include";
+  env.NIX_CFLAGS_COMPILE = "-I${xorg.xorgproto}/include -I${libXft.dev}/include";
 
   patchPhase = ''
     cd source
diff --git a/pkgs/development/libraries/libdiscid/default.nix b/pkgs/development/libraries/libdiscid/default.nix
index d7d88b3838659..39d9f23fd9962 100644
--- a/pkgs/development/libraries/libdiscid/default.nix
+++ b/pkgs/development/libraries/libdiscid/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1f9irlj3dpb5gyfdnb1m4skbjvx4d4hwiz2152f83m0d9jn47r7r";
   };
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
 
   meta = with stdenv.lib; {
     description = "A C library for creating MusicBrainz DiscIDs from audio CDs";
diff --git a/pkgs/development/libraries/libdvdread/4.9.9.nix b/pkgs/development/libraries/libdvdread/4.9.9.nix
index fbe56023a91c4..592cbd238c62a 100644
--- a/pkgs/development/libraries/libdvdread/4.9.9.nix
+++ b/pkgs/development/libraries/libdvdread/4.9.9.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   buildInputs = [libdvdcss];
 
-  NIX_LDFLAGS = "-ldvdcss";
+  env.NIX_LDFLAGS = "-ldvdcss";
 
   postInstall = ''
     ln -s dvdread $out/include/libdvdread
diff --git a/pkgs/development/libraries/libdvdread/default.nix b/pkgs/development/libraries/libdvdread/default.nix
index c133c0ba6f926..131f9f5b28b2e 100644
--- a/pkgs/development/libraries/libdvdread/default.nix
+++ b/pkgs/development/libraries/libdvdread/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [libdvdcss];
 
-  NIX_LDFLAGS = "-ldvdcss";
+  env.NIX_LDFLAGS = "-ldvdcss";
 
   postInstall = ''
     ln -s dvdread $out/include/libdvdread
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index c02a6f9a50252..06610d34a5508 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   ];
 
   # added to fix build with gcc7+
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
diff --git a/pkgs/development/libraries/libe-book/default.nix b/pkgs/development/libraries/libe-book/default.nix
index 805b1869ac38c..c8147f0292638 100644
--- a/pkgs/development/libraries/libe-book/default.nix
+++ b/pkgs/development/libraries/libe-book/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit (s) url sha256;
   };
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
   meta = {
     inherit (s) version;
     description = ''Library for import of reflowable e-book formats'';
diff --git a/pkgs/development/libraries/libfakekey/default.nix b/pkgs/development/libraries/libfakekey/default.nix
index 3c24319154331..d649ed81b7db0 100644
--- a/pkgs/development/libraries/libfakekey/default.nix
+++ b/pkgs/development/libraries/libfakekey/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXi libXtst xorgproto ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = with stdenv.lib; {
     description = "X virtual keyboard library";
diff --git a/pkgs/development/libraries/libfaketime/default.nix b/pkgs/development/libraries/libfaketime/default.nix
index 10cc5cace7b57..ffc3410be388f 100644
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@@ -21,10 +21,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  PREFIX = placeholder "out";
-  LIBDIRNAME = "/lib";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type -Wno-error=format-truncation";
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type -Wno-error=format-truncation";
+    PREFIX = placeholder "out";
+    LIBDIRNAME = "/lib";
+  };
 
   checkInputs = [ perl ];
 
diff --git a/pkgs/development/libraries/libfpx/default.nix b/pkgs/development/libraries/libfpx/default.nix
index 97df5107409a6..326aa0b359932 100644
--- a/pkgs/development/libraries/libfpx/default.nix
+++ b/pkgs/development/libraries/libfpx/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # Darwin gets misdetected as Windows without this
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__unix";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__unix";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 54bf091e5ea90..e9c4da496d028 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pf3yhwq9qk0w3yv9bb8qlwwqkffg7xb4sgc8yqdnn6pa56i3vmn";
   };
 
-  NIX_LDFLAGS = "-lgif";
+  env.NIX_LDFLAGS = "-lgif";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 55b801b0b0d54..1250830a4cb18 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
       --replace "-Xlinker --version-script=$(VERSION_SCRIPT)" "-Xlinker"
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-UDEFAULT_EGL_VENDOR_CONFIG_DIRS"
     # FHS paths are added so that non-NixOS applications can find vendor files.
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 8d480c2d88297..dab8403c64a21 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--disable-appliance" "--disable-daemon" "--with-distro=NixOS" ]
     ++ stdenv.lib.optionals (!javaSupport) [ "--disable-java" "--without-java" ];
   patches = [ ./libguestfs-syms.patch ];
-  NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
+  env.NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
   installFlags = [ "REALLY_INSTALL=yes" ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libjson-rpc-cpp/default.nix b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
index a7c9427080d87..c7511cf4ee392 100644
--- a/pkgs/development/libraries/libjson-rpc-cpp/default.nix
+++ b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${catch}/include/catch";
+  env.NIX_CFLAGS_COMPILE = "-I${catch}/include/catch";
 
   postPatch = ''
     for f in cmake/FindArgtable.cmake \
diff --git a/pkgs/development/libraries/libmatchbox/default.nix b/pkgs/development/libraries/libmatchbox/default.nix
index 98875e48f57f6..e23fcb1eea770 100644
--- a/pkgs/development/libraries/libmatchbox/default.nix
+++ b/pkgs/development/libraries/libmatchbox/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libXft libICE pango libjpeg ];
   propagatedBuildInputs = [ libX11 libXext libpng ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/matchbox/libmatchbox/${version}/libmatchbox-${version}.tar.bz2";
diff --git a/pkgs/development/libraries/libmemcached/default.nix b/pkgs/development/libraries/libmemcached/default.nix
index 5655bfe968b9d..e785ba09dea7f 100644
--- a/pkgs/development/libraries/libmemcached/default.nix
+++ b/pkgs/development/libraries/libmemcached/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = with stdenv.lib; {
     homepage = https://libmemcached.org;
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index 284d415454deb..381a30e83cc23 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs =
     optional stdenv.isLinux libpulseaudio;
 
-  NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
+  env.NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
 
   meta = with stdenv.lib; {
     description = "A library for playing tracker music module files";
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index d2848d9a1e9bb..54892b3f46f39 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 4d45c6872e4c6..e0c38dcdd4061 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   # Fix for #40213, probably permanent, because upstream doesn't seem to be
   # developed anymore. Alternatively, gcc7Stdenv could be used.
-  NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds";
 
   meta = with stdenv.lib; {
     homepage = https://sourceforge.net/projects/omxil/;
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index b2594d7c1d700..7fbe8fa10710c 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   buildInputs = [ ncurses perl ];
 
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 3398d3feb94f3..a201e0956dc41 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, enableShared ? true }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation (stdenv.lib.recursiveUpdate rec {
   version = "4.10.1";
   pname = "libpfm";
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation (rec {
     "SYS=${stdenv.hostPlatform.uname.system}"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "Helper library to program the performance monitoring events";
@@ -30,8 +30,6 @@ stdenv.mkDerivation (rec {
     maintainers = [ maintainers.pierron ];
     platforms = platforms.linux;
   };
-} // stdenv.lib.optionalAttrs ( ! enableShared )
-{
-  CONFIG_PFMLIB_SHARED = "n";
-}
-)
+} (stdenv.lib.optionalAttrs (!enableShared) {
+  env.CONFIG_PFMLIB_SHARED = "n";
+}))
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index dd6318444e78f..b0417815e9bb7 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
   # Make sure libqtav finds its libGL dependency at both link and run time
   # by adding libGL to rpath. Not sure why it wasn't done automatically like
   # the other libraries as `libGL` is part of our `buildInputs`.
-  NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
+  env.NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
 
   preFixup = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/development/libraries/librdf/redland.nix b/pkgs/development/libraries/librdf/redland.nix
index 8835490187d1d..f4fc83acdbcfd 100644
--- a/pkgs/development/libraries/librdf/redland.nix
+++ b/pkgs/development/libraries/librdf/redland.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     ];
 
   # Fix broken DT_NEEDED in lib/redland/librdf_storage_sqlite.so.
-  NIX_CFLAGS_LINK = "-lraptor2";
+  env.NIX_CFLAGS_LINK = "-lraptor2";
 
   doCheck = false; # fails 1 out of 17 tests with a segmentation fault
 
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 11c7f3fed84ec..42fa208c0e442 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     "installed_testdir=$(installedTests)/libexec/installed-tests/RSVG"
   ];
 
-  NIX_CFLAGS_COMPILE
+  env.NIX_CFLAGS_COMPILE
     = stdenv.lib.optionalString stdenv.isDarwin "-I${cairo.dev}/include/cairo";
 
   # It wants to add loaders and update the loaders.cache in gdk-pixbuf
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index b150dd0f59c33..90925d872fc90 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     '';
 
   # Needed on Darwin.
-  NIX_CFLAGS_LINK = "-logg -lvorbis";
+  env.NIX_CFLAGS_LINK = "-logg -lvorbis";
 
   meta = with stdenv.lib; {
     description = "A C library for reading and writing files containing sampled sound";
diff --git a/pkgs/development/libraries/libsoundio/default.nix b/pkgs/development/libraries/libsoundio/default.nix
index 62e5601b73c46..96660f25d4936 100644
--- a/pkgs/development/libraries/libsoundio/default.nix
+++ b/pkgs/development/libraries/libsoundio/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isLinux alsaLib
     ++ stdenv.lib.optional stdenv.isDarwin AudioUnit;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-strict-prototypes";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-strict-prototypes";
 
   meta = with stdenv.lib; {
     description = "Cross platform audio input and output";
diff --git a/pkgs/development/libraries/libtoxcore/new-api.nix b/pkgs/development/libraries/libtoxcore/new-api.nix
index 6cd5f9122a4f7..80a67c7044017 100644
--- a/pkgs/development/libraries/libtoxcore/new-api.nix
+++ b/pkgs/development/libraries/libtoxcore/new-api.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0ap1gvlyihnfivv235dbrgsxsiiz70bhlmlr5gn1027w3h5kqz8w";
   };
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   postPatch = ''
     # within Nix chroot builds, localhost is unresolvable
diff --git a/pkgs/development/libraries/libunique/default.nix b/pkgs/development/libraries/libunique/default.nix
index d6566978a6bbb..39b268109fb98 100644
--- a/pkgs/development/libraries/libunique/default.nix
+++ b/pkgs/development/libraries/libunique/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   # Patches from Gentoo portage
   patches = [
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index 9d90304042c8a..6b6de75f98181 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (rec {
     stdenv.lib.optional enableSystemd systemd ++
     stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
   preFixup = stdenv.lib.optionalString stdenv.isLinux ''
     sed 's,-ludev,-L${stdenv.lib.getLib systemd}/lib -ludev,' -i $out/lib/libusb-1.0.la
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index e6a57f1e38c4f..51255175431d5 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   configureFlags = stdenv.lib.optional stdenv.isLinux
     "--with-module-dir=${mesa.drivers.driverLink}/lib/vdpau";
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lX11";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lX11";
 
   installFlags = [ "moduledir=$(out)/lib/vdpau" ];
 
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 0556e311736a3..460344cb35abc 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -146,7 +146,7 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   meta = {
     homepage = http://libvirt.org/;
diff --git a/pkgs/development/libraries/libwhereami/default.nix b/pkgs/development/libraries/libwhereami/default.nix
index 8e190f998d56f..36e7c0942aca0 100644
--- a/pkgs/development/libraries/libwhereami/default.nix
+++ b/pkgs/development/libraries/libwhereami/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/libwps/default.nix b/pkgs/development/libraries/libwps/default.nix
index 61b777a524339..eaa1c09b90041 100644
--- a/pkgs/development/libraries/libwps/default.nix
+++ b/pkgs/development/libraries/libwps/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ boost librevenge zlib ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
 
   meta = with stdenv.lib; {
     homepage = http://libwps.sourceforge.net/;
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index 0204223d127cd..05331b2414c61 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -32,14 +32,14 @@ stdenv.mkDerivation rec {
     ortp libv4l libpcap srtp bctoolbox libXext libmatroska
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-DGIT_VERSION=\"v${version}\""
     "-Wno-error=deprecated-declarations"
     "-Wno-error=cast-function-type"
     "-Wno-error=stringop-truncation"
     "-Wno-error=stringop-overflow"
   ];
-  NIX_LDFLAGS = "-lXext";
+  env.NIX_LDFLAGS = "-lXext";
 
   meta = with stdenv.lib; {
     description = "A powerful and lightweight streaming engine specialized for voice/video telephony applications";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 761d6594bd01e..2a20836def829 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -183,7 +183,7 @@ stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-fno-common";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-fno-common";
 
   passthru = {
     inherit libdrm;
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index 4d7ecd92e6185..9a5b1b1d9f071 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   # mlt is unable to cope with our multi-prefix Qt build
   # because it does not use CMake or qmake.
-  NIX_CFLAGS_COMPILE = "-I${getDev qtsvg}/include/QtSvg";
+  env.NIX_CFLAGS_COMPILE = "-I${getDev qtsvg}/include/QtSvg";
 
   CXXFLAGS = "-std=c++11";
 
diff --git a/pkgs/development/libraries/mps/default.nix b/pkgs/development/libraries/mps/default.nix
index 8c1f3aea46679..b2d3404af0c0f 100644
--- a/pkgs/development/libraries/mps/default.nix
+++ b/pkgs/development/libraries/mps/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ sqlite ];
 
   # needed for 1.116.0 to build with gcc7
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-implicit-fallthrough"
     "-Wno-error=clobbered"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index 60dc00a335d9e..1bfea0dc5be52 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ slang popt ];
 
-  NIX_LDFLAGS = "-lncurses";
+  env.NIX_LDFLAGS = "-lncurses";
 
   preConfigure = ''
     # If CPP is set explicitly, configure and make will not agree about which
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index df9c326087836..74d4064f80d43 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -68,7 +68,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
     ++ stdenv.lib.optional stdenv.isDarwin "CCC=clang++";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   # TODO(@oxij): investigate this: `make -n check` works but `make
   # check` fails with "no rule", same for "installcheck".
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index 803906b134376..bd0ec3fbd0af8 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig python ];
 
   # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [ "--without-gobject" "CFLAGS=--std=gnu99" ];
 
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 20528ac9284f8..cd29e1e2a8688 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional pulseSupport libpulseaudio
     ++ optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  NIX_LDFLAGS = toString ([]
+  env.NIX_LDFLAGS = toString ([]
     ++ optional alsaSupport "-lasound"
     ++ optional pulseSupport "-lpulse");
 
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 642facf166a6b..98547b9da9262 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -208,7 +208,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 9fffd3d94770b..0f0e1194b8f5e 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index ad27742d0b4cd..91ac4f3dd66f8 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   cmakeFlags = [
     (opencvFlag "TIFF" enableTIFF)
diff --git a/pkgs/development/libraries/openexrid-unstable/default.nix b/pkgs/development/libraries/openexrid-unstable/default.nix
index 92cd343cf6a1e..6009b09f35fdb 100644
--- a/pkgs/development/libraries/openexrid-unstable/default.nix
+++ b/pkgs/development/libraries/openexrid-unstable/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
         --replace g++ c++
   '';
 
-  NIX_CFLAGS_COMPILE=''-I${ilmbase.dev}/include/OpenEXR
+  env.NIX_CFLAGS_COMPILE=''-I${ilmbase.dev}/include/OpenEXR
                        -I${openexr.dev}/include/OpenEXR
                        -I${openfx.dev}/include/OpenFX
                       '';
diff --git a/pkgs/development/libraries/openvdb/default.nix b/pkgs/development/libraries/openvdb/default.nix
index 840da0461706a..1d2eb2ce920b6 100644
--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec
 
   installFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE="-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR/";
-  NIX_LDFLAGS="-lboost_iostreams";
+  env.NIX_CFLAGS_COMPILE="-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR/";
+  env.NIX_LDFLAGS="-lboost_iostreams";
 
   meta = with stdenv.lib; {
     description = "An open framework for voxel";
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index ecb0f16c72c5f..917f292f782f0 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -43,9 +43,9 @@ in stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE = makeFontsConf {
+  env.FONTCONFIG_FILE = toString (makeFontsConf {
     fontDirectories = [ freefont_ttf ];
-  };
+  });
 
   doCheck = false; # /layout/valid-1.markup: FAIL
 
diff --git a/pkgs/development/libraries/phonon/backends/gstreamer.nix b/pkgs/development/libraries/phonon/backends/gstreamer.nix
index d79078c283692..f0f783d12b330 100644
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # on system paths being set.
   patches = [ ./gst-plugin-paths.patch ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     let gstPluginPaths =
           lib.makeSearchPathOutput "lib" "/lib/gstreamer-1.0"
           (with gst_all_1; [
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index 86e3caaa1486c..d32c3a0113440 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  NIX_CFLAGS_COMPILE = "-fPIC";
+  env.NIX_CFLAGS_COMPILE = "-fPIC";
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
diff --git a/pkgs/development/libraries/poly2tri-c/default.nix b/pkgs/development/libraries/poly2tri-c/default.nix
index a3e42b3ae4b2d..dc3d98f41d7d7 100644
--- a/pkgs/development/libraries/poly2tri-c/default.nix
+++ b/pkgs/development/libraries/poly2tri-c/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     glib
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "--std=gnu99"
     "-Wno-error"
   ];
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 68daece490fa9..efbdf9fe0eab5 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
 
   propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
diff --git a/pkgs/development/libraries/prometheus-cpp/default.nix b/pkgs/development/libraries/prometheus-cpp/default.nix
index 624b23f4d600f..b7f1fc3613a51 100644
--- a/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_LDFLAGS = "-ldl";
 
   meta = {
     description = "Prometheus Client Library for Modern C++";
diff --git a/pkgs/development/libraries/qoauth/default.nix b/pkgs/development/libraries/qoauth/default.nix
index 83e904e53eb2f..c6779143ae5dc 100644
--- a/pkgs/development/libraries/qoauth/default.nix
+++ b/pkgs/development/libraries/qoauth/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation {
   buildInputs = [ qt5.qtbase qca2-qt5 ];
   nativeBuildInputs = [ qt5.qmake ];
 
