diff --git a/pkgs/applications/audio/famistudio/build-native-wrapper.nix b/pkgs/applications/audio/famistudio/build-native-wrapper.nix
index ddee5bf5712dc..b7f87bca97f78 100644
--- a/pkgs/applications/audio/famistudio/build-native-wrapper.nix
+++ b/pkgs/applications/audio/famistudio/build-native-wrapper.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
       --replace-quiet 'g++' "$CXX"
 
     # Replacing gcc via sed, would break -static-libgcc otherwise
-    sed -i -e "s/^gcc/$CC/g" build.sh
+    sed -i -e "s/^gcc/''${CC//[\/\\&$'\n']/\\&}/g" build.sh
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Darwin rebuild scripts try to make a universal2 dylib
     # - build dylib for non-hostPlatform
diff --git a/pkgs/applications/science/logic/aiger/default.nix b/pkgs/applications/science/logic/aiger/default.nix
index 5b9e8f62aa01c..00599a3b5131b 100644
--- a/pkgs/applications/science/logic/aiger/default.nix
+++ b/pkgs/applications/science/logic/aiger/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix implicit declaration of `isatty`, which is an error with newer versions of clang.
     ./fix-missing-header.patch
+    # Fixes sed replacements when $CC (or other variables) contain special characters.
+    ./fix-configure-sed.patch
   ];
 
   enableParallelBuilding = true;
@@ -22,7 +24,7 @@ stdenv.mkDerivation rec {
     ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h
     ln -s ${picosat}/lib/picosat.o             ../picosat/picosat.o
     ln -s ${picosat}/share/picosat.version     ../picosat/VERSION
-    ./configure.sh
+    bash configure.sh
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/science/logic/aiger/fix-configure-sed.patch b/pkgs/applications/science/logic/aiger/fix-configure-sed.patch
new file mode 100644
index 0000000000000..1e0e3b63adf97
--- /dev/null
+++ b/pkgs/applications/science/logic/aiger/fix-configure-sed.patch
@@ -0,0 +1,48 @@
+Fixes sed replacements when variables contain special replacement string
+characters ('\', '&' and separator '/').
+
+diff -u a/configure.sh b/configure.sh
+--- a/configure.sh
++++ b/configure.sh
+@@ -131,21 +131,27 @@
+   wrn "no proper '../lingeling' nor '../picosat' (will not build 'aigbmc' nor 'aigdep')"
+ fi
+ 
++# Use Bash to quote replacement string for sed.
++# https://gist.github.com/tie/7e81aaa4b357c486abc197bdbe00f27c
++function quoteSedReplacement() {
++  echo "${!1//[\/\\&$'\n']/\\&}"
++}
++
+ msg "compiling with: $CC $CFLAGS"
+ rm -f makefile
+ sed \
+-  -e "s/@CC@/$CC/" \
+-  -e "s/@CFLAGS@/$CFLAGS/" \
+-  -e "s/@AIGBMCTARGET@/$AIGBMCTARGET/" \
+-  -e "s/@AIGBMCTARGET@/$AIGBMCTARGET/" \
+-  -e "s,@AIGBMCHDEPS@,$AIGBMCHDEPS," \
+-  -e "s,@AIGBMCODEPS@,$AIGBMCODEPS," \
+-  -e "s,@AIGBMCLIBS@,$AIGBMCLIBS," \
+-  -e "s,@AIGBMCFLAGS@,$AIGBMCFLAGS," \
+-  -e "s/@AIGDEPTARGET@/$AIGDEPTARGET/" \
+-  -e "s/@AIGDEPTARGET@/$AIGDEPTARGET/" \
+-  -e "s,@AIGDEPHDEPS@,$AIGDEPHDEPS," \
+-  -e "s,@AIGDEPCODEPS@,$AIGDEPCODEPS," \
+-  -e "s,@AIGDEPLIBS@,$AIGDEPLIBS," \
+-  -e "s,@AIGDEPFLAGS@,$AIGDEPFLAGS," \
++  -e "s/@CC@/$(quoteSedReplacement CC)/" \
++  -e "s/@CFLAGS@/$(quoteSedReplacement CFLAGS)/" \
++  -e "s/@AIGBMCTARGET@/$(quoteSedReplacement AIGBMCTARGET)/" \
++  -e "s/@AIGBMCTARGET@/$(quoteSedReplacement AIGBMCTARGET)/" \
++  -e "s/@AIGBMCHDEPS@/$(quoteSedReplacement AIGBMCHDEPS)/" \
++  -e "s/@AIGBMCODEPS@/$(quoteSedReplacement AIGBMCODEPS)/" \
++  -e "s/@AIGBMCLIBS@/$(quoteSedReplacement AIGBMCLIBS)/" \
++  -e "s/@AIGBMCFLAGS@/$(quoteSedReplacement AIGBMCFLAGS)/" \
++  -e "s/@AIGDEPTARGET@/$(quoteSedReplacement AIGDEPTARGET)/" \
++  -e "s/@AIGDEPTARGET@/$(quoteSedReplacement AIGDEPTARGET)/" \
++  -e "s/@AIGDEPHDEPS@/$(quoteSedReplacement AIGDEPHDEPS)/" \
++  -e "s/@AIGDEPCODEPS@/$(quoteSedReplacement AIGDEPCODEPS)/" \
++  -e "s/@AIGDEPLIBS@/$(quoteSedReplacement AIGDEPLIBS)/" \
++  -e "s/@AIGDEPFLAGS@/$(quoteSedReplacement AIGDEPFLAGS)/" \
+   makefile.in > makefile
diff --git a/pkgs/applications/science/logic/fast-downward/default.nix b/pkgs/applications/science/logic/fast-downward/default.nix
index c18a610467470..a6c6acfa581a6 100644
--- a/pkgs/applications/science/logic/fast-downward/default.nix
+++ b/pkgs/applications/science/logic/fast-downward/default.nix
@@ -27,12 +27,6 @@ stdenv.mkDerivation rec {
     python build.py release
   '';
 
