diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index 68fe28b50075..bb2381c8f9a0 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
   ];
 
   # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
-  GOEXPERIMENT = "boringcrypto";
+  env.GOEXPERIMENT = "boringcrypto";
 
   # https://github.com/rancher/rke2/blob/104ddbf3de65ab5490aedff36df2332d503d90fe/scripts/build-binary#L27-L39
   ldflags =
diff --git a/pkgs/build-support/docker/tarsum.nix b/pkgs/build-support/docker/tarsum.nix
index 9358c571e94b..6c82fb8f4238 100644
--- a/pkgs/build-support/docker/tarsum.nix
+++ b/pkgs/build-support/docker/tarsum.nix
@@ -13,9 +13,11 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  CGO_ENABLED = 0;
-  GOFLAGS = "-trimpath";
-  GO111MODULE = "off";
+  env = {
+    CGO_ENABLED = 0;
+    GOFLAGS = "-trimpath";
+    GO111MODULE = "off";
+  };
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/dw/dwarfs/package.nix b/pkgs/by-name/dw/dwarfs/package.nix
index 8669f2eb3dde..c0d7424775f1 100644
--- a/pkgs/by-name/dw/dwarfs/package.nix
+++ b/pkgs/by-name/dw/dwarfs/package.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   # these fail inside of the sandbox due to missing access
   # to the FUSE device
-  GTEST_FILTER =
+  env.GTEST_FILTER =
     let
       disabledTests = [
         "dwarfs/tools_test.end_to_end/*"
diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index 19c0aabd0642..e4ded1dfd220 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
           ++ attrs.nativeBuildInputs or [ ];
           strictDeps = true;
 
-          ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+          env.${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
 
           prePatch = ''
             rm -rf BaseTools
diff --git a/pkgs/by-name/fi/fig2dev/package.nix b/pkgs/by-name/fi/fig2dev/package.nix
index 73444a95bd14..a42db77a1cda 100644
--- a/pkgs/by-name/fi/fig2dev/package.nix
+++ b/pkgs/by-name/fi/fig2dev/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ libpng ];
 
-  GSEXE = "${ghostscript}/bin/gs";
+  env.GSEXE = "${ghostscript}/bin/gs";
 
   configureFlags = [ "--enable-transfig" ];
 
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 57f7b0a7fc5c..3f6c43bc42e4 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -56,8 +56,10 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [ openssl ];
 
-  FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
-  FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  env = {
+    FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
+    FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  };
   completions = "target/${stdenv.targetPlatform.config}/release/completions";
 
   gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
diff --git a/pkgs/by-name/gh/ghciwatch/package.nix b/pkgs/by-name/gh/ghciwatch/package.nix
index 55c66944929a..9fe7f3455ac3 100644
--- a/pkgs/by-name/gh/ghciwatch/package.nix
+++ b/pkgs/by-name/gh/ghciwatch/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-kH5YTadpaUXDma+7SfBJxrOIsd9Gm0EU3MfhFmQ3U80=";
 
   # integration tests are not run but the macros need this variable to be set
-  GHC_VERSIONS = "";
+  env.GHC_VERSIONS = "";
   checkFlags = "--test \"unit\"";
 
   meta = {
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index a244ea5474d0..2e0616ee636b 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -228,14 +228,16 @@ let
       chmod 777 ee/frontend_islands/yarn.lock
     '';
 
-    # One of the patches uses this variable - if it's unset, execution
-    # of rake tasks fails.
-    GITLAB_LOG_PATH = "log";
-    FOSS_ONLY = !gitlabEnterprise;
-    SKIP_FRONTEND_ISLANDS_BUILD = lib.optionalString (!gitlabEnterprise) "true";
+    env = {
+      # One of the patches uses this variable - if it's unset, execution
+      # of rake tasks fails.
+      GITLAB_LOG_PATH = "log";
+      FOSS_ONLY = !gitlabEnterprise;
+      SKIP_FRONTEND_ISLANDS_BUILD = lib.optionalString (!gitlabEnterprise) "true";
 
-    SKIP_YARN_INSTALL = 1;
-    NODE_OPTIONS = "--max-old-space-size=8192";
+      SKIP_YARN_INSTALL = 1;
+      NODE_OPTIONS = "--max-old-space-size=8192";
+    };
 
     postConfigure = ''
       # Some rake tasks try to run yarn automatically, which won't work
diff --git a/pkgs/by-name/gl/global-platform-pro/package.nix b/pkgs/by-name/gl/global-platform-pro/package.nix
index 1bc0cc605163..a89e1057c104 100644
--- a/pkgs/by-name/gl/global-platform-pro/package.nix
+++ b/pkgs/by-name/gl/global-platform-pro/package.nix
@@ -26,7 +26,7 @@ in
 maven.buildMavenPackage rec {
   pname = "global-platform-pro";
   version = "25.10.20";
-  GPPRO_VERSION = "v25.10.20-0-g72f85b9"; # git describe --tags --always --long --dirty
+  env.GPPRO_VERSION = "v25.10.20-0-g72f85b9"; # git describe --tags --always --long --dirty
 
   src = fetchFromGitHub {
     owner = "martinpaljak";
diff --git a/pkgs/by-name/go/golem/package.nix b/pkgs/by-name/go/golem/package.nix
index 527d1d69ea48..0ba5fff942db 100644
--- a/pkgs/by-name/go/golem/package.nix
+++ b/pkgs/by-name/go/golem/package.nix
@@ -43,12 +43,14 @@ rustPlatform.buildRustPackage rec {
     (lib.getDev openssl)
   ];
 