-  NIX_CFLAGS_COMPILE = "-I${qca2-qt5}/include/Qca-qt5/QtCrypto";
-  NIX_LDFLAGS = "-lqca-qt5";
+  env.NIX_CFLAGS_COMPILE = "-I${qca2-qt5}/include/Qca-qt5/QtCrypto";
+  env.NIX_LDFLAGS = "-lqca-qt5";
 
   meta = with stdenv.lib; {
     description = "Qt library for OAuth authentication";
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 25953949eb76a..d859884fb16b2 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -206,7 +206,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = toString (
+  env.NIX_CFLAGS_COMPILE = toString (
     # with gcc7 the warnings blow the log over Hydra's limit
     [ "-Wno-expansion-to-defined" "-Wno-unused-local-typedefs" ]
     ++ lib.optional stdenv.isLinux "-std=gnu++98" # gnu++ in (Obj)C flags is no good on Darwin
@@ -214,13 +214,13 @@ stdenv.mkDerivation rec {
       [ "-I${glib.dev}/include/glib-2.0" "-I${glib.out}/lib/glib-2.0/include" ]
     ++ lib.optional stdenv.isDarwin "-I${libcxx}/include/c++/v1");
 
-  NIX_LDFLAGS = lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) "-lglib-2.0";
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) "-lglib-2.0";
 
   preBuild = lib.optionalString stdenv.isDarwin ''
     # resolve "extra qualification on member" error
     sed -i 's/struct ::TabletProximityRec;/struct TabletProximityRec;/' \
       src/gui/kernel/qt_cocoa_helpers_mac_p.h
-    find . -name "Makefile*" | xargs sed -i 's/^\(LINK[[:space:]]* = clang++\)/\1 ${NIX_LDFLAGS}/'
+    find . -name "Makefile*" | xargs sed -i 's/^\(LINK[[:space:]]* = clang++\)/\1 ${env.NIX_LDFLAGS}/'
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
diff --git a/pkgs/development/libraries/qt-5/mkDerivation.nix b/pkgs/development/libraries/qt-5/mkDerivation.nix
index 2c6333cb02045..3317e2f1c0da1 100644
--- a/pkgs/development/libraries/qt-5/mkDerivation.nix
+++ b/pkgs/development/libraries/qt-5/mkDerivation.nix
@@ -12,9 +12,9 @@ let
     qmakeFlags = [ ("CONFIG+=" + (if debug then "debug" else "release")) ]
               ++ (args.qmakeFlags or []);
 
-    NIX_CFLAGS_COMPILE = toString (
+    env.NIX_CFLAGS_COMPILE = toString (
       optional (!debug) "-DQT_NO_DEBUG"
-      ++ lib.toList (args.NIX_CFLAGS_COMPILE or []));
+      ++ lib.toList (args.env.NIX_CFLAGS_COMPILE or []));
 
     cmakeFlags =
       (args.cmakeFlags or [])
@@ -29,4 +29,4 @@ let
   };
 in
 
-mkDerivation (args // args_)
+mkDerivation (lib.recursiveUpdate args args_)
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index bc23d0f9cafe1..25d935913e821 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -195,7 +195,7 @@ stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error=sign-compare" # freetype-2.5.4 changed signedness of some struct fields
     ''-DNIXPKGS_QTCOMPOSE="${libX11.out}/share/X11/locale"''
     ''-D${if compareVersion "5.11.0" >= 0 then "LIBRESOLV_SO" else "NIXPKGS_LIBRESOLV"}="${stdenv.cc.libc.out}/lib/libresolv"''
diff --git a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
index d0bab88b2f214..35a2d036b23dc 100644
--- a/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtmultimedia.nix
@@ -12,5 +12,5 @@ qtModule {
     ++ optional (stdenv.isLinux) alsaLib;
   outputs = [ "bin" "dev" "out" ];
   qmakeFlags = [ "GST_VERSION=1.0" ];
-  NIX_LDFLAGS = optionalString (stdenv.isDarwin) "-lobjc";
+  env.NIX_LDFLAGS = optionalString (stdenv.isDarwin) "-lobjc";
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtserialport.nix b/pkgs/development/libraries/qt-5/modules/qtserialport.nix
index 516d38340dc53..c339ee200885f 100644
--- a/pkgs/development/libraries/qt-5/modules/qtserialport.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtserialport.nix
@@ -5,7 +5,7 @@ let inherit (lib) getLib optional; in
 qtModule {
   name = "qtserialport";
   qtInputs = [ qtbase ];
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     optional stdenv.isLinux
     ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'';
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qttools.nix b/pkgs/development/libraries/qt-5/modules/qttools.nix
index 573472a8b5ab0..ae1c47ae00d30 100644
--- a/pkgs/development/libraries/qt-5/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttools.nix
@@ -32,7 +32,7 @@ qtModule {
     "bin/macdeployqt"
   ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     lib.optional stdenv.isDarwin ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
 
   setupHook = ../hooks/qttools-setup-hook.sh;
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index df444eee2eb56..86a2f6e4c111a 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -103,7 +103,7 @@ EOF
       --replace 'libs = [ "sandbox" ]' 'libs = [ "/usr/lib/libsandbox.1.dylib" ]'
     '');
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
     # with gcc8, -Wclass-memaccess became part of -Wall and this exceeds the logging limit
     "-Wno-class-memaccess"
   ] ++ lib.optionals (stdenv.hostPlatform.platform.gcc.arch or "" == "sandybridge") [
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index 542afdd55da02..6ed9a426c4ad0 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -50,7 +50,7 @@ qtModule {
     export qmakeFlags="$qmakeFlags CONFIG+=silent"
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = [
       # with gcc7 this warning blows the log over Hydra's limit
       "-Wno-expansion-to-defined"
     ]
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebview.nix b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
index 906d750c5d3f8..cb68cc70b2449 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebview.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
@@ -10,5 +10,5 @@ qtModule {
     darwin.apple_sdk.frameworks.WebKit
   ];
   outputs = [ "out" "dev" "bin" ];
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation -framework WebKit";
+  env.NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation -framework WebKit";
 }
diff --git a/pkgs/development/libraries/qt-mobility/default.nix b/pkgs/development/libraries/qt-mobility/default.nix
index b7857372d1cd8..d64e6cdd27521 100644
--- a/pkgs/development/libraries/qt-mobility/default.nix
+++ b/pkgs/development/libraries/qt-mobility/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "14713pbscysd6d0b9rgm7gg145jzwvgdn22778pf2v13qzvfmy1i";
   };
 
-  NIX_CFLAGS_COMPILE="-fpermissive";
+  env.NIX_CFLAGS_COMPILE="-fpermissive";
 
   configurePhase = ''
     ./configure -prefix $out
diff --git a/pkgs/development/libraries/qtinstaller/default.nix b/pkgs/development/libraries/qtinstaller/default.nix
index 3c4c192bd4b9e..bfc92ae5fc0cb 100644
--- a/pkgs/development/libraries/qtinstaller/default.nix
+++ b/pkgs/development/libraries/qtinstaller/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   setOutputFlags = false;
   enableParallelBuilding = true;
-  NIX_QT_SUBMODULE = true;
+  env.NIX_QT_SUBMODULE = true;
 
   installPhase = ''
     mkdir -p $out/{bin,lib,share/qt-installer-framework}
diff --git a/pkgs/development/libraries/rdkafka/default.nix b/pkgs/development/libraries/rdkafka/default.nix
index cb1b176ce3537..b3140ee2faa9d 100644
--- a/pkgs/development/libraries/rdkafka/default.nix
+++ b/pkgs/development/libraries/rdkafka/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib perl python openssl ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/science/benchmark/papi/default.nix b/pkgs/development/libraries/science/benchmark/papi/default.nix
index 53ae70f5bf8a3..84a0a276756e1 100644
--- a/pkgs/development/libraries/science/benchmark/papi/default.nix
+++ b/pkgs/development/libraries/science/benchmark/papi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "13mngf9kl0y2wfxqvkad0smdaag7k8fvw82b4312gx62nwhc1i6r";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   preConfigure = ''
     cd src
diff --git a/pkgs/development/libraries/science/math/nccl/default.nix b/pkgs/development/libraries/science/math/nccl/default.nix
index c9aeb83c46941..fd434f2d1cd1a 100644
--- a/pkgs/development/libraries/science/math/nccl/default.nix
+++ b/pkgs/development/libraries/science/math/nccl/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     addOpenGLRunpath $out/lib/lib*.so
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-unused-function" ];
+  env.NIX_CFLAGS_COMPILE = [ "-Wno-unused-function" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/science/math/osi/default.nix b/pkgs/development/libraries/science/math/osi/default.nix
index 6dc7e746fd35a..0fed28d569af7 100644
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
     lib.optionals withGurobi [ "--with-gurobi-incdir=${gurobi}/include" "--with-gurobi-lib=-lgurobi${gurobi.libSuffix}" ]
     ++ lib.optionals withCplex [ "--with-cplex-incdir=${cplex}/cplex/include/ilcplex" "--with-cplex-lib=-lcplex${cplex.libSuffix}" ];
 
-  NIX_LDFLAGS =
+  env.NIX_LDFLAGS =
     lib.optionalString withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
 
   # Compile errors
-  NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
+  env.NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
   hardeningDisable = [ "format" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/science/math/suitesparse/4.4.nix b/pkgs/development/libraries/science/math/suitesparse/4.4.nix
index 1ce56d1e49f7f..b29aab9cfed40 100644
--- a/pkgs/development/libraries/science/math/suitesparse/4.4.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/4.4.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
     "LAPACK="
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin " -DNTIMER";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin " -DNTIMER";
 
   postInstall = ''
     # Build and install shared library
diff --git a/pkgs/development/libraries/science/math/suitesparse/default.nix b/pkgs/development/libraries/science/math/suitesparse/default.nix
index a6c803be260a5..76a5ee6d67b72 100644
--- a/pkgs/development/libraries/science/math/suitesparse/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
         -e 's|^[[:space:]]*\(NVCCFLAGS     =\)|NVCCFLAGS = $(NV20) -O3 -gencode=arch=compute_20,code=sm_20 -gencode=arch=compute_30,code=sm_30 -gencode=arch=compute_35,code=sm_35 -gencode=arch=compute_60,code=sm_60|'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin " -DNTIMER";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin " -DNTIMER";
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/development/libraries/silgraphite/default.nix b/pkgs/development/libraries/silgraphite/default.nix
index 9d0aca0ab14ba..3777d40d017aa 100644
--- a/pkgs/development/libraries/silgraphite/default.nix
+++ b/pkgs/development/libraries/silgraphite/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ freetype libXft pango fontconfig];
 
-  NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
+  env.NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
 
   meta = {
     description = "An advanced font engine";
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index 4d74ee7ca063d..69e64232dc98f 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --prefix PKG_CONFIG_PATH ":" "${SDL.dev}/lib/pkgconfig"
   '';
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     homepage = http://icculus.org/smpeg/;
diff --git a/pkgs/development/libraries/spatialite-tools/default.nix b/pkgs/development/libraries/spatialite-tools/default.nix
index 83eef355f2db8..2142575e3a488 100644
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lsqlite3";
+  env.NIX_LDFLAGS = "-lsqlite3";
 
   meta = {
     description = "A complete sqlite3-compatible CLI front-end for libspatialite";
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index 51583fdbbcd65..fc306dce8d43d 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-dpdk=${dpdk}" ];
 
-  NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
+  env.NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix
index d2c4ddb8631e3..819b66afa3370 100644
--- a/pkgs/development/libraries/spice/default.nix
+++ b/pkgs/development/libraries/spice/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   mesonFlags = [
     "-Dgstreamer=1.0"
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index d904637fcd386..fa29d4c0cc1ad 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-threadsafe" ] ++ optional interactive "--enable-readline";
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-DSQLITE_ENABLE_COLUMN_METADATA"
     "-DSQLITE_ENABLE_DBSTAT_VTAB"
     "-DSQLITE_ENABLE_JSON1"
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 0cc4038b64e72..39950f95ebf73 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -27,7 +27,7 @@ in stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   buildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/ucl/default.nix b/pkgs/development/libraries/ucl/default.nix
index 933a3afef35b5..9de9c7999b486 100644
--- a/pkgs/development/libraries/ucl/default.nix
+++ b/pkgs/development/libraries/ucl/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   };
 
   # needed to successfully compile with gcc 6
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-std=c90";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-std=c90";
 
   meta = {
     homepage = http://www.oberhumer.com/opensource/ucl/;
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 5e5f4c9e8ca61..c88c89b8a7c31 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/usbredir/default.nix b/pkgs/development/libraries/usbredir/default.nix
index 8e43135196c90..f9aa0d501fd94 100644
--- a/pkgs/development/libraries/usbredir/default.nix
+++ b/pkgs/development/libraries/usbredir/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "002yik1x7kn0427xahvnhjby2np14a6xqw7c3dx530n9h5d9rg47";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb ];
diff --git a/pkgs/development/libraries/ustr/default.nix b/pkgs/development/libraries/ustr/default.nix
index 18eae87e11c6c..6a019128854e1 100644
--- a/pkgs/development/libraries/ustr/default.nix
+++ b/pkgs/development/libraries/ustr/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patches = [ ./va_args.patch ];
 
   # Work around gcc5 switch to gnu11
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   # Fix detection of stdint.h
   postPatch = ''
diff --git a/pkgs/development/libraries/v8/3.14.nix b/pkgs/development/libraries/v8/3.14.nix
index febadc2d6ac88..409909457a655 100644
--- a/pkgs/development/libraries/v8/3.14.nix
+++ b/pkgs/development/libraries/v8/3.14.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
   buildInputs = [ readline python icu ];
 
   # http://code.google.com/p/v8/issues/detail?id=2149
-  NIX_CFLAGS_COMPILE = concatStringsSep " " [
+  env.NIX_CFLAGS_COMPILE = concatStringsSep " " [
     "-Wno-error=strict-overflow"
     "-Wno-unused-local-typedefs"
     "-Wno-aggressive-loop-optimizations"
diff --git a/pkgs/development/libraries/v8/5_x.nix b/pkgs/development/libraries/v8/5_x.nix
index 050abe9e81bfc..117623f1887ed 100644
--- a/pkgs/development/libraries/v8/5_x.nix
+++ b/pkgs/development/libraries/v8/5_x.nix
@@ -154,7 +154,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isDarwin xcbuild
     ++ stdenv.lib.optional stdenv.isLinux patchelf;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
     + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=unused-lambda-capture";
 
   buildFlags = [
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index a02e540173d84..e85c655812896 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
 
   # with gcc8, -Wclass-memaccess became part of -Wall and causes logging limit
   # to be exceeded
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-class-memaccess";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-class-memaccess";
 
   nativeBuildInputs = [ gn ninja pkgconfig python ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ xcbuild darwin.DarwinTools ];
diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 625ec2cee3890..c05064c10a9f5 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     sha256 = "03i5wfscv83jb8vnwwhfmm8yfiniwkvk13myzhr1kbwbs9884wdj";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
+  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
 
   # Fixes compilation with clang (on darwin) see https://github.com/ukoethe/vigra/issues/414
   patches =
diff --git a/pkgs/development/libraries/wxwidgets/2.8/default.nix b/pkgs/development/libraries/wxwidgets/2.8/default.nix
index 73dac47307a97..a49fadc593618 100644
--- a/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/pkgs/development/libraries/wxwidgets/2.8/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     + optionalString withMesa "${libGLU.out}/lib ${libGL.out}/lib ";
 
   # Work around a bug in configure.
-  NIX_CFLAGS_COMPILE = "-DHAVE_X11_XLIB_H=1 -lX11 -lcairo -Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-DHAVE_X11_XLIB_H=1 -lX11 -lcairo -Wno-narrowing";
 
   preConfigure = "
     substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
diff --git a/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
index 5236996199d6b..8a3205d35f130 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     ./wx-config --libs
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-undef";
+  env.NIX_CFLAGS_COMPILE = "-Wno-undef";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/xine-lib/default.nix b/pkgs/development/libraries/xine-lib/default.nix
index adcb2e74b0bbd..6c0287ab5a687 100644
--- a/pkgs/development/libraries/xine-lib/default.nix
+++ b/pkgs/development/libraries/xine-lib/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_LDFLAGS = "-lxcb-shm";
+  env.NIX_LDFLAGS = "-lxcb-shm";
 
   propagatedBuildInputs = [zlib];
 
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index a8c751330b7c5..eb0d6bdf9ef24 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--enable-soap" ];
 
   # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-  NIX_LDFLAGS = "-lgcrypt";
+  env.NIX_LDFLAGS = "-lgcrypt";
 
   postInstall = ''
     moveToOutput "bin/xmlsec1-config" "$dev"
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index 3a5b1690f2d02..359a9bfac9bca 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ zeroc_mcpp bzip2 expat openssl lmdb ]
     ++ lib.optionals stdenv.isDarwin [ darwin.cctools libiconv Security ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
 
   prePatch = lib.optional stdenv.isDarwin ''
     substituteInPlace Make.rules.Darwin \
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 71da686ce48f4..b98a00fbad85b 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (rec {
 
   # As zlib takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.hostPlatform.isDarwin) "-static-libgcc";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.hostPlatform.isDarwin) "-static-libgcc";
 
   # We don't strip on static cross-compilation because of reports that native
   # stripping corrupted the target library; see commit 12e960f5 for the report.
diff --git a/pkgs/development/libraries/zookeeper_mt/default.nix b/pkgs/development/libraries/zookeeper_mt/default.nix
index 127ea4f7162bd..5f16d693406a3 100644
--- a/pkgs/development/libraries/zookeeper_mt/default.nix
+++ b/pkgs/development/libraries/zookeeper_mt/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
 
   setSourceRoot = "export sourceRoot=${zookeeper.name}/src/c";
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.isDarwin) "-Wno-error=format-overflow -Wno-error=stringop-truncation";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.isDarwin) "-Wno-error=format-overflow -Wno-error=stringop-truncation";
 
   buildInputs = [ zookeeper bash ];
 