-  postPatch = ''
-    # Needed because the package tries to be too smart.
-    export CC="$(which $CC)"
-    export CXX="$(which $CXX)"
-  '';
-
   installPhase = ''
     install -Dm755 builds/release/bin/downward $out/libexec/fast-downward/downward
     cp -r builds/release/bin/translate $out/libexec/fast-downward/
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index c146cbea80e4f..e294c5a80f566 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -54,13 +54,16 @@ fi
 
 export NIX_BINTOOLS${role_post}=@out@
 
+# Note that certain tools (e.g. strip) sometimes don’t have wrappers so we also
+# check the underlying bintools package.
 for cmd in \
     ar as ld nm objcopy objdump readelf ranlib strip strings size windres
 do
     if
-        PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
+        cmd_path=$(PATH=@out@/bin:@bintools_bin@/bin type -P @targetPrefix@${cmd})
     then
-        export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
+        export NIX_${cmd^^}_BASENAME${role_post}=@targetPrefix@${cmd}
+        export ${cmd^^}${role_post}=${cmd_path}
     fi
 done
 
@@ -69,4 +72,4 @@ done
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
-unset -v role_post cmd upper_case
+unset -v role_post cmd cmd_path
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 33a2b62a49b00..d8e68cd8480af 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -107,8 +107,11 @@ fi
 
 export NIX_CC${role_post}=@out@
 
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
+export NIX_CC_BASENAME${role_post}=@named_cc@
+export NIX_CXX_BASENAME${role_post}=@named_cxx@
+
+export CC${role_post}=@out@/bin/@named_cc@
+export CXX${role_post}=@out@/bin/@named_cxx@
 