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index fd99a70de3a62..b4f1be6bc7344 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -42,7 +42,7 @@ with super;
     ];
 
     # https://github.com/wahern/cqueues/issues/227
-    NIX_CFLAGS_COMPILE = with pkgs.stdenv; lib.optionalString hostPlatform.isDarwin
+    env.NIX_CFLAGS_COMPILE = with pkgs.stdenv; lib.optionalString hostPlatform.isDarwin
       "-DCLOCK_MONOTONIC -DCLOCK_REALTIME";
 
     disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -288,7 +288,7 @@ with super;
         nativeBuildInputs = [ pkgs.fixDarwinDylibNames ];
 
         # Fixup linking libluv.dylib, for some reason it's not linked against lua correctly.
-        NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
+        env.NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
           (if isLuaJIT then "-lluajit-${lua.luaversion}" else "-llua");
       });
     };
diff --git a/pkgs/development/misc/amdapp-sdk/default.nix b/pkgs/development/misc/amdapp-sdk/default.nix
index a3a4573c0aede..ce0a95c4ec21e 100644
--- a/pkgs/development/misc/amdapp-sdk/default.nix
+++ b/pkgs/development/misc/amdapp-sdk/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   patchFlags = [ "-p0" ];
   buildInputs = [ makeWrapper perl libGLU libGL xorg.libX11 xorg.libXext xorg.libXaw xorg.libXi xorg.libXxf86vm ];
   propagatedBuildInputs = [ stdenv.cc ];
-  NIX_LDFLAGS = "-lX11 -lXext -lXmu -lXi -lXxf86vm";
+  env.NIX_LDFLAGS = "-lX11 -lXext -lXmu -lXi -lXxf86vm";
   doCheck = false;
 
   unpackPhase = ''
diff --git a/pkgs/development/misc/qmk_firmware/default.nix b/pkgs/development/misc/qmk_firmware/default.nix
index 38b1df3ca3b58..1c9c5a972cf04 100644
--- a/pkgs/development/misc/qmk_firmware/default.nix
+++ b/pkgs/development/misc/qmk_firmware/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir $out
   '';
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
   nativeBuildInputs = [
     avrgcc
     avrbinutils
diff --git a/pkgs/development/ocaml-modules/curses/default.nix b/pkgs/development/ocaml-modules/curses/default.nix
index 9bcf4fc411ffc..15cccdb4c221d 100644
--- a/pkgs/development/ocaml-modules/curses/default.nix
+++ b/pkgs/development/ocaml-modules/curses/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ocaml findlib ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index b05aeebf9d4d5..a8eac51f9bcbd 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -29,7 +29,7 @@ if isPyPy then null else buildPythonPackage rec {
   '';
 
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
     "-Wno-unused-command-line-argument -Wno-unreachable-code";
 
   doCheck = !stdenv.hostPlatform.isMusl && !stdenv.isDarwin; # TODO: Investigate
diff --git a/pkgs/development/python-modules/cld2-cffi/default.nix b/pkgs/development/python-modules/cld2-cffi/default.nix
index 7775fee5ba0d9..651801acba1c3 100644
--- a/pkgs/development/python-modules/cld2-cffi/default.nix
+++ b/pkgs/development/python-modules/cld2-cffi/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
 
   # gcc doesn't approve of this code, so disable -Werror
-  NIX_CFLAGS_COMPILE = "-w" + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-w" + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=c++11-narrowing";
 
   checkPhase = "nosetests -v";
 
diff --git a/pkgs/development/python-modules/kiwisolver/default.nix b/pkgs/development/python-modules/kiwisolver/default.nix
index e41c4bbeee055..899bb14d3d441 100644
--- a/pkgs/development/python-modules/kiwisolver/default.nix
+++ b/pkgs/development/python-modules/kiwisolver/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "53eaed412477c836e1b9522c19858a8557d6e595077830146182225613b11a75";
   };
   
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
   
   # Does not include tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/matplotlib/2.nix b/pkgs/development/python-modules/matplotlib/2.nix
index 8ea530489e249..bb340c41fc32e 100644
--- a/pkgs/development/python-modules/matplotlib/2.nix
+++ b/pkgs/development/python-modules/matplotlib/2.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     sha256 = "7355bf757ecacd5f0ac9dd9523c8e1a1103faadf8d33c22664178e17533f8ce5";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
   XDG_RUNTIME_DIR = "/tmp";
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 44d2bf6724702..d7a34cdf79a65 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     sha256 = "8e8e2c2fe3d873108735c6ee9884e6f36f467df4a143136209cff303b183bada";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
   XDG_RUNTIME_DIR = "/tmp";
 
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index f452b7fae7381..a6318d64df18e 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     sha256 = "c2cbaeae60f80805290fff50175028726fae12692404a36babd3326730fbceee";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
   propagatedBuildInputs = [numpy llvmlite] ++ stdenv.lib.optional (!isPy3k) funcsigs ++ stdenv.lib.optional (isPy27 || isPy33) singledispatch;
 
diff --git a/pkgs/development/python-modules/pivy/default.nix b/pkgs/development/python-modules/pivy/default.nix
index f7ec55bba05ef..de130c5dd9924 100644
--- a/pkgs/development/python-modules/pivy/default.nix
+++ b/pkgs/development/python-modules/pivy/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     libXi libXext libSM libICE libX11
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${pkgs.qt5.qtbase.dev}/include/QtCore"
     "-I${pkgs.qt5.qtbase.dev}/include/QtGui"
     "-I${pkgs.qt5.qtbase.dev}/include/QtOpenGL"
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index e414dff8aa172..f28aef130604a 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -9,7 +9,7 @@ buildPythonPackage {
   inherit disabled;
   doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
 
-  NIX_CFLAGS_COMPILE = toString (
+  env.NIX_CFLAGS_COMPILE = toString (
     # work around python distutils compiling C++ with $CC
     optional stdenv.isDarwin "-I${libcxx}/include/c++/v1"
     ++ optional (versionOlder protobuf.version "2.7.0") "-std=c++98"
diff --git a/pkgs/development/python-modules/py3exiv2/default.nix b/pkgs/development/python-modules/py3exiv2/default.nix
index fe0827c4f8f63..dd30fb3d5640e 100644
--- a/pkgs/development/python-modules/py3exiv2/default.nix
+++ b/pkgs/development/python-modules/py3exiv2/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   buildInputs = [ exiv2 boost ];
 
   # work around python distutils compiling C++ with $CC (see issue #26709)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
   # fix broken libboost_python3 detection
   patches = [
diff --git a/pkgs/development/python-modules/pyezminc/default.nix b/pkgs/development/python-modules/pyezminc/default.nix
index 614a1555cbeff..6c80016df7681 100644
--- a/pkgs/development/python-modules/pyezminc/default.nix
+++ b/pkgs/development/python-modules/pyezminc/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   buildInputs = [ netcdf hdf5 libminc ezminc ];
   propagatedBuildInputs = [ numpy scipy ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   doCheck = false;  # e.g., expects test data in /opt
 
diff --git a/pkgs/development/python-modules/pygtk/default.nix b/pkgs/development/python-modules/pygtk/default.nix
index 4779f76aed462..f8c6ac21bb93f 100644
--- a/pkgs/development/python-modules/pygtk/default.nix
+++ b/pkgs/development/python-modules/pygtk/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   buildPhase = "buildPhase";
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-ObjC";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-ObjC";
 
   installPhase = "installPhase";
 
diff --git a/pkgs/development/python-modules/pypoppler/default.nix b/pkgs/development/python-modules/pypoppler/default.nix
index ccda4f2631d20..ef90b8836ca31 100644
--- a/pkgs/development/python-modules/pypoppler/default.nix
+++ b/pkgs/development/python-modules/pypoppler/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     sha256 = "47e6ac99e5b114b9abf2d1dd1bca06f22c028d025432512989f659142470810f";
   };
 
-  NIX_CFLAGS_COMPILE="-I${pkgs.poppler.dev}/include/poppler/";
+  env.NIX_CFLAGS_COMPILE="-I${pkgs.poppler.dev}/include/poppler/";
   nativeBuildInputs = [ pkgs.pkgconfig ];
   buildInputs = [ pkgs.poppler.dev ];
   propagatedBuildInputs = [ pycairo pygobject2 ];
diff --git a/pkgs/development/python-modules/pyscard/default.nix b/pkgs/development/python-modules/pyscard/default.nix
index ddd8b0ce29545..8fda7c1ff43ec 100644
--- a/pkgs/development/python-modules/pyscard/default.nix
+++ b/pkgs/development/python-modules/pyscard/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
                 "${getLib pcsclite}/lib/libpcsclite${sharedLibrary}"
   '';
 
-  NIX_CFLAGS_COMPILE = optionalString (! withApplePCSC)
+  env.NIX_CFLAGS_COMPILE = optionalString (! withApplePCSC)
     "-I ${getDev pcsclite}/include/PCSC";
 
   propagatedBuildInputs = if withApplePCSC then [ PCSC ] else [ pcsclite ];
diff --git a/pkgs/development/python-modules/pysvn/default.nix b/pkgs/development/python-modules/pysvn/default.nix
index c1c765f1adc99..0e4858cc70dcd 100644
--- a/pkgs/development/python-modules/pysvn/default.nix
+++ b/pkgs/development/python-modules/pysvn/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     ++ (if stdenv.isLinux then [pkgs.e2fsprogs] else []);
 
   # There seems to be no way to pass that path to configure.
-  NIX_CFLAGS_COMPILE="-I${pkgs.aprutil.dev}/include/apr-1";
+  env.NIX_CFLAGS_COMPILE="-I${pkgs.aprutil.dev}/include/apr-1";
 
   preConfigure = ''
     cd Source
diff --git a/pkgs/development/python-modules/python-jose/default.nix b/pkgs/development/python-modules/python-jose/default.nix
index a9377c4a1c213..a509755a12ba9 100644
--- a/pkgs/development/python-modules/python-jose/default.nix
+++ b/pkgs/development/python-modules/python-jose/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   '';
 
   # https://github.com/mpdavis/python-jose/issues/149
-  PYTEST_ADDOPTS = "-k 'not test_invalid_claims_json and not test_invalid_claims'";
+  env.PYTEST_ADDOPTS = "-k 'not test_invalid_claims_json and not test_invalid_claims'";
 
   propagatedBuildInputs = [ future six ecdsa rsa ];
 
diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index 8f6c7c54cb2e6..5b4003c04510e 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_LINK = "-ludev";
+  env.NIX_CFLAGS_LINK = "-ludev";
 
   meta = with stdenv.lib; {
     description = "Pythonic API to Linux uinput kernel module";
diff --git a/pkgs/development/python-modules/pytorch/default.nix b/pkgs/development/python-modules/pytorch/default.nix
index d55be70ae490b..ca2d5b1b3a74b 100644
--- a/pkgs/development/python-modules/pytorch/default.nix
+++ b/pkgs/development/python-modules/pytorch/default.nix
@@ -165,7 +165,7 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.2.0/setup.py#L17
-  NIX_CFLAGS_COMPILE = lib.optionals (numpy.blas == mkl) [ "-Wno-error=array-bounds" ];
+  env.NIX_CFLAGS_COMPILE = lib.optionals (numpy.blas == mkl) [ "-Wno-error=array-bounds" ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/roboschool/default.nix b/pkgs/development/python-modules/roboschool/default.nix
index a86e17e921b68..d73afadd752ff 100644
--- a/pkgs/development/python-modules/roboschool/default.nix
+++ b/pkgs/development/python-modules/roboschool/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     boost
   ];
 
-  NIX_CFLAGS_COMPILE="-I ${python}/include/${python.libPrefix}";
+  env.NIX_CFLAGS_COMPILE="-I ${python}/include/${python.libPrefix}";
 
   patches = [
     # Remove kwarg that was removed in upstream gym
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 34282a5ec9373..6687d0d03c1b9 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -266,7 +266,7 @@ let
     '';
 
     # FIXME: Tensorflow uses dlopen() for CUDA libraries.
-    NIX_LDFLAGS = lib.optionalString cudaSupport "-lcudart -lcublas -lcufft -lcurand -lcusolver -lcusparse -lcudnn";
+    env.NIX_LDFLAGS = lib.optionalString cudaSupport "-lcudart -lcublas -lcufft -lcurand -lcusolver -lcusparse -lcudnn";
 
     hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/r-modules/generic-builder.nix b/pkgs/development/r-modules/generic-builder.nix
index 76bf29abc17c6..86b097b335dfa 100644
--- a/pkgs/development/r-modules/generic-builder.nix
+++ b/pkgs/development/r-modules/generic-builder.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation ({
                 stdenv.lib.optionals requireX [utillinux xvfb_run] ++
                 stdenv.lib.optionals stdenv.isDarwin [Cocoa Foundation gfortran];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
   configurePhase = ''
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index c1eb82c5fa807..fc95a7aa6157d 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -120,7 +120,7 @@ in
   };
 
   dep-selector-libgecode = attrs: {
-    USE_SYSTEM_GECODE = true;
+    env.USE_SYSTEM_GECODE = true;
     postInstall = ''
       installPath=$(cat $out/nix-support/gem-meta/install-path)
       sed -i $installPath/lib/dep-selector-libgecode.rb -e 's@VENDORED_GECODE_DIR =.*@VENDORED_GECODE_DIR = "${gecode_3}"@'
@@ -236,7 +236,7 @@ in
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ openssl ];
     hardeningDisable = [ "format" ];
-    NIX_CFLAGS_COMPILE = toString [
+    env.NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=stringop-overflow"
       "-Wno-error=implicit-fallthrough"
       "-Wno-error=sizeof-pointer-memaccess"
@@ -496,7 +496,7 @@ in
   sassc = attrs: {
     nativeBuildInputs = [ rake ];
     dontBuild = false;
-    SASS_LIBSASS_PATH = toString libsass;
+    env.SASS_LIBSASS_PATH = toString libsass;
     postPatch = ''
       substituteInPlace lib/sassc/native.rb \
         --replace 'gem_root = spec.gem_dir' 'gem_root = File.join(__dir__, "../../")'
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index a8d95eb05deb2..f7661694d966d 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   ];
 
   # we turn on additional warnings due to hardening
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index 0ec4b1510e915..4f16c1f18c40d 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -16,7 +16,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake qttools ];
 
-  NIX_LDFLAGS = "-lQt5PrintSupport";
+  env.NIX_LDFLAGS = "-lQt5PrintSupport";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index 0fdd026d875f6..12fec5f807321 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -65,7 +65,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
+  env.NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index af73ce25d422b..aa007f91bc1ad 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ] ++
     stdenv.lib.optional (qt4 != null) "-Dbuild_wizard=YES";
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 82365d986b8a3..debcfdae11d95 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
 
   # As binutils takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.isDarwin
+  env.NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.isDarwin
     then "-Wno-string-plus-int -Wno-deprecated-declarations"
     else "-static-libgcc";
 
diff --git a/pkgs/development/tools/misc/bossa/default.nix b/pkgs/development/tools/misc/bossa/default.nix
index 6548e9643971a..f5406647cbabb 100644
--- a/pkgs/development/tools/misc/bossa/default.nix
+++ b/pkgs/development/tools/misc/bossa/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   # Explicitly specify targets so they don't get stripped.
   makeFlags = [ "bin/bossac" "bin/bossash" "bin/bossa" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index e125b7418f6b5..31555b3d6e4ff 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   # darwin build fails with format hardening since v7.12
   hardeningDisable = stdenv.lib.optionals stdenv.isDarwin [ "format" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
   # TODO(@Ericson2314): Always pass "--target" and always prefix.
   configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 3e5c12e183aa9..e3bdbbfc0d388 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -102,7 +102,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-docbook-xsl=${docbook_xsl}/xml/xsl/docbook" ];
 
-  NIX_CFLAGS_COMPILE = "-pthread";
+  env.NIX_CFLAGS_COMPILE = "-pthread";
 
   shellHook = ''
     PATH=$(pwd)/src/script:$(pwd)/src/hydra-eval-jobs:$(pwd)/src/hydra-queue-runner:$(pwd)/src/hydra-evaluator:$PATH
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index c4b5fecca7411..d32689c5939c6 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ texinfo ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
     "-Wno-implicit-function-declaration";
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/tools/misc/kconfig-frontends/default.nix b/pkgs/development/tools/misc/kconfig-frontends/default.nix
index e33259b416fa6..c61c52b9e9263 100644
--- a/pkgs/development/tools/misc/kconfig-frontends/default.nix
+++ b/pkgs/development/tools/misc/kconfig-frontends/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     wrapPythonPrograms
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with stdenv.lib; {
     description = "Out of Linux tree packaging of the kconfig infrastructure";
diff --git a/pkgs/development/tools/misc/openocd/default.nix b/pkgs/development/tools/misc/openocd/default.nix
index 7e1412709041b..1015b6fc5e627 100644
--- a/pkgs/development/tools/misc/openocd/default.nix
+++ b/pkgs/development/tools/misc/openocd/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     "--enable-remote-bitbang"
   ];
 
-  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     "-Wno-implicit-fallthrough"
     "-Wno-format-truncation"
     "-Wno-format-overflow"
diff --git a/pkgs/development/tools/misc/tcptrack/default.nix b/pkgs/development/tools/misc/tcptrack/default.nix
index 9872c91ac4ba2..6893438c729cd 100644
--- a/pkgs/development/tools/misc/tcptrack/default.nix
+++ b/pkgs/development/tools/misc/tcptrack/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses libpcap ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/tools/misc/uisp/default.nix b/pkgs/development/tools/misc/uisp/default.nix
index 1727f772006e4..af483ecdb33bd 100644
--- a/pkgs/development/tools/misc/uisp/default.nix
+++ b/pkgs/development/tools/misc/uisp/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1bncxp5yxh9r1yrp04vvhfiva8livi1pwic7v8xj99q09zrwahvw";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = {
     description = "Tool for AVR microcontrollers which can interface to many hardware in-system programmers";
diff --git a/pkgs/development/tools/misc/xxdiff/default.nix b/pkgs/development/tools/misc/xxdiff/default.nix
index c187ad42c0e98..42665a00b1478 100644
--- a/pkgs/development/tools/misc/xxdiff/default.nix
+++ b/pkgs/development/tools/misc/xxdiff/default.nix
@@ -20,7 +20,7 @@ mkDerivation rec {
   dontUseQmakeConfigure = true;
 