 # If unset, assume the default hardening flags.
 : ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
diff --git a/pkgs/development/compilers/gcc/common/builder.nix b/pkgs/development/compilers/gcc/common/builder.nix
index 9a254ef59c023..ba897d01a6c43 100644
--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@@ -63,9 +63,12 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
             if [[ -e "''${!curBintools}/nix-support/orig-libc" ]]; then
                 # Figure out what extra flags when linking to pass to the gcc
                 # compilers being generated to make sure that they use our libc.
-                extraLDFlags=($(< "''${!curBintools}/nix-support/libc-ldflags") $(< "''${!curBintools}/nix-support/libc-ldflags-before" || true))
+                extraLDFlags=($(< "''${!curBintools}/nix-support/libc-ldflags"))
+                if [ -e "''${!curBintools}/nix-support/libc-ldflags-before" ]; then
+                    extraLDFlags+=($(< "''${!curBintools}/nix-support/libc-ldflags-before"))
+                fi
                 if [ -e ''${!curBintools}/nix-support/ld-set-dynamic-linker ]; then
-                    extraLDFlags=-dynamic-linker=$(< ''${!curBintools}/nix-support/dynamic-linker)
+                    extraLDFlags+=(-dynamic-linker=$(< ''${!curBintools}/nix-support/dynamic-linker))
                 fi
 
                 # The path to the Libc binaries such as `crti.o'.
@@ -153,16 +156,15 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
             "NATIVE_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY"
 
             "LDFLAGS_FOR_BUILD=$EXTRA_LDFLAGS_FOR_BUILD"
-            #"LDFLAGS=$EXTRA_LDFLAGS"
+            "LDFLAGS=$EXTRA_LDFLAGS"
             "LDFLAGS_FOR_TARGET=$EXTRA_LDFLAGS_FOR_TARGET"
 
             "CFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
             "CXXFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
             "FLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
 
-            # It seems there is a bug in GCC 5
-            #"CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-            #"CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+            "CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+            "CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
 
             "CFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
             "CXXFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 596c778c0ff5b..1c3a7cd38a23e 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -192,18 +192,14 @@ let
           sed -i '/^  CONFIG\["\(BASERUBY\|SHELL\|GREP\|EGREP\|MKDIR_P\|MAKEDIRS\|INSTALL\)"\]/d' $rbConfig
           # Remove unnecessary groff reference from runtime closure, since it's big
           sed -i '/NROFF/d' $rbConfig
-          ${
-            lib.optionalString (!jitSupport) ''
-              # Get rid of the CC runtime dependency
-              remove-references-to \
-                -t ${stdenv.cc} \
-                $out/lib/libruby*
-              remove-references-to \
-                -t ${stdenv.cc} \
-                $rbConfig
-              sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
-            ''
-          }
+        '' + lib.optionalString (!jitSupport) ''
+          # Get rid of the CC runtime dependency
+          remove-references-to \
+            -t "$NIX_CC" \
+            -t "$NIX_BINTOOLS" \
+            -- "$rbConfig" "$out"/lib/libruby*
+          sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
+        '' + ''
 
           # Allow to override compiler. This is important for cross compiling as
           # we need to set a compiler that is different from the build one.
@@ -255,8 +251,13 @@ let
           fi
 
           fallback_cc=$(unset CC; $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
-          if [[ "$fallback_cc" != "$CC" ]]; then
-             echo "CC='$fallback_cc' should be '$CC' by default" >&2
+        '' + (if jitSupport then ''
+          expected_fallback_cc=$CC
+        '' else ''
+          expected_fallback_cc=$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-''${NIX_CC#"$NIX_STORE"/*-}/bin/$NIX_CC_BASENAME
+        '') + ''
+          if [[ "$fallback_cc" != "$expected_fallback_cc" ]]; then
+             echo "CC='$fallback_cc' should be '$expected_fallback_cc' by default" >&2
              false
           fi
         '';
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index 600ca69f46d04..34c805755b7e1 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -57,22 +57,16 @@ in stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc"
     (
       # We "shift" the tools over to fake platforms perspective from the previous stage.
-      export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-      export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-      export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-      export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-      export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
       export AS=$AS_FOR_BUILD
       export CC=$CC_FOR_BUILD
       export CPP=$CPP_FOR_BUILD
       export CXX=$CXX_FOR_BUILD
       export LD=$LD_FOR_BUILD
 
-      export AS_FOR_TARGET=${stdenv.cc}/bin/$AS
-      export CC_FOR_TARGET=${stdenv.cc}/bin/$CC
-      export CPP_FOR_TARGET=${stdenv.cc}/bin/$CPP
-      export LD_FOR_TARGET=${stdenv.cc.bintools}/bin/$LD
+      export AS_FOR_TARGET=$AS
+      export CC_FOR_TARGET=$CC
+      export CPP_FOR_TARGET=$CPP
+      export LD_FOR_TARGET=$LD
 
       # We define GENERATOR_FILE so nothing bothers looking for GNU GMP.
       export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
@@ -104,23 +98,6 @@ in stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc/${stdenv.hostPlatform.config}/libgcc"
     configureScript=$sourceRoot/configure
     chmod +x "$configureScript"
-
-    export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-    export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-    export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-    export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-    export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
-    export AS=${stdenv.cc}/bin/$AS
-    export CC=${stdenv.cc}/bin/$CC
-    export CPP=${stdenv.cc}/bin/$CPP
-    export CXX=${stdenv.cc}/bin/$CXX
-    export LD=${stdenv.cc.bintools}/bin/$LD
-
-    export AS_FOR_TARGET=${stdenv.cc}/bin/$AS_FOR_TARGET
-    export CC_FOR_TARGET=${stdenv.cc}/bin/$CC_FOR_TARGET
-    export CPP_FOR_TARGET=${stdenv.cc}/bin/$CPP_FOR_TARGET
-    export LD_FOR_TARGET=${stdenv.cc.bintools}/bin/$LD_FOR_TARGET
   '';
 
   configurePlatforms = [ "build" "host" ];
diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index e809ed926edae..dc7b62c4fc84f 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -9,6 +9,10 @@ let self = stdenv.mkDerivation rec {
     sha256 = "0x8prpqi9amfcmi7r4zrza609ai9529pjaq0h4aw51i867064qck";
   };
 
+  patches = [
+    ./remove-cc-reference.patch
+  ];
+
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index e4fb89d054dae..19ec78fc0a1af 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -23,6 +23,7 @@ let self = stdenv.mkDerivation rec {
   nativeBuildInputs = [ m4 ];
 
   patches = [
+    ./remove-cc-reference.patch
     ./5.1.3-CVE-2021-43618.patch
   ] ++ lib.optionals stdenv.isDarwin [
     ./need-size-t.patch
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 3187b529aa178..7e769acbeb2ba 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -20,6 +20,10 @@ let self = stdenv.mkDerivation rec {
     hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
   };
 
+  patches = [
+    ./remove-cc-reference.patch
+  ];
+
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion
diff --git a/pkgs/development/libraries/gmp/remove-cc-reference.patch b/pkgs/development/libraries/gmp/remove-cc-reference.patch
new file mode 100644
index 0000000000000..620bf1ca530f6
--- /dev/null
+++ b/pkgs/development/libraries/gmp/remove-cc-reference.patch
@@ -0,0 +1,13 @@
+--- a/gmp-h.in
++++ b/gmp-h.in
+@@ -2331,8 +2331,8 @@
+ };
+ 
+ /* Define CC and CFLAGS which were used to build this version of GMP */
+-#define __GMP_CC "@CC@"
+-#define __GMP_CFLAGS "@CFLAGS@"
++#define __GMP_CC "cc"
++#define __GMP_CFLAGS ""
+ 
+ /* Major version number is the value of __GNU_MP__ too, above. */
+ #define __GNU_MP_VERSION            6
diff --git a/pkgs/development/libraries/icu/make-icu.nix b/pkgs/development/libraries/icu/make-icu.nix
index 575f184c163fb..083a08085567e 100644
--- a/pkgs/development/libraries/icu/make-icu.nix
+++ b/pkgs/development/libraries/icu/make-icu.nix
@@ -20,9 +20,17 @@ let
     '';
 