   # c++11 and above is needed for building with Qt 5.9+
-  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+  env.NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
 
   sourceRoot = "source/src";
 
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index d8dab6b035878..99cbdc4d10257 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  NIX_LDFLAGS = "-lpcre";
+  env.NIX_LDFLAGS = "-lpcre";
 
   buildPhase = ''
     HOME=$TMPDIR
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index 213c926521fea..a87bb00980072 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -40,9 +40,9 @@ mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
+  env.NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
 
-  NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
+  env.NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
 
   qtWrapperArgs = [
     ''--prefix PATH : ${lib.getBin graphviz}/bin''
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index 8090aca5ff303..e2840ea9b912f 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation {
     rmdir $out/usr
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = [ "-GNinja" ];
 
diff --git a/pkgs/development/web/kore/default.nix b/pkgs/development/web/kore/default.nix
index a59db6d4d1ae1..61c339706eccd 100644
--- a/pkgs/development/web/kore/default.nix
+++ b/pkgs/development/web/kore/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   # added to fix build w/gcc7 and clang5
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=pointer-compare"
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=pointer-compare"
     + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=unknown-warning-option";
 
   enableParallelBuilding = true;
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index 42464f71ae33d..e0735e617bed4 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     nvidia-texture-tools libsodium
   ] ++ lib.optional withEditor wxGTK;
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${xorgproto}/include/X11"
     "-I${libX11.dev}/include/X11"
     "-I${libXcursor.dev}/include/X11"
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index 408f2817854a3..aa0a361cc5f9b 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ makeWrapper SDL SDL_image ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   installPhase = ''
     ls -l
diff --git a/pkgs/games/armagetronad/default.nix b/pkgs/games/armagetronad/default.nix
index 57373d39b54cd..8f1e689825f8f 100644
--- a/pkgs/games/armagetronad/default.nix
+++ b/pkgs/games/armagetronad/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     sha256 = "157pp84wf0q3bdb72rnbm3ck0czwx2ply6lyhj8z7kfdc7csdbr3";
   };
 
-  NIX_LDFLAGS = "-lSDL_image";
+  env.NIX_LDFLAGS = "-lSDL_image";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/asc/default.nix b/pkgs/games/asc/default.nix
index c8f5deef92406..5e41316697bb5 100644
--- a/pkgs/games/asc/default.nix
+++ b/pkgs/games/asc/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-paragui" "--disable-paraguitest" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"; # I'm too lazy to catch all gcc47-related problems
+  env.NIX_CFLAGS_COMPILE = "-fpermissive"; # I'm too lazy to catch all gcc47-related problems
   hardeningDisable = [ "format" ];
 
   buildInputs = [
diff --git a/pkgs/games/beret/default.nix b/pkgs/games/beret/default.nix
index 81bdbed46e94f..e12f42f3167a8 100644
--- a/pkgs/games/beret/default.nix
+++ b/pkgs/games/beret/default.nix
@@ -5,9 +5,9 @@ stdenv.mkDerivation {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_mixer ];
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
-  NIX_CFLAGS_LINK = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_LINK = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin
     "-framework CoreFoundation -framework OpenGL -framework Cocoa";
 
   patches = [ ./use-home-dir.patch ];
diff --git a/pkgs/games/bitsnbots/default.nix b/pkgs/games/bitsnbots/default.nix
index c6c5176ecdf8b..76e452bad8adf 100644
--- a/pkgs/games/bitsnbots/default.nix
+++ b/pkgs/games/bitsnbots/default.nix
@@ -14,9 +14,9 @@ stdenv.mkDerivation rec {
 
   makefile = "Makefile.linux";
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
-  NIX_LDFLAGS = "-lGL";
+  env.NIX_LDFLAGS = "-lGL";
 
   installPhase = ''
     mkdir -p $out/share/${name}
diff --git a/pkgs/games/blackshades/default.nix b/pkgs/games/blackshades/default.nix
index 608b32764bb95..89d39b605c76a 100644
--- a/pkgs/games/blackshades/default.nix
+++ b/pkgs/games/blackshades/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "0kbrh1dympk8scjxr6av24qs2bffz44l8qmw2m5gyqf4g3rxf6ra";
   };
 
-  NIX_LDFLAGS = "-lSDL_image";
+  env.NIX_LDFLAGS = "-lSDL_image";
 
   buildInputs = [ SDL SDL_image libGLU libGL openal libvorbis freealut ];
 
diff --git a/pkgs/games/btanks/default.nix b/pkgs/games/btanks/default.nix
index 5bb7cfa215bcf..b48040fffd079 100644
--- a/pkgs/games/btanks/default.nix
+++ b/pkgs/games/btanks/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL_image}/include/SDL";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/games/devilutionx/default.nix b/pkgs/games/devilutionx/default.nix
index ac7d61b31c743..a524b9db26835 100644
--- a/pkgs/games/devilutionx/default.nix
+++ b/pkgs/games/devilutionx/default.nix
@@ -10,10 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0lx903gchda4bgr71469yn63rx5ya6xv9j1azx18nrv3sskrphn4";
   };
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2_ttf}/include/SDL2"
-    ''-DTTF_FONT_PATH="${placeholder "out"}/share/fonts/truetype/CharisSILB.ttf"''
-  ];
+  env.NIX_CFLAGS_COMPILE = ''-I${SDL2_ttf}/include/SDL2 -DTTF_FONT_PATH="${placeholder "out"}/share/fonts/truetype/CharisSILB.ttf"'';
 
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [ libsodium SDL2 SDL2_mixer SDL2_ttf ];
diff --git a/pkgs/games/dxx-rebirth/default.nix b/pkgs/games/dxx-rebirth/default.nix
index b7eb2f02568dd..a09ac5d0a3da0 100644
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/games/dxx-rebirth/default.nix
@@ -37,7 +37,7 @@ in gcc6Stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
+  env.NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";
 
   postInstall = ''
     install -Dm644 ${music} $out/share/games/dxx-rebirth/d2xr-sc55-music.dxa
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index af6bc4be39361..ae997f976b866 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation {
     patchShebangs ./configure
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
-  NIX_LDFLAGS = "-ldl";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = http://www.bergo.eng.br/eboard/;
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 242e0930db3be..0de2cd025285e 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index c8a5f380900a0..56afa06c5f037 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     '';
   */
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "3D dungeon crawling adventure";
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index 07f84d7a151af..01a873d0bc883 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   postInstall =
     ''
diff --git a/pkgs/games/globulation/default.nix b/pkgs/games/globulation/default.nix
index 45c5013705f3f..fae87423b18af 100644
--- a/pkgs/games/globulation/default.nix
+++ b/pkgs/games/globulation/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     sconsFlags+=" DATADIR=$out/share/globulation2/glob2"
   '';
 
-  NIX_LDFLAGS = "-lboost_system";
+  env.NIX_LDFLAGS = "-lboost_system";
 
   meta = with stdenv.lib; {
     description = "RTS without micromanagement";
diff --git a/pkgs/games/gnujump/default.nix b/pkgs/games/gnujump/default.nix
index af2e924960a1e..3af72a0b3464d 100644
--- a/pkgs/games/gnujump/default.nix
+++ b/pkgs/games/gnujump/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
   buildInputs = [ SDL SDL_image SDL_mixer ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = https://jump.gnu.sinusoid.es/index.php?title=Main_Page;
diff --git a/pkgs/games/gzdoom/default.nix b/pkgs/games/gzdoom/default.nix
index 5cafe045fa6aa..1111ef6f1e751 100644
--- a/pkgs/games/gzdoom/default.nix
+++ b/pkgs/games/gzdoom/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
+  env.NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
 
   preConfigure = ''
     sed -i \
diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix
index dffeb2ac556d7..951b159dd7b5f 100644
--- a/pkgs/games/hedgewars/default.nix
+++ b/pkgs/games/hedgewars/default.nix
@@ -40,7 +40,7 @@ mkDerivation rec {
     "-DNOSERVER=${if withServer then "OFF" else "ON"}"
   ];
 
-  NIX_LDFLAGS = lib.concatMapStringsSep " " (e: "-rpath ${e}/lib") [
+  env.NIX_LDFLAGS = lib.concatMapStringsSep " " (e: "-rpath ${e}/lib") [
     SDL2.out
     SDL2_image
     SDL2_mixer
diff --git a/pkgs/games/instead/default.nix b/pkgs/games/instead/default.nix
index fff15b5c5b0c1..429ed039d8ea0 100644
--- a/pkgs/games/instead/default.nix
+++ b/pkgs/games/instead/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     sha256 = "10bppcdjnd0all71l5akdvy7fx0c8s8x0za9qxszs8cjmlv9z1q0";
   };
 
-  NIX_LDFLAGS = "-llua -lgcc_s";
+  env.NIX_LDFLAGS = "-llua -lgcc_s";
 
   nativeBuildInputs = [ pkgconfig unzip ];
   buildInputs = [ SDL2 SDL2_ttf SDL2_image SDL2_mixer lua zlib ];
diff --git a/pkgs/games/ivan/default.nix b/pkgs/games/ivan/default.nix
index 0a7474e0f51fa..2c3503de3d297 100644
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = ["-DCMAKE_CXX_FLAGS=-DWIZARD"];
 
   # Help CMake find SDL_mixer.h
-  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
 
   meta = with stdenv.lib; {
     description = "Graphical roguelike game";
diff --git a/pkgs/games/liquidwar/5.nix b/pkgs/games/liquidwar/5.nix
index 5c42b8ecaab27..d9eddf4479971 100644
--- a/pkgs/games/liquidwar/5.nix
+++ b/pkgs/games/liquidwar/5.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE = [ "-lm" ];
+  env.NIX_CFLAGS_COMPILE = [ "-lm" ];
 
   meta = with stdenv.lib; {
     description = ''The classic version of a quick tactics game LiquidWar'';
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index 800ac0fc4c7a7..6fd87175c2235 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_CFLAGS_COMPILE =
+  env.NIX_CFLAGS_COMPILE =
     "-Wno-error=deprecated-declarations" +
     # Avoid GL_GLEXT_VERSION double definition
     " -DNO_SDL_GLEXT"
diff --git a/pkgs/games/macopix/default.nix b/pkgs/games/macopix/default.nix
index 7879b68c857db..550d93494874b 100644
--- a/pkgs/games/macopix/default.nix
+++ b/pkgs/games/macopix/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = "Mascot Constructive Pilot for X";
diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
index f286c359e6fc4..c896ac0c2665d 100644
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@@ -40,7 +40,7 @@ let
       "-DOpenGL_GL_PREFERENCE=GLVND"
     ];
 
-    NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+    env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
     nativeBuildInputs = [ cmake doxygen graphviz ];
 
diff --git a/pkgs/games/naev/default.nix b/pkgs/games/naev/default.nix
index a1b525ff093b9..486b4657a5dec 100644
--- a/pkgs/games/naev/default.nix
+++ b/pkgs/games/naev/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
-  NIX_CFLAGS_COMPILE="-include ${zlib.dev}/include/zlib.h";
+  env.NIX_CFLAGS_COMPILE="-include ${zlib.dev}/include/zlib.h";
 
   postInstall = ''
     mkdir -p $out/share/naev
diff --git a/pkgs/games/nexuiz/default.nix b/pkgs/games/nexuiz/default.nix
index 9f8d228e71677..6e74ecd8006d7 100644
--- a/pkgs/games/nexuiz/default.nix
+++ b/pkgs/games/nexuiz/default.nix
@@ -36,7 +36,7 @@ in stdenv.mkDerivation {
     cd ../../
   '';
 
-  NIX_LDFLAGS = ''
+  env.NIX_LDFLAGS = ''
     -rpath ${zlib.out}/lib
     -rpath ${curl.out}/lib
     -rpath ${libjpeg.out}/lib
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index 2ad23a72368b5..2d1049eabfc9f 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--no-werror" ];
 
   # Without this libvorbisfile.so is not getting linked properly for some reason.
-  NIX_CFLAGS_LINK = "-lvorbisfile";
+  env.NIX_CFLAGS_LINK = "-lvorbisfile";
 
   preBuild = ''
     sed -i 's/.dll//g' Makefile
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index f6841abb1d07a..b7823e14e4019 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake ogre cegui boost sfml openal ois ];
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = with stdenv.lib; {
     description = "An open source, real time strategy game sharing game elements with the Dungeon Keeper series and Evil Genius.";
diff --git a/pkgs/games/openlierox/default.nix b/pkgs/games/openlierox/default.nix
index 4b1385f3e10d1..aad50127b9acc 100644
--- a/pkgs/games/openlierox/default.nix
+++ b/pkgs/games/openlierox/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "1k35xppfqi3qfysv81xq3hj4qdy9j2ciinbkfdcmwclcsf3nh94z";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -std=c++98 -Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -std=c++98 -Wno-error";
 
   # The breakpad fails to build on x86_64, and it's only to report bugs upstream
   cmakeFlags = [ "-DBREAKPAD=0" ];
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index b00524461a493..1d2e05d90aafe 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = "-lopenal";
+  env.NIX_CFLAGS_LINK = "-lopenal";
 
   meta = with stdenv.lib; {
     description = "A compatible client of Ace of Spades 0.75";
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index 2e4ce270b8281..5059a00a043a7 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     "pokerth.pro"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/rogue/default.nix b/pkgs/games/rogue/default.nix
index 1e27d67eb03e5..019e76fceb3cc 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/games/rogue/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   buildInputs = [ ncurses ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   meta = with stdenv.lib; {
     homepage = http://rogue.rogueforge.net/rogue-5-4/;
diff --git a/pkgs/games/scorched3d/default.nix b/pkgs/games/scorched3d/default.nix
index c86df396ff159..78aa42e7a2198 100644
--- a/pkgs/games/scorched3d/default.nix
+++ b/pkgs/games/scorched3d/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-fftw=${fftwSinglePrec.dev}" ];
 
-  NIX_LDFLAGS = "-lopenal";
+  env.NIX_LDFLAGS = "-lopenal";
 
   meta = with stdenv.lib; {
     homepage = http://scorched3d.co.uk/;
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 8f43a6d84b1ae..36057189d6c6e 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"; # GL header minor incompatibility
+  env.NIX_CFLAGS_COMPILE = "-fpermissive"; # GL header minor incompatibility
 
   postInstall = ''
     wrapProgram "$out/bin/spring" \
diff --git a/pkgs/games/stuntrally/default.nix b/pkgs/games/stuntrally/default.nix
index 6b3da08b70c7f..8161360d156e7 100644
--- a/pkgs/games/stuntrally/default.nix
+++ b/pkgs/games/stuntrally/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   # include/OGRE/OgreException.h:265:126: error: invalid conversion from
   # 'int' to 'Ogre::Exception::ExceptionCodes' [-fpermissive]
-  NIX_CFLAGS_COMPILE="-fpermissive";
+  env.NIX_CFLAGS_COMPILE="-fpermissive";
 
   preConfigure = ''
     pushd data
diff --git a/pkgs/games/tdm/default.nix b/pkgs/games/tdm/default.nix
index 949f5a3e2ab94..9668510d1bdcf 100644
--- a/pkgs/games/tdm/default.nix
+++ b/pkgs/games/tdm/default.nix
@@ -91,7 +91,7 @@ EOF
 
   enableParallelBuilding = true;
   sconsFlags = [ "BUILD=release" "TARGET_ARCH=x64" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   meta = with stdenv.lib; {
     description = "The Dark Mod - stealth FPS inspired by the Thief series";
     homepage = "http://www.thedarkmod.com";
diff --git a/pkgs/games/tome4/default.nix b/pkgs/games/tome4/default.nix
index b31b53922ffee..ade363b47c070 100644
--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
   # disable parallel building as it caused sporadic build failures
   enableParallelBuilding = false;
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
 
   makeFlags = [ "config=release" ];
 
diff --git a/pkgs/games/tremulous/default.nix b/pkgs/games/tremulous/default.nix
index 7ea83f80fefa5..1f4919e2c0714 100644
--- a/pkgs/games/tremulous/default.nix
+++ b/pkgs/games/tremulous/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
   patches = [ ./parse.patch ];
   patchFlags = [ "-p" "0" ];
-  NIX_LD_FLAGS = ''
+  env.NIX_LD_FLAGS = ''
     -rpath ${stdenv.cc}/lib
     -rpath ${stdenv.cc}/lib64
   '';
diff --git a/pkgs/games/ufoai/default.nix b/pkgs/games/ufoai/default.nix
index beff8ada96b40..1ba29f35f789f 100644
--- a/pkgs/games/ufoai/default.nix
+++ b/pkgs/games/ufoai/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     curl libjpeg libpng gettext cunit
   ];
 
-  NIX_CFLAGS_LINK = "-lgcc_s"; # to avoid occasional runtime error in finding libgcc_s.so.1
+  env.NIX_CFLAGS_LINK = "-lgcc_s"; # to avoid occasional runtime error in finding libgcc_s.so.1
 
   meta = {
     homepage = http://ufoai.org;
diff --git a/pkgs/games/xbill/default.nix b/pkgs/games/xbill/default.nix
index 8a6d4cf14cdce..0d7e63749986d 100644
--- a/pkgs/games/xbill/default.nix
+++ b/pkgs/games/xbill/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 libXpm libXt motif ];
 
-  NIX_CFLAGS_LINK = "-lXpm";
+  env.NIX_CFLAGS_LINK = "-lXpm";
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/games/xpilot/bloodspilot-client.nix b/pkgs/games/xpilot/bloodspilot-client.nix
index 4a1c25ee12e0c..ef4ae3a08aeea 100644
--- a/pkgs/games/xpilot/bloodspilot-client.nix
+++ b/pkgs/games/xpilot/bloodspilot-client.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     libX11 SDL SDL_ttf SDL_image libGLU libGL expat zlib
   ];
 
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = ''A multiplayer space combat game (client part)'';
diff --git a/pkgs/games/xsok/default.nix b/pkgs/games/xsok/default.nix
index 62cdaccc29750..768b89fbce6c8 100644
--- a/pkgs/games/xsok/default.nix
+++ b/pkgs/games/xsok/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libX11 libXt libXaw libXpm libXext];
   nativeBuildInputs = [imake];
 
-  NIX_CFLAGS_COMPILE=" -isystem ${libXpm.dev}/include/X11 ";
+  env.NIX_CFLAGS_COMPILE=" -isystem ${libXpm.dev}/include/X11 ";
 
   preConfigure = ''
     sed -e "s@/usr/@$out/share/@g" -i src/Imakefile
diff --git a/pkgs/games/xsokoban/default.nix b/pkgs/games/xsokoban/default.nix
index 3f6062c4f6862..ca0e633623b58 100644
--- a/pkgs/games/xsokoban/default.nix
+++ b/pkgs/games/xsokoban/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 xorgproto libXpm libXt ];
 
-  NIX_CFLAGS_COMPILE = "-I${libXpm.dev}/include/X11";
+  env.NIX_CFLAGS_COMPILE = "-I${libXpm.dev}/include/X11";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/games/zaz/default.nix b/pkgs/games/zaz/default.nix
index 9d42cfd6896dc..88fbde0dceb93 100644
--- a/pkgs/games/zaz/default.nix
+++ b/pkgs/games/zaz/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Fix SDL include problems
-  NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_image}/include/SDL";
   # Fix linking errors
   makeFlags = [
     "ZAZ_LIBS+=-lSDL"
diff --git a/pkgs/games/zdoom/default.nix b/pkgs/games/zdoom/default.nix
index f6fde241129b1..14f357a743d21 100644
--- a/pkgs/games/zdoom/default.nix
+++ b/pkgs/games/zdoom/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = [ "-lopenal" "-lfluidsynth" ];
+  env.NIX_CFLAGS_LINK = [ "-lopenal" "-lfluidsynth" ];
 
   preConfigure = ''
     sed -i \
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index 888b7bd3d6aab..d478d754785b4 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ unrar unzip SDL SDL_image SDL_ttf SDL_mixer libmysqlclient makeWrapper ];
 
-  NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
+  env.NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
 
   installPhase = ''
     mkdir -p $out/bin $out/share/zod
diff --git a/pkgs/games/zoom/default.nix b/pkgs/games/zoom/default.nix
index 827fb351f1de2..3973711324de7 100644
--- a/pkgs/games/zoom/default.nix
+++ b/pkgs/games/zoom/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ perl expat xlibsWrapper freetype ];
 
-  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
+  env.NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
 
   meta = with stdenv.lib; {
     description = "Player for Z-Code, TADS and HUGO stories or games";
diff --git a/pkgs/misc/cups/drivers/cups-bjnp/default.nix b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
index 0c91b782117dd..4b5f71436f9ff 100644
--- a/pkgs/misc/cups/drivers/cups-bjnp/default.nix
+++ b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''configureFlags="--with-cupsbackenddir=$out/lib/cups/backend"'';
 
   buildInputs = [cups];
-  NIX_CFLAGS_COMPILE = [ "-include stdio.h" "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-include stdio.h -Wno-error=stringop-truncation";
 
   meta = {
     description = "CUPS back-end for Canon printers";
diff --git a/pkgs/misc/drivers/utsushi/default.nix b/pkgs/misc/drivers/utsushi/default.nix
index ad7659d060a36..565b6a9c1daf9 100644
--- a/pkgs/misc/drivers/utsushi/default.nix
+++ b/pkgs/misc/drivers/utsushi/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     libusb.dev
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=parentheses -Wno-error=unused-variable";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=parentheses -Wno-error=unused-variable";
 
   postPatch = ''
     # remove vendored dependencies
diff --git a/pkgs/misc/emulators/fakenes/default.nix b/pkgs/misc/emulators/fakenes/default.nix
index 704cef52e5e44..bddcb1db63ae1 100644
--- a/pkgs/misc/emulators/fakenes/default.nix
+++ b/pkgs/misc/emulators/fakenes/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     cp fakenes $out/bin
   '';
 
-  NIX_LDFLAGS = "-lX11 -lXxf86vm -lXcursor -lXpm";
+  env.NIX_LDFLAGS = "-lX11 -lXxf86vm -lXcursor -lXpm";
 
   patches = [ ./build.patch ];
 
diff --git a/pkgs/misc/emulators/gens-gs/default.nix b/pkgs/misc/emulators/gens-gs/default.nix
index 4120ec7ba6aa1..5212b41e0e19f 100644
--- a/pkgs/misc/emulators/gens-gs/default.nix
+++ b/pkgs/misc/emulators/gens-gs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   # Work around build failures on recent GTK.
   # See http://ubuntuforums.org/showthread.php?p=10535837
-  NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
+  env.NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
 
   meta = with stdenv.lib; {
     homepage = https://segaretro.org/Gens/GS;
diff --git a/pkgs/misc/emulators/mame/default.nix b/pkgs/misc/emulators/mame/default.nix
index 3c205a703759a..31d0ae3dbaecc 100644
--- a/pkgs/misc/emulators/mame/default.nix
+++ b/pkgs/misc/emulators/mame/default.nix
@@ -27,7 +27,7 @@ in mkDerivation {
   };
 
   hardeningDisable = [ "fortify" ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=maybe-uninitialized" ];
+  env.NIX_CFLAGS_COMPILE = [ "-Wno-error=maybe-uninitialized" ];
 
   makeFlags = [ "TOOLS=1" ];
 
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index 0b6eab70263f8..42d0b6b6ac901 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   # Wine locates a lot of libraries dynamically through dlopen().  Add
   # them to the RPATH so that the user doesn't have to set them in
   # LD_LIBRARY_PATH.
-  NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
+  env.NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
       map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ buildInputs)
       # libpulsecommon.so is linked but not found otherwise
       ++ lib.optionals supportFlags.pulseaudioSupport (map (x: "${lib.getLib x}/lib/pulseaudio")
diff --git a/pkgs/misc/emulators/wxmupen64plus/default.nix b/pkgs/misc/emulators/wxmupen64plus/default.nix
index 2416ddd65b7ae..685718d8e1559 100644
--- a/pkgs/misc/emulators/wxmupen64plus/default.nix
+++ b/pkgs/misc/emulators/wxmupen64plus/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     wafConfigureFlagsArray+=("--mupenapi=$APIDIR" "--wxconfig=`type -P wx-config`")
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     description = "GUI for the Mupen64Plus 2.0 emulator";
diff --git a/pkgs/misc/screensavers/rss-glx/default.nix b/pkgs/misc/screensavers/rss-glx/default.nix
index 467f762de86ca..edc07972f68f4 100644
--- a/pkgs/misc/screensavers/rss-glx/default.nix
+++ b/pkgs/misc/screensavers/rss-glx/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libGLU libGL xlibsWrapper imagemagick libtiff bzip2 ];
 
-  NIX_CFLAGS_COMPILE = "-I${imagemagick.dev}/include/ImageMagick";
-  NIX_LDFLAGS= "-rpath ${libXext}/lib";
+  env.NIX_CFLAGS_COMPILE = "-I${imagemagick.dev}/include/ImageMagick";
+  env.NIX_LDFLAGS= "-rpath ${libXext}/lib";
 
   meta = {
     description = "Really Slick Screensavers Port to GLX";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index 6d3bd103811d8..8aae973a03c05 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -5,8 +5,8 @@ appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ libutil ];
 
-  NIX_CFLAGS_COMPILE = "-I.";
-  NIX_LDFLAGS = "-lutil";
+  env.NIX_CFLAGS_COMPILE = "-I.";
+  env.NIX_LDFLAGS = "-lutil";
   patchPhase = ''
     # ugly hacks for missing headers
     # most are bsd related - probably should make this a drv
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 3e7e89642c26f..fa4261d94cfd1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -4,8 +4,8 @@
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
   buildInputs = [ CoreSymbolication darling xnu ];
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
-  NIX_LDFLAGS = "-L./Products/Release";
+  env.NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
+  env.NIX_LDFLAGS = "-L./Products/Release";
   xcbuildFlags = [ "-target" "dtrace_frameworks" "-target" "dtrace" ];
 
   doCheck = false;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 82be7dc860eca..c89db3c71dc82 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -5,7 +5,7 @@ appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ openssl_1_0_2 xnu Librpcsvc libpcap developer_cmds ];
 
-  NIX_CFLAGS_COMPILE = " -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
+  env.NIX_CFLAGS_COMPILE = " -I./unbound -I${xnu}/Library/Frameworks/System.framework/Headers/";
 
   # "spray" requires some files that aren't compiling correctly in xcbuild.
   # "rtadvd" seems to fail with some missing constants.
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 16454cbc1a5f3..1e68282af1142 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -12,7 +12,7 @@ appleDerivation {
   # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
   #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
-  NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
+  env.NIX_CFLAGS_COMPILE = builtins.toString ([ "-DDAEMON_UID=1"
                          "-DDAEMON_GID=1"
                          "-DDEFAULT_AT_QUEUE='a'"
                          "-DDEFAULT_BATCH_QUEUE='b'"
@@ -28,7 +28,7 @@ appleDerivation {
                          "-DAHZV1=64 "
                          "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
                          "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
-                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
 
   patchPhase = ''
     substituteInPlace login.tproj/login.c \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index a2f912ca5782c..f6b00c85648c0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -3,7 +3,7 @@
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
-  NIX_LDFLAGS = "-lutil";
+  env.NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
     install -D Products/Release/libtop.h $out/include/libtop.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index afa5dc1c08cb4..3c781cee338ae 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -58,7 +58,7 @@ appleDerivation ({
   MIGCC = "cc";
   ARCHS = "x86_64";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preBuild = ''
     # This is a bit of a hack...
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
index d1df820615df1..216dac62266d8 100644
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ b/pkgs/os-specific/darwin/maloader/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
       ld-mac.cc
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = "-I${libcxx}/include/c++/v1";
   buildInputs = [ clang libcxx ];
   buildFlags = [ "USE_LIBCXX=1" "release" ];
 
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 4f2f84b3c0a5d..2dcc793f9792d 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -57,12 +57,15 @@ stdenv.mkDerivation {
       --replace '#if U_ICU_VERSION_MAJOR_NUM' '#if 0 //'
   '';
 
-  BUILD_DIR = "./Build";
-  CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
-
-  # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
-  # and this version is a version from there. No idea how accurate it is.
-  LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
+  env = {
+    BUILD_DIR = "./Build";
+    # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
+    CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2";
+
+    # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
+    # and this version is a version from there. No idea how accurate it is.
+    LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
+  };
 
   configurePhase = ''
     ../configure release --sysroot UNUSED
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index b72944a49eb19..2566433ed040b 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -94,7 +94,7 @@ in stdenv.mkDerivation rec {
   postBuild = optionalString (!libsOnly)
     (concatMapStrings (m: "xz usr/src/amdgpu-${build}/${m}\n") modules);
 
-  NIX_CFLAGS_COMPILE = "-Werror";
+  env.NIX_CFLAGS_COMPILE = "-Werror";
 
   makeFlags = optionalString (!libsOnly)
     "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 0012c3de98971..05fc052f7f109 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     libGL
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=missing-field-initializers";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=missing-field-initializers";
 
   patchPhase = ''
     patchShebangs scripts
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index f826ddd423d8e..28f23706a4977 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/Conky.cmake --replace "# set(RELEASE true)" "set(RELEASE true)"
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ glib libXinerama ]
diff --git a/pkgs/os-specific/linux/crda/default.nix b/pkgs/os-specific/linux/crda/default.nix
index 501b1fb1884a3..e6ba61a123e41 100644
--- a/pkgs/os-specific/linux/crda/default.nix
+++ b/pkgs/os-specific/linux/crda/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     "REG_BIN=${wireless-regdb}/lib/crda/regulatory.bin"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-const-variable";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-const-variable";
 
   buildFlags = [ "all_noverify" ];
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 9c621d28ed290..b2712e69c99cc 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   configureFlags = [
     "--enable-cryptsetup-reencrypt"
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index 46ebc923e3b27..a34e9473a456b 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   buildPhase = "make -f makefile";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/os-specific/linux/dropwatch/default.nix b/pkgs/os-specific/linux/dropwatch/default.nix
index 69acfa9682b6a..4527f28e8eefe 100644
--- a/pkgs/os-specific/linux/dropwatch/default.nix
+++ b/pkgs/os-specific/linux/dropwatch/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libbfd libnl ncurses readline zlib ];
 
   # To avoid running into https://sourceware.org/bugzilla/show_bug.cgi?id=14243 we need to define:
-  NIX_CFLAGS_COMPILE = "-DPACKAGE=${pname} -DPACKAGE_VERSION=${version}";
+  env.NIX_CFLAGS_COMPILE = "-DPACKAGE=${pname} -DPACKAGE_VERSION=${version}";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/ebtables/default.nix b/pkgs/os-specific/linux/ebtables/default.nix
index 3f025ca75045d..960850b3e859d 100644
--- a/pkgs/os-specific/linux/ebtables/default.nix
+++ b/pkgs/os-specific/linux/ebtables/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
       "LOCALSTATEDIR=/var"
     ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preInstall = "mkdir -p $out/etc/sysconfig";
 
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 9b5d82b9f7b36..a58cd952318d2 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   # linux 3.12
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   configurePhase = ''
     cd kernel/linux/ena
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index c14e04dc3440e..c44e3d5f50846 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     ./do-not-create-sharedstatedir.patch
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${gnu-efi}/include/efi -Wno-error=address-of-packed-member";
+  env.NIX_CFLAGS_COMPILE = "-I${gnu-efi}/include/efi -Wno-error=address-of-packed-member";
 
   # TODO: Just apply the disable to the efi subdir
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 9f32e3e37ddbd..94de4904b0602 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
     "-Wno-error=bool-compare"
     "-Wno-error=deprecated-declarations"
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 39e97f8473c8c..7cab9a08d6764 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index b31554d6cee4f..2b42e1cbe79b9 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   passthru = { inherit se_release se_url; };
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 46c8dec8889fd..024632b04591a 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   preConfigure = ''
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 93e9ba614f881..57c67b8edf70e 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -57,8 +57,6 @@ stdenv.mkDerivation rec {
       sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
     })
   ];
-  CFLAGS = [ "-fstack-protector-strong" ]
-    ++ lib.optional stdenv.hostPlatform.isPower "-mlong-double-64";
 
   configureFlags = [
     "--enable-shared"
@@ -73,7 +71,11 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
   separateDebugInfo = true;
 
-  NIX_DONT_SET_RPATH = true;
+  env = {
+    NIX_DONT_SET_RPATH = true;
+    CFLAGS = "-fstack-protector-strong"
+      + lib.optionalString stdenv.hostPlatform.isPower " -mlong-double-64";
+  };
 
   postInstall = ''
     # Not sure why, but link in all but scsi directory as that's what uclibc/glibc do.
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index 34e2591d44abd..dc3674635e338 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
 
   DESTDIR = "$(out)";
 
-  NIX_LDFLAGS = "-lkmod -lsystemd";
-  NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
+  env.NIX_LDFLAGS = "-lkmod -lsystemd";
+  env.NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
 
   preConfigure = ''
     sed -i 's|/usr|/|' Makefile
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 3312f2302472a..8c4618bc121c5 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = stdenv.lib.optionalString withGtk "true";
 
-  NIX_CFLAGS_COMPILE = "-msse3";
+  env.NIX_CFLAGS_COMPILE = "-msse3";
 
   patches = [ ./configure.patch ];
 
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 4ad454437f577..1d777bcd73b46 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus libcap ];
-  NIX_LDFLAGS = "-lrt";
+  env.NIX_LDFLAGS = "-lrt";
 
   meta = with stdenv.lib; {
     homepage = http://0pointer.de/blog/projects/rtkit;
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index c54d45773428c..f9434f011842e 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 1829bd6763f0f..12d23b038150c 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "format" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 3dbdb99549a15..37a661f626743 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   };
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     export SGML_CATALOG_FILES="${docbookFiles}"
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 61a51afa3a75e..0eae3b4e645a1 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   # needed since luajit-2.1.0-beta3
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
 
   preConfigure = ''
     cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl")
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index 213394e5eccf4..517d6ba6607a2 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   patches = [ ./systemd.patch ./union-wait.patch ];
 
-  NIX_CFLAGS_COMPILE = "-DSYSV";
+  env.NIX_CFLAGS_COMPILE = "-DSYSV";
 
   installFlags = [ "BINDIR=$(out)/sbin" "MANDIR=$(out)/share/man" "INSTALL=install" ];
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 214c9b75cea11..17a32ae254d99 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -180,7 +180,7 @@ in stdenv.mkDerivation {
       --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
     "-UPOLKIT_AGENT_BINARY_PATH" "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index bfcf58a35307a..a4b5b62c67587 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with stdenv.lib; {
     description = "Performance monitoring tool for Linux";
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index 690eb8b2eabb9..0739f931c4edc 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   '';
 
   makeFlags = kernel.makeFlags ++ [ "INSTALL_ROOT=\"$(out)\"" "BINDIR=bin" ];
-  NIX_CFLAGS_LINK = "-lgcc_s";
+  env.NIX_CFLAGS_LINK = "-lgcc_s";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index ec58d513b0958..5208752670d7a 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
+  env.NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index eefa03d91cd88..33b0adb75aa88 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -21,10 +21,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
-
-  NIX_CFLAGS = ["-Wno-error=cpp"];
+  env = {
+    NIX_CFLAGS = "-Wno-error=cpp";
+    KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+    INSTALL_MOD_PATH = "\${out}";
+  };
 
   nativeBuildInputs = [ perl ] ++ kernel.moduleBuildDependencies;
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index ae72aad6c0775..fa94661249616 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -74,7 +74,7 @@ let
         ++ optional stdenv.hostPlatform.isMusl libtirpc;
 
       # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-      NIX_CFLAGS_LINK = "-lgcc_s";
+      env.NIX_CFLAGS_LINK = "-lgcc_s";
 
       hardeningDisable = [ "fortify" "stackprotector" "pic" ];
 
diff --git a/pkgs/servers/computing/torque/default.nix b/pkgs/servers/computing/torque/default.nix
index 8eb12a1b81124..ec37306984079 100644
--- a/pkgs/servers/computing/torque/default.nix
+++ b/pkgs/servers/computing/torque/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # added to fix build with gcc7
-  NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
 
   postPatch = ''
     substituteInPlace Makefile.am \
diff --git a/pkgs/servers/dict/libmaa.nix b/pkgs/servers/dict/libmaa.nix
index 4ac4328c35fcf..b1bee1c46eb91 100644
--- a/pkgs/servers/dict/libmaa.nix
+++ b/pkgs/servers/dict/libmaa.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libtool ];
   # configureFlags = [ "--datadir=/run/current-system/share/dictd" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   meta = with stdenv.lib; {
     description = "Dict protocol server and client";
diff --git a/pkgs/servers/fcgiwrap/default.nix b/pkgs/servers/fcgiwrap/default.nix
index c8ddcf438f7b7..7808019ffaf87 100644
--- a/pkgs/servers/fcgiwrap/default.nix
+++ b/pkgs/servers/fcgiwrap/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "07y6s4mm86cv7p1ljz94sxnqa89y9amn3vzwsnbq5hrl4vdy0zac";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
   configureFlags = [ "--with-systemd" "--with-systemdsystemunitdir=$(out)/etc/systemd/system" ];
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/servers/fingerd/bsd-fingerd/default.nix b/pkgs/servers/fingerd/bsd-fingerd/default.nix
index 999718160215e..f16053c764f32 100644
--- a/pkgs/servers/fingerd/bsd-fingerd/default.nix
+++ b/pkgs/servers/fingerd/bsd-fingerd/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
   };
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   patches = [ ./ubuntu-0.17-9.patch ];
 
diff --git a/pkgs/servers/ftp/vsftpd/default.nix b/pkgs/servers/ftp/vsftpd/default.nix
index 1ef624f2a41ed..63f8b9af43823 100644
--- a/pkgs/servers/ftp/vsftpd/default.nix
+++ b/pkgs/servers/ftp/vsftpd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/sbin $out/man/man{5,8}
   '';
 
-  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
+  env.NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index d5da6df8d689b..7f0caab283ea9 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Required for ‘pthread_cancel’.
-  NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
 
   configureFlags = [
     "--with-apr=${apr.dev}"
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 990d7c5cf1348..b5c396490808a 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-I${libxml2.dev}/include/libxml2"
     "-Wno-error=implicit-fallthrough"
   ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 328db9ec98614..25b8cfbebd84f 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip postgresql ];
   nativeBuildInputs = [ perl ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
index 1eeb5a8c4dd8d..898070d091143 100644
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
     + optionalString stdenv.isDarwin " -Wno-error=deprecated-declarations";
 
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
diff --git a/pkgs/servers/mail/archiveopteryx/default.nix b/pkgs/servers/mail/archiveopteryx/default.nix
index 55cc4c121f0f5..307fd82977a91 100644
--- a/pkgs/servers/mail/archiveopteryx/default.nix
+++ b/pkgs/servers/mail/archiveopteryx/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   # fix build on gcc7+
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=builtin-declaration-mismatch"
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=deprecated-copy"
diff --git a/pkgs/servers/mail/opensmtpd/extras.nix b/pkgs/servers/mail/opensmtpd/extras.nix
index 14d36ad65549c..733d120df7a47 100644
--- a/pkgs/servers/mail/opensmtpd/extras.nix
+++ b/pkgs/servers/mail/opensmtpd/extras.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     "--with-table-redis"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString enableRedis
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString enableRedis
       "-I${hiredis}/include/hiredis -lhiredis"
     + stdenv.lib.optionalString enableMysql
       " -L${libmysqlclient}/lib/mysql";
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index c0e6252a5518c..2714c44bad2eb 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
-  NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
+  env.NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
 
   installTargets = [ "non-interactive-package" ];
 
diff --git a/pkgs/servers/mail/postfix/pfixtools.nix b/pkgs/servers/mail/postfix/pfixtools.nix
index 9fb441a92de3c..f5d4519f04a6d 100644
--- a/pkgs/servers/mail/postfix/pfixtools.nix
+++ b/pkgs/servers/mail/postfix/pfixtools.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
                       --replace /bin/bash ${bash}/bin/bash;
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
 
   makeFlags = [ "DESTDIR=$(out)" "prefix=" ];
 
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index dfb3ac2cfa202..3e09e77f14f94 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "A distributed memory object caching system";
diff --git a/pkgs/servers/nosql/aerospike/default.nix b/pkgs/servers/nosql/aerospike/default.nix
index b7b43edc1cd9d..d49bd8a364d45 100644
--- a/pkgs/servers/nosql/aerospike/default.nix
+++ b/pkgs/servers/nosql/aerospike/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ openssl zlib ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=format-truncation"
     "-Wno-error=address-of-packed-member"
     "-Wno-error=format-overflow"
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index e41930a2f4857..cf3e431a6561b 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -17,7 +17,6 @@ let
 
     # prevent failing with "cmake-3.13.4/nix-support/setup-hook: line 10: ./3rdParty/rocksdb/RocksDBConfig.cmake.in: No such file or directory"
     dontFixCmake       =                     lib.versionAtLeast version "3.5";
-    NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast version "3.5") "-Wno-error";
     preConfigure       = lib.optionalString (lib.versionAtLeast version "3.5") "patchShebangs utils";
 
     postPatch = ''
@@ -44,6 +43,8 @@ let
 
     enableParallelBuilding = true;
 
+    env.NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast version "3.5") "-Wno-error";
+
     meta = with lib; {
       homepage = https://www.arangodb.com;
       description = "A native multi-model database with flexible data models for documents, graphs, and key-values";
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index c2ae83f3e8af0..4b06bd4ddfb42 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
   sconsFlags = [
     "--release"
diff --git a/pkgs/servers/prayer/default.nix b/pkgs/servers/prayer/default.nix
index d1351afa0b301..dd12319ed031e 100644
--- a/pkgs/servers/prayer/default.nix
+++ b/pkgs/servers/prayer/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl db zlib uwimap html-tidy pam ];
   nativeBuildInputs = [ perl ];
 
-  NIX_LDFLAGS = "-lpam";
+  env.NIX_LDFLAGS = "-lpam";
 
   meta = {
     homepage = http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/;
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index da201765e55e0..7549a5fd7789f 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
   # the alternative is to copy the files from /usr/include to src, but there are
   # probably a large number of files that would need to be copied (I stopped
   # after the seventh)
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I/usr/include";
 
   installFlags =
     [ "sysconfdir=${placeholder "out"}/etc"
diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix
index 060b58d18b1b6..45b8737b2be6f 100644
--- a/pkgs/servers/shishi/default.nix
+++ b/pkgs/servers/shishi/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     (mkEnable true                "arcfour"       null)
   ];
 
-  NIX_CFLAGS_COMPILE
+  env.NIX_CFLAGS_COMPILE
     = optionalString stdenv.isDarwin "-DBIND_8_COMPAT";
 
   doCheck = true;
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index aeedf8b30aee4..8805d810d37f5 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
   ++ lib.unique (lib.concatMap (mod: mod.inputs) enabledModules)
   ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/servers/sql/mysql/5.7.x.nix b/pkgs/servers/sql/mysql/5.7.x.nix
index 6636c099e8324..acfa2e7045ddc 100644
--- a/pkgs/servers/sql/mysql/5.7.x.nix
+++ b/pkgs/servers/sql/mysql/5.7.x.nix
@@ -54,9 +54,11 @@ self = stdenv.mkDerivation rec {
     "-DINSTALL_DOCDIR=share/mysql/docs"
     "-DINSTALL_SHAREDIR=share/mysql"
   ];
-
-  CXXFLAGS = "-fpermissive -std=c++11";
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  
+  env = {
+    CXXFLAGS = "-fpermissive -std=c++11";
+    NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  };
 
   prePatch = ''
     sed -i -e "s|/usr/bin/libtool|libtool|" cmake/merge_archives.cmake.in
diff --git a/pkgs/servers/sql/percona/5.6.x.nix b/pkgs/servers/sql/percona/5.6.x.nix
index 860c1f8e94f79..2c3c2fbca7385 100644
--- a/pkgs/servers/sql/percona/5.6.x.nix
+++ b/pkgs/servers/sql/percona/5.6.x.nix
@@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
     "-DINSTALL_SHAREDIR=share/mysql"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=address-of-packed-member";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   prePatch = ''
     sed -i -e "s|/usr/bin/libtool|libtool|" cmake/libutils.cmake
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 3f05b3e36c197..9e7f5b14b2e1f 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -44,7 +44,7 @@ let
 
     buildFlags = [ "world" ];
 
-    NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+    env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
     # Otherwise it retains a reference to compiler and fails; see #44767.  TODO: better.
     preConfigure = "CC=${stdenv.cc.targetPrefix}cc";
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index c7bceb232f661..d3689a5e8e062 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
 
   # postgis config directory assumes /include /lib from the same root for json-c library
-  NIX_LDFLAGS = "-L${stdenv.lib.getLib json_c}/lib";
+  env.NIX_LDFLAGS = "-L${stdenv.lib.getLib json_c}/lib";
 
   preConfigure = ''
     sed -i 's@/usr/bin/file@${file}/bin/file@' configure
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 9a01bf3eed634..600ac86c69aac 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" "-Wno-error=stringop-truncation" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation -Wno-error=stringop-truncation";
 
   # disable dvbscan, as having it enabled causes a network download which
   # cannot happen during build.
diff --git a/pkgs/servers/uwsgi/default.nix b/pkgs/servers/uwsgi/default.nix
index 7669053d22943..0d42ccd677c36 100644
--- a/pkgs/servers/uwsgi/default.nix
+++ b/pkgs/servers/uwsgi/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     ${lib.concatMapStringsSep "\n" (x: x.install or "") needed}
   '';
 
-  NIX_CFLAGS_LINK = toString (lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed);
+  env.NIX_CFLAGS_LINK = toString (lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed);
 
   meta = with stdenv.lib; {
     homepage = https://uwsgi-docs.readthedocs.org/en/latest/;
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index 8d49846cbc042..5756239c96085 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -26,7 +26,7 @@ let
       '';
 
       # https://github.com/varnishcache/varnish-cache/issues/1875
-      NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-fexcess-precision=standard";
+      env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-fexcess-precision=standard";
 
       outputs = [ "out" "dev" "man" ];
 
diff --git a/pkgs/servers/varnish/digest.nix b/pkgs/servers/varnish/digest.nix
index f11c577288f71..4165dfdc21d0d 100644
--- a/pkgs/servers/varnish/digest.nix
+++ b/pkgs/servers/varnish/digest.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "VMOD_DIR=$(out)/lib/varnish/vmods" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+  env.NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
 
   doCheck = true;
 
diff --git a/pkgs/servers/web-apps/fileshelter/default.nix b/pkgs/servers/web-apps/fileshelter/default.nix
index 928d80b1297af..19d0e18e5a11d 100644
--- a/pkgs/servers/web-apps/fileshelter/default.nix
+++ b/pkgs/servers/web-apps/fileshelter/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libzip boost wt4 libconfig ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   postInstall = ''
     ln -s ${wt4}/share/Wt/resources $out/share/fileshelter/docroot/resources
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c01bca007dc82..e08fc87b36742 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -63,7 +63,7 @@ self: super:
     x11BuildHook = ./imake.sh;
     patches = [./imake.patch ./imake-cc-wrapper-uberhack.patch];
     setupHook = ./imake-setup-hook.sh;
-    CFLAGS = "-DIMAKE_COMPILETIME_CPP='\"${if stdenv.isDarwin
+    env.CFLAGS = "-DIMAKE_COMPILETIME_CPP='\"${if stdenv.isDarwin
       then "${tradcpp}/bin/cpp"
       else "gcc"}\"'";
 
@@ -405,7 +405,7 @@ self: super:
   });
 
   xf86videoati = super.xf86videoati.overrideAttrs (attrs: {
-    NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
+    env.NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
   });
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index 121368abf4c70..c0d9999f6e275 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
     -DDEFAULT_PATH_VALUE="/no-such-path"
diff --git a/pkgs/shells/bash/5.0.nix b/pkgs/shells/bash/5.0.nix
index a06b08a5599cc..b099796e1e517 100644
--- a/pkgs/shells/bash/5.0.nix
+++ b/pkgs/shells/bash/5.0.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" "doc" "info" ];
 
-  NIX_CFLAGS_COMPILE = ''
+  env.NIX_CFLAGS_COMPILE = ''
     -DSYS_BASHRC="/etc/bashrc"
     -DSYS_BASH_LOGOUT="/etc/bash_logout"
     -DDEFAULT_PATH_VALUE="/no-such-path"
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 8b23d3dadd2cc..327b06b28428f 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -43,7 +43,9 @@ rec {
       if stdenv'.hostPlatform.isDarwin
       then throw "Cannot build fully static binaries on Darwin/macOS"
       else stdenv'.mkDerivation (args // {
-        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -static";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_LINK = (args.env.NIX_CFLAGS_LINK or "") + " -static";
+        };
         configureFlags = (args.configureFlags or []) ++ [
             "--disable-shared" # brrr...
           ];
@@ -183,7 +185,9 @@ rec {
   keepDebugInfo = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
         dontStrip = true;
-        NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_COMPILE = (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+        };
       });
     };
 
@@ -191,7 +195,9 @@ rec {
   /* Modify a stdenv so that it uses the Gold linker. */
   useGoldLinker = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
-        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
+        env = (args.env or {}) // {
+          NIX_CFLAGS_LINK = (args.env.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
+        };
       });
     };
 
@@ -202,8 +208,10 @@ rec {
      WARNING: this breaks purity! */
   impureUseNativeOptimizations = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
-        NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -march=native";
-        NIX_ENFORCE_NO_NATIVE = false;
+        env = (args.env or {}) // {
+          NIX_CFLAGS_COMPILE = (args.env.NIX_CFLAGS_COMPILE or "") + " -march=native";
+          NIX_ENFORCE_NO_NATIVE = false;
+        };
 
         preferLocalBuild = true;
         allowSubstitutes = false;
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index a11b280b047ee..283693d3b4d42 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -88,6 +88,8 @@ in rec {
 
     , patches ? []
 
+    , env ? {}
+
     , ... } @ attrs:
 
     let
@@ -180,13 +182,16 @@ in rec {
         lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or [])
           (lib.concatLists propagatedDependencies));
 
+      envIsExportable = lib.isAttrs env && !lib.isDerivation env;
+
       derivationArg =
         (removeAttrs attrs
-          ["meta" "passthru" "pos"
+          (["meta" "passthru" "pos"
            "checkInputs" "installCheckInputs"
            "__darwinAllowLocalNetworking"
            "__impureHostDeps" "__propagatedImpureHostDeps"
-           "sandboxProfile" "propagatedSandboxProfile"])
+           "sandboxProfile" "propagatedSandboxProfile"]
+           ++ lib.optional envIsExportable "env"))
         // (lib.optionalAttrs (!(attrs ? name) && attrs ? pname && attrs ? version)) {
           name = "${attrs.pname}-${attrs.version}";
         } // (lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform && !dontAddHostSuffix && (attrs ? name || (attrs ? pname && attrs ? version)))) {
@@ -310,18 +315,27 @@ in rec {
                        else true);
         };
 
+      checkedEnv = let
+        envNames = lib.attrNames env;
+        drvNames = lib.attrNames derivationArg;
+      in
+        assert lib.assertMsg (lib.mutuallyExclusive envNames drvNames) "The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: ${lib.concatStringsSep ", " (lib.intersectLists envNames drvNames)}";
+        lib.mapAttrs
+          (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v) "The ‘env’ attribute set can only contain string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; v)
+          env;
+
     in
 
       lib.extendDerivation
         validity.handled
         ({
            overrideAttrs = f: mkDerivation (attrs // (f attrs));
-           inherit meta passthru;
+           inherit meta passthru env;
          } //
          # Pass through extra attributes that are not inputs, but
          # should be made available to Nix expressions using the
          # derivation (e.g., in assertions).
          passthru)
-        (derivation derivationArg);
+        (derivation (derivationArg // lib.optionalAttrs envIsExportable checkedEnv));
 
 }
diff --git a/pkgs/tools/X11/x11spice/default.nix b/pkgs/tools/X11/x11spice/default.nix
index 513149049faf3..8f65626c57469 100644
--- a/pkgs/tools/X11/x11spice/default.nix
+++ b/pkgs/tools/X11/x11spice/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     gtk2 spice spice-protocol
   ];
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   meta = with stdenv.lib; {
     description = ''
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index da7bfb445a975..5e42c67e376fa 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -61,7 +61,7 @@ in buildPythonApplication rec {
   ];
 
     # error: 'import_cairo' defined but not used
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 465bc474a9e52..1edec8ca9d6f0 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = {
     homepage = http://p7zip.sourceforge.net/;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index b8f649fbdcbb9..fc87b533edc26 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = "-lbz2" + stdenv.lib.optionalString enableNLS " -lnatspec";
+  env.NIX_LDFLAGS = "-lbz2" + stdenv.lib.optionalString enableNLS " -lnatspec";
 
   buildFlags = [
     "generic"
diff --git a/pkgs/tools/audio/darkice/default.nix b/pkgs/tools/audio/darkice/default.nix
index c5f7bcd5a71d8..27bec880a2071 100644
--- a/pkgs/tools/audio/darkice/default.nix
+++ b/pkgs/tools/audio/darkice/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     libopus libvorbis libogg libpulseaudio alsaLib libsamplerate libjack2 lame
   ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   configureFlags = [
     "--with-faac-prefix=${faac}"
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 9029eb38b06fe..aba921b626846 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 69e5976e6d5ea..d464910cd2c76 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   '';
 