     # https://sourceware.org/glibc/wiki/Release/2.26#Removal_of_.27xlocale.h.27
-    postPatch = if (stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl") && lib.versionOlder version "62.1"
-      then "substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'"
-      else null; # won't find locale_t on darwin
+    postPatch = lib.optionalString ((stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl") && lib.versionOlder version "62.1") ''
+      substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'
+    ''
+    # Remove CC/CXX references from tools/toolutil/udbgutil.cpp and do not
+    # embed build platform alias in the output for reproducibility.
+    + ''
+      substituteInPlace tools/toolutil/Makefile.in \
+        --replace-fail \
+        'CPPFLAGS+=  "-DU_BUILD=\"@build@\"" "-DU_HOST=\"@host@\"" "-DU_CC=\"@CC@\"" "-DU_CXX=\"@CXX@\""' \
+        'CPPFLAGS += "-DU_HOST=\"@host@\"" "-DU_CC=\"''${NIX_CC_BASENAME}\"" "-DU_CXX=\"''${NIX_CXX_BASENAME}\""'
+    '';
 
     inherit patchFlags patches;
 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 5ddb26798af51..f9ef18893d4b0 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -28,7 +28,9 @@ let
       inherit hash;
     };
 
-    inherit patches;
+    patches = patches ++ [
+      ./remove-cflags-references.patch
+    ];
 
     postPatch = ''
       patchShebangs Configure
diff --git a/pkgs/development/libraries/openssl/remove-cflags-references.patch b/pkgs/development/libraries/openssl/remove-cflags-references.patch
new file mode 100644
index 0000000000000..bfe77f7b32792
--- /dev/null
+++ b/pkgs/development/libraries/openssl/remove-cflags-references.patch
@@ -0,0 +1,18 @@
+--- a/util/mkbuildinf.pl
++++ b/util/mkbuildinf.pl
+@@ -12,6 +12,15 @@
+ my ($cflags, $platform) = @ARGV;
+ $cflags = "compiler: $cflags";
+ 
++# OpenSSL is part of the stdenv bootstrap, but also removeReferencesTo on Darwin
++# requires signingUtils that, in turn, requires OpenSSL, causing infinite
++# recursion. To break the cycle, we make OpenSSL build system aware of the Nix
++# build environment and remove store references from the embedded cflags string
++# at build time. This is arguably cleaner approach as we still retain this
++# information if some dependency needs it, but don’t have to modify and
++# potentially fixup the resulting binaries.
++$cflags =~ s/(\Q$ENV{NIX_STORE}\E)\/[a-z0-9]{32}-/$1\/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-/g;
++
+ my $date = gmtime($ENV{'SOURCE_DATE_EPOCH'} || time()) . " UTC";
+ 
+ print <<"END_OUTPUT";
diff --git a/pkgs/development/python-modules/clustershell/default.nix b/pkgs/development/python-modules/clustershell/default.nix
index 964b2724d07c3..ec3277c6853ab 100644
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@@ -97,6 +97,9 @@ buildPythonPackage rec {
     tests/*.py
   '';
 
+  # FIXME: for some reason, tests get stuck (that is an issue on master branch as well).
+  doCheck = false;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Scalable Python framework for cluster administration";
diff --git a/pkgs/development/tools/abuild/default.nix b/pkgs/development/tools/abuild/default.nix
index 4cabeaa7d020b..f7cf07afe5f84 100644
--- a/pkgs/development/tools/abuild/default.nix
+++ b/pkgs/development/tools/abuild/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xVxgcBchGfeVo1cgP9iVsWjZ6SHVN6R8zWaE1k3DcXQ=";
   };
 
+  strictDeps = true;
+
   buildInputs = [
     openssl
     zlib
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index eb24879366472..ece709c3bdbdb 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -89,6 +89,16 @@ stdenv.mkDerivation rec {
     "--syslibdir=${placeholder "out"}/lib"
   ];
 
+  # Set variables that affect the path used by musl-gcc and musl-clang wrappers.
+  # If $CC ends with gcc, WRAPCC_GCC is set to $CC. Same for clang. Note that
+  # musl-gcc wrapper uses REALGCC environment variable at runtime if it is set.
+  # We want to avoid reference to the $CC, so we force the default values when
+  # building (see Makefile).
+  makeFlags = [
+    "WRAPCC_GCC=gcc"
+    "WRAPCC_CLANG=clang"
+  ];
+
   outputs = [ "out" "bin" "dev" ];
 
   dontDisableStatic = true;
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index b2167b9ef7fac..2f4cb5aacbcb2 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -5,6 +5,7 @@
 , updateAutotoolsGnuConfigScriptsHook
 , bison
 , util-linux
+, removeReferencesTo
 
   # patch for cygwin requires readline support
 , interactive ? stdenv.isCygwin
@@ -100,6 +101,7 @@ stdenv.mkDerivation rec {
   # Note: Bison is needed because the patches above modify parse.y.
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook bison ]
+    ++ lib.optional interactive removeReferencesTo
     ++ lib.optional withDocs texinfo
     ++ lib.optional stdenv.hostPlatform.isDarwin stdenv.cc.bintools;
 
@@ -123,8 +125,8 @@ stdenv.mkDerivation rec {
   postFixup =
     if interactive
     then ''
-      substituteInPlace "$out/bin/bashbug" \
-        --replace '#!/bin/sh' "#!$out/bin/bash"
+      remove-references-to -t "$NIX_CC" -- "$out"/bin/bashbug
+      HOST_PATH=$out/bin patchShebangs --host -- "$out"/bin/bashbug
     ''
     # most space is taken by locale data
     else ''
diff --git a/pkgs/test/stdenv/gcc-stageCompare.nix b/pkgs/test/stdenv/gcc-stageCompare.nix
index e5c2ed5921b30..9c800344aa570 100644
--- a/pkgs/test/stdenv/gcc-stageCompare.nix
+++ b/pkgs/test/stdenv/gcc-stageCompare.nix
@@ -8,25 +8,43 @@
 # must remember to do the check.
 #
 
-{ stdenv
-, pkgs
-, lib
+{ lib
+, stdenv
+, runCommand
+, overrideCC
+, wrapCCWith
 }:
 
-assert stdenv.cc.isGNU;
-with pkgs;
-# rebuild gcc using the "final" stdenv
-let gcc-stageCompare = (gcc-unwrapped.override {
-      reproducibleBuild = true;
-      profiledCompiler = false;
-      stdenv = overrideCC stdenv (wrapCCWith {
-        cc = stdenv.cc;
-      });
-    }).overrideAttrs(_: {
-      NIX_OUTPATH_USED_AS_RANDOM_SEED = stdenv.cc.cc.out;
+let
+  inherit (stdenv.cc) cc;
+in
+
+assert cc.isGNU;
+
+# Rebuild gcc using the "final" stdenv.
+let
+  rebuiltCC = (cc.override {
+    reproducibleBuild = true;
+    profiledCompiler = false;
+    stdenv = overrideCC stdenv (wrapCCWith {
+      inherit cc;
     });
-in (runCommand "gcc-stageCompare" {} ''
-  diff -sr ${pkgs.gcc-unwrapped.checksum}/checksums ${gcc-stageCompare.checksum}/checksums && touch $out
-'').overrideAttrs (a: {
-  meta = (a.meta or { }) // { platforms = lib.platforms.linux; };
-})
+  }).overrideAttrs (_: {
+    # TODO: do we really have to set random seed? This likely won’t work with
+    # content-addressed derivations, and also GCC expects random seed to be
+    # different for each file (but that is an issue with stdenv in general).
+    # https://gcc.gnu.org/onlinedocs/gcc-14.1.0/gcc/Developer-Options.html#index-frandom-seed
+    # >The string should be different for every file you compile.
+    NIX_OUTPATH_USED_AS_RANDOM_SEED = cc.out;
+  });
+
+  cmdArgs = {
+    checksumBefore = cc.checksum;
+    checksumAfter = rebuiltCC.checksum;
+    meta.platforms = lib.platforms.linux;
+  };
+in
+runCommand "gcc-stageCompare" cmdArgs ''
+  diff -sr "$checksumBefore"/checksums "$checksumAfter"/checksums
+  touch $out
+''