   # work around a problem related to gtk3 updates
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   postInstall = ''
   '';
diff --git a/pkgs/tools/backup/chunksync/default.nix b/pkgs/tools/backup/chunksync/default.nix
index 736a3122a6f0a..7c922b10d6dfc 100644
--- a/pkgs/tools/backup/chunksync/default.nix
+++ b/pkgs/tools/backup/chunksync/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [openssl perl];
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env.NIX_LDFLAGS = "-lgcc_s";
 
   makeFlags = [
     "DESTDIR=$(out)"
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 908808b79f3c6..2813d3c4c1f06 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   '';
 
   # Needed on gcc >= 6.
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   meta = with stdenv.lib; {
     description = "A tool for recording audio or data CD-Rs in disk-at-once (DAO) mode";
diff --git a/pkgs/tools/compression/pbzip2/default.nix b/pkgs/tools/compression/pbzip2/default.nix
index 3314544084f87..8241f3b3d7bef 100644
--- a/pkgs/tools/compression/pbzip2/default.nix
+++ b/pkgs/tools/compression/pbzip2/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
 
   meta = with stdenv.lib; {
     homepage = http://compression.ca/pbzip2/;
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index 3c6f622832935..987d351a65715 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index b6099c099f321..b82a4ad9521b9 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -31,7 +31,7 @@ in rec {
     patches = [ ./irods_root_path.patch ];
 
     # fix build with recent llvm versions
-    NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
+    env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
 
     preConfigure = common.preConfigure + ''
       patchShebangs ./test
diff --git a/pkgs/tools/filesystems/reiserfsprogs/default.nix b/pkgs/tools/filesystems/reiserfsprogs/default.nix
index a89ea0657500b..4769c3255a783 100644
--- a/pkgs/tools/filesystems/reiserfsprogs/default.nix
+++ b/pkgs/tools/filesystems/reiserfsprogs/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libuuid ];
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   meta = {
     inherit version;
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 018dfe7858e35..9eb92a3bce3dc 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ fuse3 glib ];
   checkInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/filesystems/svnfs/default.nix b/pkgs/tools/filesystems/svnfs/default.nix
index ebfb211732e8d..3949b8fa019ae 100644
--- a/pkgs/tools/filesystems/svnfs/default.nix
+++ b/pkgs/tools/filesystems/svnfs/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation {
     export LD_LIBRARY_PATH=${subversion.out}/lib
   '';
 
-  NIX_CFLAGS_COMPILE="-I ${subversion.dev}/include/subversion-1";
-  NIX_LDFLAGS="-lsvn_client-1 -lsvn_subr-1";
+  env.NIX_CFLAGS_COMPILE="-I ${subversion.dev}/include/subversion-1";
+  env.NIX_LDFLAGS="-lsvn_client-1 -lsvn_subr-1";
 
   meta = {
     description = "FUSE filesystem for accessing Subversion repositories";
diff --git a/pkgs/tools/filesystems/udftools/default.nix b/pkgs/tools/filesystems/udftools/default.nix
index 9efaf96182d7f..5414efe5a79e8 100644
--- a/pkgs/tools/filesystems/udftools/default.nix
+++ b/pkgs/tools/filesystems/udftools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   preConfigure = ''
     sed -e '1i#include <limits.h>' -i cdrwtool/cdrwtool.c -i pktsetup/pktsetup.c
diff --git a/pkgs/tools/graphics/appleseed/default.nix b/pkgs/tools/graphics/appleseed/default.nix
index cafe0bb7b11a2..ffb3bec4f02e6 100644
--- a/pkgs/tools/graphics/appleseed/default.nix
+++ b/pkgs/tools/graphics/appleseed/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
     osl seexpr makeWrapper
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-I${openexr.dev}/include/OpenEXR"
     "-I${ilmbase.dev}/include/OpenEXR"
     "-I${openimageio.dev}/include/OpenImageIO"
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 31bdba26783ee..d3fb792729669 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     "--with-context=$out/share/texmf/tex/context/third"
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
+  env.NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
 
   postInstall = ''
     mv $out/share/info/asymptote/*.info $out/share/info/
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 3fc82a9c72a04..10cf400e4d2a9 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString x11Support "-lSDL";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString x11Support "-lSDL";
 
   meta = with stdenv.lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/graphics/qrcode/default.nix b/pkgs/tools/graphics/qrcode/default.nix
index 909f0e3972680..38cd617575fe0 100644
--- a/pkgs/tools/graphics/qrcode/default.nix
+++ b/pkgs/tools/graphics/qrcode/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0v81745nx5gny2g05946k8j553j18a29ikmlyh6c3syq6c15k8cf";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   installPhase = ''
     mkdir -p "$out"/{bin,share/doc/qrcode}
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index 4b610ebbfef23..e9ed5a8f1e2da 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     inherit (s) url sha256 rev;
   };
-  NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_gfx}/include/SDL";
+  env.NIX_CFLAGS_COMPILE="-I${SDL.dev}/include/SDL -I${SDL_gfx}/include/SDL";
   configurePhase = ''
     sed -e 's/-[og] root//g' -i Makefile
   '';
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 7610b4e56fb01..61f82857a1163 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable assertions which include -dev QtBase file paths.
-  NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
+  env.NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   configureFlags = [
     "--without-python"
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index 1deff93e2016e..aa49c65fce593 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake fcitx gettext ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/misc/aescrypt/default.nix b/pkgs/tools/misc/aescrypt/default.nix
index 75d8d71b89524..ba785fcb50542 100644
--- a/pkgs/tools/misc/aescrypt/default.nix
+++ b/pkgs/tools/misc/aescrypt/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1iziymcbpc64d44djgqfifpblsly4sr5bxsp5g29jgxz552kjlah";
   };
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-liconv";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-liconv";
 
   preBuild = ''
     substituteInPlace src/Makefile --replace "CC=gcc" "CC?=gcc"
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index cbe97dda9e5ab..f996c7fab89de 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -15,7 +15,7 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 
 with lib;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (recursiveUpdate rec {
   pname = "coreutils";
   version = "8.31";
 
@@ -106,8 +106,10 @@ stdenv.mkDerivation rec {
   # man/sha512sum.td/sha512sum’.
   enableParallelBuilding = false;
 
-  NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
-  FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+  env = {
+    NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
+    FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+  };
 
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
@@ -144,7 +146,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 
-} // optionalAttrs stdenv.hostPlatform.isMusl {
+} (optionalAttrs stdenv.hostPlatform.isMusl {
   # Work around a bogus warning in conjunction with musl.
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-}
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+}))
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 6239e83959816..63fa28dfd5dfe 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
   nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
   buildInputs = [
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 3f5485718dc5b..556960a81ef6f 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   # Work around a bug in the generated flex lexer (upstream flex bug?)
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 1033a489c7670..782efd0a5c875 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
+  env.NIX_CFLAGS_COMPILE = "-Wno-error"; # generated code redefines yyfree
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 219c03f263c77..b025a30ada0a3 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
   # not possible due to assembler code
   hardeningDisable = [ "pic" "stackprotector" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index 2ec683484958c..014e9c7d9bfbe 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureScript = "sh autogen.sh";
 
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 57cf5bb97e2ea..266c13ab051e8 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0cwx20yja24bfknqh1rjb5rl2c0kwnppzsisg1dibbak0l8mxchk";
   };
 
-  NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
 
   hardeningDisable = [ "all" ];
 
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 54da1a1640110..c2126ab44bae5 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat proj bzip2 zlib boost postgresql lua ];
 
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
+  env.NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   meta = with stdenv.lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index 46606e3b43be3..54942a3f356d9 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
   buildInputs = [ gtk2 hicolor-icon-theme ];
-  NIX_LDFLAGS = "-lgio-2.0";
+  env.NIX_LDFLAGS = "-lgio-2.0";
 
   preFixup = ''
     # Need which and xdotool on path to fix auto-pasting.
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 3e7e3870959b4..af7e9d2c4a386 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = "-lX11";
+  env.NIX_LDFLAGS = "-lX11";
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 466a5f3faf1cf..46ea4a03ca97b 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/tealdeer/default.nix b/pkgs/tools/misc/tealdeer/default.nix
index 547cb2d10759a..3e7bc7f82c47a 100644
--- a/pkgs/tools/misc/tealdeer/default.nix
+++ b/pkgs/tools/misc/tealdeer/default.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkgconfig ];
   
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   # disable tests for now since one needs network
   # what is unavailable in sandbox build
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index c307c96199f20..363efee89da37 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--enable-audio=oss,alsa,jack" "--enable-alsaseq" "--with-default-output=alsa" "--enable-ncurses" ];
 
-  NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
+  env.NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
 
   instruments = fetchurl {
     url = http://www.csee.umbc.edu/pub/midia/instruments.tar.gz;
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index b863786145c63..7d80867c54b35 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   checkInputs = [ which ]; # used for tests with checkFlags = [ "DEBUG=true" ];
   checkTarget = "tests";
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "Lightweight implementation of some Unix command line utilities";
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index b9a8f70ff71a7..4d9fd69ec7c39 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake libgsf glib libxml2 ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = {
     description = "Excellent MS Word filter lib, used in most Office suites";
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index 6a5ec86722243..c2c351d0aca32 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
+  env.NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index b1481b2208c6d..13cb26429eea4 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=format"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
diff --git a/pkgs/tools/networking/atftp/default.nix b/pkgs/tools/networking/atftp/default.nix
index 7fcd677044fee..6d32c8fd0a714 100644
--- a/pkgs/tools/networking/atftp/default.nix
+++ b/pkgs/tools/networking/atftp/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline tcp_wrappers pcre makeWrapper gcc ];
 
   # Expects pre-GCC5 inline semantics
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   doCheck = false; # fails
 
diff --git a/pkgs/tools/networking/atinout/default.nix b/pkgs/tools/networking/atinout/default.nix
index 16b3ee668da62..1919221ef3663 100644
--- a/pkgs/tools/networking/atinout/default.nix
+++ b/pkgs/tools/networking/atinout/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "atinout-${version}";
   version = "0.9.2-alpha";
 
-  NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";
+  env.NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";
   LANG = "C.UTF-8";
   nativeBuildInputs = [ ronn mount ];
 
diff --git a/pkgs/tools/networking/bsd-finger/default.nix b/pkgs/tools/networking/bsd-finger/default.nix
index d011665a492bc..724abf76b9456 100644
--- a/pkgs/tools/networking/bsd-finger/default.nix
+++ b/pkgs/tools/networking/bsd-finger/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yhkiv0in588il7f84k2xiy78g9lv12ll0y7047gazhiimk5v244";
   };
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   patches = [ ./ubuntu-0.17-9.patch ];
 
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 8e766cdeeb5c1..2bce1ee9c478a 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
 
   # This code uses inline in the gnu89 sense: see http://clang.llvm.org/compatibility.html#inline
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-std=gnu89";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-std=gnu89";
 
   meta = with stdenv.lib; {
     description = "A small and simple console-based live network and disk io bandwidth monitor";
diff --git a/pkgs/tools/networking/connman/connman-ncurses/default.nix b/pkgs/tools/networking/connman/connman-ncurses/default.nix
index 140105c247549..d875d736a0424 100644
--- a/pkgs/tools/networking/connman/connman-ncurses/default.nix
+++ b/pkgs/tools/networking/connman/connman-ncurses/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ dbus ncurses json_c connman ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
   
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index c5d650f52bbd0..73d02d775e259 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isLinux "--with-randomdev=/dev/random"
     ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
 
-  NIX_CFLAGS_COMPILE = builtins.toString [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=pointer-compare"
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
diff --git a/pkgs/tools/networking/dibbler/default.nix b/pkgs/tools/networking/dibbler/default.nix
index 43c9455712db0..b8f9f27d60cc6 100644
--- a/pkgs/tools/networking/dibbler/default.nix
+++ b/pkgs/tools/networking/dibbler/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     "--enable-resolvconf"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1";
 
   meta = with stdenv.lib; {
     description = "Portable DHCPv6 implementation";
diff --git a/pkgs/tools/networking/dnstracer/default.nix b/pkgs/tools/networking/dnstracer/default.nix
index 5261fdb18960b..7a4b5fd40115a 100644
--- a/pkgs/tools/networking/dnstracer/default.nix
+++ b/pkgs/tools/networking/dnstracer/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [] ++ stdenv.lib.optionals stdenv.isDarwin [ libresolv ];
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lresolv";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lresolv";
 
   meta = with stdenv.lib; {
     description = "Dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.";
diff --git a/pkgs/tools/networking/dsniff/default.nix b/pkgs/tools/networking/dsniff/default.nix
index 9ddc1a35ce372..6014c22da22cc 100644
--- a/pkgs/tools/networking/dsniff/default.nix
+++ b/pkgs/tools/networking/dsniff/default.nix
@@ -54,7 +54,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ glib pcap ];
-  NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread";
+  env.NIX_CFLAGS_LINK = "-lglib-2.0 -lpthread";
   postPatch = ''
     for patch in debian/patches/*.patch; do
       patch < $patch
diff --git a/pkgs/tools/networking/iodine/default.nix b/pkgs/tools/networking/iodine/default.nix
index 44bf52c9933fc..f380c643f5d86 100644
--- a/pkgs/tools/networking/iodine/default.nix
+++ b/pkgs/tools/networking/iodine/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''sed -i "s,/sbin/route,${nettools}/bin/route," src/tun.c'';
 
-  NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
+  env.NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
 
   installFlags = [ "prefix=\${out}" ];
 
diff --git a/pkgs/tools/networking/libnids/default.nix b/pkgs/tools/networking/libnids/default.nix
index ef753127c67ec..39a31e4f1a664 100644
--- a/pkgs/tools/networking/libnids/default.nix
+++ b/pkgs/tools/networking/libnids/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   this is necessary for dsniff to compile; otherwise g_thread_init is a missing
   symbol when linking (?!?)
   */
-  NIX_CFLAGS_COMPILE="-Dg_thread_init= ";
+  env.NIX_CFLAGS_COMPILE="-Dg_thread_init= ";
 
   meta = with stdenv.lib; {
     description = "An E-component of Network Intrusion Detection System which emulates the IP stack of Linux 2.0.x";
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 4c8b926b58273..10ba600d37e61 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   };
 
   # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=format-truncation"
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index 5d788af1682e6..08f651e0c83d1 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     export lsh_cv_sys_unix98_ptys=yes
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam ];
 
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index dcf377ca0c04c..2d9f0c2c1c265 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     (fetchurl { url = "${p}/weed.at"; sha256 = "1101xakhc99f5gb9cs3mmydn43ayli7b270pzbvh7f9rbvh0d0nh"; })
   ];
 
-  NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
+  env.NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
 
   checkInputs = [ dejagnu ];
   doCheck = false; # fails 1 out of a bunch of tests, looks like a bug
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index 9c443696eda68..23370834f1fca 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   # Glib calls `clock_gettime', which is in librt. Linking that library
   # here ensures that a proper rpath is added to the executable so that
   # it can be loaded at run-time.
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lrt -lpthread";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lrt -lpthread";
 
   meta = {
     homepage = http://nbd.sourceforge.net;
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 29c0d550fe2fb..b531664b23dce 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index 843985bfa3e45..f9bb60c3c4780 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
index 72a0ea3682b75..63e4cd5b11096 100644
--- a/pkgs/tools/networking/nfstrace/default.nix
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   # To build with GCC 8+ it needs:
-  CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
+  env.CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
   # CMake can't find json_c without:
-  NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c";
+  env.NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c";
 
   doCheck = false; # requires network access
 
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 68f801060310f..1572079c979f9 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"
+  env.NIX_CFLAGS_COMPILE = "-fpermissive"
     + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index d1a73f1c148b3..32682dd3bafa7 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ openssl ppp ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   configureFlags = [ "--with-pppd=${ppp}/bin/pppd" ];
 
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 623645efc0cab..2200d7ffeb032 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   setSourceRoot = ''
     export sourceRoot=$(realpath */gtests/net/packetdrill)
   '';
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=unused-result"
     "-Wno-error=stringop-truncation"
     "-Wno-error=address-of-packed-member"
diff --git a/pkgs/tools/networking/ripmime/default.nix b/pkgs/tools/networking/ripmime/default.nix
index ae84d9662aa0b..efbabc43f1b1d 100644
--- a/pkgs/tools/networking/ripmime/default.nix
+++ b/pkgs/tools/networking/ripmime/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin" "$out/share/man/man1"
   '';
 
-  NIX_CFLAGS_COMPILE=" -Wno-error ";
+  env.NIX_CFLAGS_COMPILE=" -Wno-error ";
 
   meta = with stdenv.lib; {
     description = "Attachment extractor for MIME messages";
diff --git a/pkgs/tools/networking/siege/default.nix b/pkgs/tools/networking/siege/default.nix
index a0a6599741487..1a6d02062dff4 100644
--- a/pkgs/tools/networking/siege/default.nix
+++ b/pkgs/tools/networking/siege/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vzaj5nzb0fir2a4l7ghv3wa5d1nk2ss8gmwjb6bjavjplccyzcg";
   };
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
   buildInputs = [ openssl zlib ];
 
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index c1a2451328df0..5bd0d7ee090e7 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     c-ares
   ];
 
-  NIX_CFLAGS_COMPILE = "--std=gnu89";
+  env.NIX_CFLAGS_COMPILE = "--std=gnu89";
 
   src = fetchurl {
     url = "https://github.com/sipwise/sipsak/archive/mr${version}.tar.gz";
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index 81da427a52cfa..e16d00b895cc3 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   buildInputs = stdenv.lib.optional tlsSupport openssl;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString tlsSupport "-lcrypto";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString tlsSupport "-lcrypto";
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index fb7de5486fb0a..b923c1942a264 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
     echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
   '';
 
-  NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
+  env.NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
   meta = {
     description = "OpenSource IPsec-based VPN Solution";
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 1d3c4190e3884..5a8229c570940 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-lua=yes" ];
 
-  NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
+  env.NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
 
   preAutoreconf = ''
     substituteInPlace Makefile.am --replace "noinst" ""
diff --git a/pkgs/tools/networking/uwimap/default.nix b/pkgs/tools/networking/uwimap/default.nix
index b687f1db01709..581da3feb2144 100644
--- a/pkgs/tools/networking/uwimap/default.nix
+++ b/pkgs/tools/networking/uwimap/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation ({
     sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${openssl.out}/lib,'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
     "-I${openssl.dev}/include/openssl";
 
   installPhase = ''
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 98705430c2f0a..b940d2e1106fd 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+  env.NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 28413971c004d..568d4bd39a114 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -30,8 +30,6 @@ common =
 
       is20 = lib.versionAtLeast version "2.0pre";
 
-      VERSION_SUFFIX = lib.optionalString fromGit suffix;
-
       outputs = [ "out" "dev" "man" "doc" ];
 
       nativeBuildInputs =
@@ -57,7 +55,10 @@ common =
       propagatedBuildInputs = [ boehmgc ];
 
       # Seems to be required when using std::atomic with 64-bit types
-      NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
+      env = {
+        NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
+        VERSION_SUFFIX = lib.optionalString fromGit suffix;
+      };
 
       preConfigure =
         # Copy libboost_context so we don't get all of Boost in our closure.
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index ae0259e65fcd1..b7df0f57da00f 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ popt nss db bzip2 libarchive libbfd ]
     ++ stdenv.lib.optional stdenv.isLinux elfutils;
 
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
+  env.NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
   configureFlags = [
     "--with-external-db"
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 7ff079c0116c6..feb64bb46e66d 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cert-paths.patch ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/chaps/default.nix b/pkgs/tools/security/chaps/default.nix
index c8ee95069682e..17ffafbebfdc2 100644
--- a/pkgs/tools/security/chaps/default.nix
+++ b/pkgs/tools/security/chaps/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     sha256 = "0chk6pnn365d5kcz6vfqx1d0383ksk97icc0lzg0vvb0kvyj0ff1";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = [
     # readdir_r(3) is deprecated in glibc >= 2.24
     "-Wno-error=deprecated-declarations"
     # gcc8 catching polymorphic type error
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index c3a14f62c7664..60e45df1e1c48 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp gpgstats $out/bin
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
     "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/haka/default.nix b/pkgs/tools/security/haka/default.nix
index bfac54d2d8601..dc3c918b1741f 100644
--- a/pkgs/tools/security/haka/default.nix
+++ b/pkgs/tools/security/haka/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0dm39g3k77sa70zrjsqadidg27a6iqq61jzfdxazpllnrw4mjy4w";
   };
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = ''
     sed -i 's,/etc,'$out'/etc,' src/haka/haka.c
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 315cd1c8c285d..7d4e39a506a1d 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optional stdenv.isDarwin Carbon
   ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [
     "--enable-zlib"
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 716973a3e2e71..944170c5efa00 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
                })
   ];
 
-  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 527c8064bac51..e1533ddedea33 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libevent openssl zlib lzma zstd scrypt ] ++
     stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
 
-  NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
+  env.NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
   postPatch = ''
     substituteInPlace contrib/client-tools/torify \
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index a38c011d7a49f..e1938b65fcfc1 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-usercheck" ];
 
-  NIX_CFLAGS_COMPILE = [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
+  env.NIX_CFLAGS_COMPILE = [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 269b6a82bbcad..6ee0f45a90269 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pz95fb1zvsj9238bg7a4vxl1svn5mnjg10sn5qvgr008q0v9782";
   };
 
-  NIX_CFLAGS_COMPILE = "-O3";
+  env.NIX_CFLAGS_COMPILE = "-O3";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/ddrescueview/default.nix b/pkgs/tools/system/ddrescueview/default.nix
index 466232e2bf779..c55b339fcfb22 100644
--- a/pkgs/tools/system/ddrescueview/default.nix
+++ b/pkgs/tools/system/ddrescueview/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source";
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  env.NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
 
   buildPhase = ''
     lazbuild --lazarusdir=${lazarus}/share/lazarus ddrescueview.lpi
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 86aa5adb6f8f2..68276cccd676f 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   CXXFLAGS = "-fpermissive -Wno-error=catch-value";
-  NIX_LDFLAGS = "-lblkid";
+  env.NIX_LDFLAGS = "-lblkid";
 
   cmakeFlags = [
     "-DFACTER_RUBY=${ruby}/lib/libruby.so"
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 4adc81608293a..fd47f973d5683 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = "-lm";
+  env.NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = http://gdmap.sourceforge.net;
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index 6c5019847ff3c..53bd37fd97781 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "all" ];
 
   # Ignore undefined references to a bunch of libsoup symbols
-  NIX_LDFLAGS = "--unresolved-symbol=ignore-all";
+  env.NIX_LDFLAGS = "--unresolved-symbol=ignore-all";
 
   preConfigure = ''
     patchShebangs configure
diff --git a/pkgs/tools/system/hardlink/default.nix b/pkgs/tools/system/hardlink/default.nix
index d1d2b7a3e7698..7531cceac85db 100644
--- a/pkgs/tools/system/hardlink/default.nix
+++ b/pkgs/tools/system/hardlink/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ pcre2 ];
-  NIX_CFLAGS_LINK = "-lpcre2-8";
+  env.NIX_CFLAGS_LINK = "-lpcre2-8";
 
   buildPhase = ''
     $CC -O2 hardlink.c -o hardlink $NIX_CFLAGS_LINK
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index 0d2a78efba125..ac0488963af73 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sed -e "s@/var@$out/var@g" -i Makefile */Makefile */*/Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
   meta = with stdenv.lib; {
     description = "An easy-to-use IPMI server management utility";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 4f8cfb966e864..c6820a865cea8 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ./no-files-in-etc-and-var.patch
   ];
 
-  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  env.NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
diff --git a/pkgs/tools/system/opencl-info/default.nix b/pkgs/tools/system/opencl-info/default.nix
index d1c3d0ec6c0c0..a762ea0428e82 100644
--- a/pkgs/tools/system/opencl-info/default.nix
+++ b/pkgs/tools/system/opencl-info/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencl-clhpp ocl-icd ];
 
-  NIX_LDFLAGS = "-lOpenCL";
+  env.NIX_LDFLAGS = "-lOpenCL";
 
   installPhase = ''
     install -Dm755 opencl-info $out/bin/opencl-info
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 64c184a612295..511ce5d4f5057 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-Wno-error=format";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 7d3e62d7beb52..25ce6a9f68901 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index ad11cd2e3b65c..8380d45ec713e 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -41,7 +41,7 @@ assert enableQt -> qwt != null;
 
   nativeBuildInputs = [ pkgconfig ];
 
-  NIX_CFLAGS_COMPILE="-Wno-unused";
+  env.NIX_CFLAGS_COMPILE="-Wno-unused";
 
   meta = with stdenv.lib; {
     homepage = https://www.cgsecurity.org/wiki/Main_Page;
diff --git a/pkgs/tools/text/kytea/default.nix b/pkgs/tools/text/kytea/default.nix
index 621408866e8ca..e9dea14fe4d79 100644
--- a/pkgs/tools/text/kytea/default.nix
+++ b/pkgs/tools/text/kytea/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc-O3.patch ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = with stdenv.lib; {
     homepage = http://www.phontron.com/kytea/;
diff --git a/pkgs/tools/text/multitran/libmtquery/default.nix b/pkgs/tools/text/multitran/libmtquery/default.nix
index baccdfdedba5a..ea7b43b314487 100644
--- a/pkgs/tools/text/multitran/libmtquery/default.nix
+++ b/pkgs/tools/text/multitran/libmtquery/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmtsupport libfacet libbtree multitrandata ];
 
-  NIX_LDFLAGS = "-lbtree";
+  env.NIX_LDFLAGS = "-lbtree";
 
   patchPhase = ''
     sed -i -e 's@\$(DESTDIR)/usr@'$out'@' \
diff --git a/pkgs/tools/text/sgml/jade/default.nix b/pkgs/tools/text/sgml/jade/default.nix
index 2cc40510121ba..6728c0cb0c5fe 100644
--- a/pkgs/tools/text/sgml/jade/default.nix
+++ b/pkgs/tools/text/sgml/jade/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnum4 ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated";
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated";
 
   preInstall = ''
     install -d -m755 "$out"/lib
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 2c28f9ea5a565..1d13f03f9367e 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./bash-completion.patch ];
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
+  env.NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ pcre zlib lzma ];
diff --git a/pkgs/tools/text/smu/default.nix b/pkgs/tools/text/smu/default.nix
index 50bceb4fcb347..0a36666ad5cc4 100644
--- a/pkgs/tools/text/smu/default.nix
+++ b/pkgs/tools/text/smu/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
-  NIX_CFLAGS_COMPILE = "-O";
+  env.NIX_CFLAGS_COMPILE = "-O";
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 3b6ec809869d4..5efbd2b0fa58d 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's|@import AppKit;|#import <AppKit/AppKit.h>|' src/macfonts.m
   '';
 
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework AppKit";
+  env.NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework AppKit";
 
   FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 3e72d8b8af592..ed832c794ba7d 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index 3832f3c3be0c8..161f67760b7d5 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   # Fixes build with GCC 6
-  NIX_CFLAGS_COMPILE = "-std=c++03";
+  env.NIX_CFLAGS_COMPILE = "-std=c++03";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxslt freetype libpng libxml2 ];
diff --git a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
index 0daa01f85bb39..73299a52f4e40 100644
--- a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ curl.dev pam ];
 
-  NIX_CFLAGS_COMPILE="-I${json_c.dev}/include/json-c";
-  NIX_CFLAGS_LINK="-L${json_c}/lib";
+  env.NIX_CFLAGS_COMPILE="-I${json_c.dev}/include/json-c";
+  env.NIX_CFLAGS_LINK="-L${json_c}/lib";
 
   installPhase = ''
     mkdir -p $out/{bin,lib}
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index db9c412877ff0..b635677dd5f11 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -707,8 +707,8 @@ let
       sha256 = "0jk3djnk6yf0jsjh8qk3mj8bkx4avp6i4czcpr5xrbf7f41744l3";
     };
     buildInputs = [ pkgs.zlib TestWarn ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.zlib.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.zlib.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
     meta = {
       description = "Fast C metadata and tag reader for all common audio file formats";
       license = stdenv.lib.licenses.gpl2;
@@ -3416,8 +3416,8 @@ let
       sha256 = "0f5gdprcql4kwzgxl2s6ngcfg1jl45lzcqh7dkv5bkwlwmxa9rsi";
     };
     buildInputs = [ pkgs.gmp DevelChecklib TestRequires ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
   };
 
   CryptECB = buildPerlPackage {
@@ -3585,8 +3585,8 @@ let
       url = mirror://cpan/authors/id/T/TT/TTAR/Crypt-OpenSSL-AES-0.02.tar.gz;
       sha256 = "b66fab514edf97fc32f58da257582704a210c2b35e297d5c31b7fa2ffd08e908";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
     meta = with stdenv.lib; {
       description = "Perl wrapper around OpenSSL's AES library";
       license = with licenses; [ artistic1 gpl1Plus ];
@@ -3600,8 +3600,8 @@ let
       url = mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-0.09.tar.gz;
       sha256 = "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
   };
 
   CryptOpenSSLGuess = buildPerlPackage {
@@ -3625,8 +3625,8 @@ let
       url = mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-0.15.tar.gz;
       sha256 = "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -3638,8 +3638,8 @@ let
       sha256 = "4173403ad4cf76732192099f833fbfbf3cd8104e0246b3844187ae384d2c5436";
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_0_2.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl_1_0_2.out}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
   };
 
@@ -3650,8 +3650,8 @@ let
       url = "mirror://cpan/authors/id/J/JO/JONASBN/Crypt-OpenSSL-X509-1.813.tar.gz";
       sha256 = "684bd888d2ed4c748f8f6dd8e87c14afa2974b12ee01faa082ad9cfa1e321e62";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     meta = {
       homepage = "https://github.com/dsully/perl-crypt-openssl-x509";
       description = "Perl extension to OpenSSL's X509 API";
@@ -3753,7 +3753,7 @@ let
       sha256 = "0r6xd9wr0c25rr28zixhqipak575zqsfb7r7f2693i9il1dpj554";
     };
     propagatedBuildInputs = [ pkgs.ncurses ];
-    NIX_CFLAGS_LINK = "-lncurses";
+    env.NIX_CFLAGS_LINK = "-lncurses";
     meta = {
       description = "Perl bindings to ncurses";
       license = stdenv.lib.licenses.artistic1;
@@ -9938,7 +9938,7 @@ let
       sha256 = "312940c1f60f47c4fc93fa0a9d2a626425faa837040c8c2f1ad58ee09f62f371";
     };
     buildInputs = [ pkgs.acl ];
-    NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
     meta = {
       maintainers = [ maintainers.limeytexan ];
       description = "Perl extension for reading and setting Access Control Lists for files by libacl linux library";
@@ -10910,8 +10910,8 @@ let
     };
     buildInputs = [ pkgs.gmp ];
     doCheck = false;
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     propagatedBuildInputs = [ MathBigInt ];
   };
 
@@ -10969,8 +10969,8 @@ let
       sha256 = "1c07521m4d38hy2yx21hkwz22n2672bvrc4i21ldc68h85qy1q8i";
     };
     buildInputs = [ pkgs.gmp AlienGMP ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "High speed arbitrary size integer math";
       license = with stdenv.lib.licenses; [ lgpl21Plus ];
@@ -12892,7 +12892,7 @@ let
     };
     buildInputs = [ DevelPPPort ModuleBuildXSUtil TestException TestFatal TestLeakTrace TestOutput TestRequires TryTiny ];
     perlPreHook = "export LD=$CC";
-    NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-fno-stack-protector";
+    env.NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-fno-stack-protector";
     hardeningDisable = stdenv.lib.optional stdenv.isi686 "stackprotector";
   };
 
@@ -13840,8 +13840,8 @@ let
     buildInputs = [ pkgs.zookeeper_mt ];
     # fix "error: format not a string literal and no format arguments [-Werror=format-security]"
     hardeningDisable = [ "format" ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.zookeeper_mt}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.zookeeper_mt}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
     meta = {
       maintainers = [ maintainers.limeytexan ];
       homepage = https://github.com/mark-5/p5-net-zookeeper;
@@ -14241,7 +14241,7 @@ let
     };
     buildInputs = [ pkgs.pcsclite ];
     nativeBuildInputs = [ pkgs.pkgconfig ];
-    NIX_CFLAGS_LINK = "-L${stdenv.lib.getLib pkgs.pcsclite}/lib -lpcsclite";
+    env.NIX_CFLAGS_LINK = "-L${stdenv.lib.getLib pkgs.pcsclite}/lib -lpcsclite";
     # tests fail; look unfinished
     doCheck = false;
     meta = {
@@ -17182,7 +17182,7 @@ let
       sha256 = "9a08f7a4013c9b865541c10dbba1210779eb9128b961250b746d26702bab6925";
     };
     buildInputs = [ pkgs.readline pkgs.ncurses ];
-    NIX_CFLAGS_LINK = "-lreadline -lncursesw";
+    env.NIX_CFLAGS_LINK = "-lreadline -lncursesw";
 
     # For some crazy reason Makefile.PL doesn't generate a Makefile if
     # AUTOMATED_TESTING is set.
@@ -18749,8 +18749,8 @@ let
     };
     propagatedBuildInputs = [ pkgs.aspell ];
     ASPELL_CONF = "dict-dir ${pkgs.aspellDicts.en}/lib/aspell";
-    NIX_CFLAGS_COMPILE = "-I${pkgs.aspell}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
+    env.NIX_CFLAGS_COMPILE = "-I${pkgs.aspell}/include";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
   };
 
   TextAutoformat = buildPerlPackage {
@@ -19245,7 +19245,7 @@ let
       sha256 = "0avk50kia78kxryh2whmaj5l18q2wvmkdyqyjsf6kwr4kgy6x3i7";
     };
     # https://rt.cpan.org/Public/Bug/Display.html?id=124815
-    NIX_CFLAGS_COMPILE = "-DHAS_VPRINTF";
+    env.NIX_CFLAGS_COMPILE = "-DHAS_VPRINTF";
   };
 
   TextUnidecode = buildPerlPackage {
@@ -20140,7 +20140,7 @@ let
         substituteInPlace Makefile.PL --replace '"cpp"' '"gcc -E"'
         substituteInPlace Makefile.PL --replace '_LASTENTRY\z' '_LASTENTRY\z|CURL_DID_MEMORY_FUNC_TYPEDEFS\z'
       '';
-    NIX_CFLAGS_COMPILE = "-DCURL_STRICTER";
+    env.NIX_CFLAGS_COMPILE = "-DCURL_STRICTER";
     doCheck = false; # performs network access
     meta.broken = stdenv.lib.versionAtLeast (stdenv.lib.getVersion pkgs.curl) "7.66"; # broken since "curl: 7.65.3 -> 7.66.0"
   };
@@ -20292,7 +20292,7 @@ let
       sha256 = "1dq89bh6fqv7l5mbffqcismcljpq5f869bx7g8lg698zgindv5ny";
     };
     buildInputs = [ pkgs.xlibsWrapper ];
-    NIX_CFLAGS_LINK = "-lX11";
+    env.NIX_CFLAGS_LINK = "-lX11";
     doCheck = false; # requires an X server
   };
 
@@ -20320,7 +20320,7 @@ let
       sha256 = "0jznws68skdzkhgkgcgjlj40qdyh9i75r7fw8bqzy406f19xxvnw";
     };
     buildInputs = [ pkgs.xlibsWrapper pkgs.xorg.libXtst pkgs.xorg.libXi ];
-    NIX_CFLAGS_LINK = "-lX11 -lXext -lXtst";
+    env.NIX_CFLAGS_LINK = "-lX11 -lXext -lXtst";
     doCheck = false; # requires an X server
   };
 
@@ -20334,7 +20334,7 @@ let
     AUTOMATED_TESTING = false;
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];
-    NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
+    env.NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
     doCheck = false; # requires an X server
     meta = {
       description = "XCB bindings for X";