-  # Required for golem-wasm-rpc's build.rs to find the required protobuf files
-  # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
-  GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.1.0";
-  # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
-  # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
-  GOLEM_WIT_ROOT = "../golem-wit-1.1.0";
+  env = {
+    # Required for golem-wasm-rpc's build.rs to find the required protobuf files
+    # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
+    GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.1.0";
+    # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
+    # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
+    GOLEM_WIT_ROOT = "../golem-wit-1.1.0";
+  };
 
   cargoHash = "sha256-zf/L7aNsfQXCdGpzvBZxgoatAGB92bvIuj59jANrXIc=";
 
diff --git a/pkgs/by-name/in/infnoise/package.nix b/pkgs/by-name/in/infnoise/package.nix
index f5c6f3855403..762f9a629e81 100644
--- a/pkgs/by-name/in/infnoise/package.nix
+++ b/pkgs/by-name/in/infnoise/package.nix
@@ -27,9 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  GIT_COMMIT = finalAttrs.src.rev;
-  GIT_VERSION = finalAttrs.version;
-  GIT_DATE = "2023-02-14";
+  env = {
+    GIT_COMMIT = finalAttrs.src.rev;
+    GIT_VERSION = finalAttrs.version;
+    GIT_DATE = "2023-02-14";
+  };
 
   buildInputs = [ libftdi ];
 
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index f63dfdfe46c5..f0b5c5169f94 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-w1NoWgaUBny//3t1S5z/juPOYFomwJKtTq/M4qKoNv0=";
   };
 
-  GIT_COMMIT_HASH = finalAttrs.src.rev;
+  env.GIT_COMMIT_HASH = finalAttrs.src.rev;
 
   cargoHash = "sha256-N+c2jnJ7a+Nh2UibkaOByh4tKDX52VovYIpeHTpawXo=";
 
diff --git a/pkgs/by-name/ki/kinect-audio-setup/package.nix b/pkgs/by-name/ki/kinect-audio-setup/package.nix
index 76cd1370d66b..16c26dfd17a8 100644
--- a/pkgs/by-name/ki/kinect-audio-setup/package.nix
+++ b/pkgs/by-name/ki/kinect-audio-setup/package.nix
@@ -17,7 +17,7 @@ let
   # redirects to the following url:
   licenseUrl = "https://www.microsoft.com/en-us/legal/terms-of-use";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kinect-audio-setup";
 
   # On update: Make sure that the `firmwareURL` is still in sync with upstream.
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   version = "0.5";
 
   # This is an MSI or CAB file
-  FIRMWARE = requireFile {
+  env.FIRMWARE = requireFile {
     name = "UACFirmware";
     sha256 = "08a2vpgd061cmc6h3h8i6qj3sjvjr1fwcnwccwywqypz3icn8xw1";
     message = ''
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "git://git.ao2.it/kinect-audio-setup.git";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-bFwmWh822KvFwP/0Gu097nF5K2uCwCLMB1RtP7k+Zt0=";
   };
 
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     install -Dm755 kinect_upload_fw/kinect_upload_fw $out/libexec/
 
     # 7z extract "assume yes on all queries" "only extract/keep files/directories matching UACFIRMWARE.* recursively"
-    7z e -y -r "${FIRMWARE}" "UACFirmware.*" >/dev/null
+    7z e -y -r "${finalAttrs.env.FIRMWARE}" "UACFirmware.*" >/dev/null
     # The filename is bound to change with the Firmware SDK
     mv UACFirmware.* $out/lib/firmware/UACFirmware
 
@@ -93,4 +93,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     license = lib.licenses.unfree;
   };
-}
+})
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index 9cd9d0ed1757..06df3c4cd49f 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -150,8 +150,10 @@ buildPythonApplication rec {
     "fortify3"
   ];
 
-  env.CGO_ENABLED = 0;
-  GOFLAGS = "-trimpath";
+  env = {
+    CGO_ENABLED = 0;
+    GOFLAGS = "-trimpath";
+  };
 
   configurePhase = ''
     export GOCACHE=$TMPDIR/go-cache
diff --git a/pkgs/by-name/mm/mmtc/package.nix b/pkgs/by-name/mm/mmtc/package.nix
index 623b9e3ed060..15057ca33a36 100644
--- a/pkgs/by-name/mm/mmtc/package.nix
+++ b/pkgs/by-name/mm/mmtc/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion artifacts/mmtc.{bash,fish} --zsh artifacts/_mmtc
   '';
 
-  GEN_ARTIFACTS = "artifacts";
+  env.GEN_ARTIFACTS = "artifacts";
 
   meta = {
     description = "Minimal mpd terminal client that aims to be simple yet highly configurable";
diff --git a/pkgs/by-name/mo/movit/package.nix b/pkgs/by-name/mo/movit/package.nix
index 12e8be4d619f..a36ebab3f3db 100644
--- a/pkgs/by-name/mo/movit/package.nix
+++ b/pkgs/by-name/mo/movit/package.nix
@@ -26,8 +26,6 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  GTEST_DIR = "${gtest.src}/googletest";
-
   nativeBuildInputs = [
     pkg-config
   ];
@@ -45,13 +43,15 @@ stdenv.mkDerivation rec {
     libepoxy
   ];
 
-  env =
-    lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = "-std=c++17"; # needed for latest gtest
-    }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_LDFLAGS = "-framework OpenGL";
-    };
+  env = {
+    GTEST_DIR = "${gtest.src}/googletest";
+  }
+  // lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-std=c++17"; # needed for latest gtest
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework OpenGL";
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/ne/netcdffortran/package.nix b/pkgs/by-name/ne/netcdffortran/package.nix
index 50c745633639..0891559c5b78 100644
--- a/pkgs/by-name/ne/netcdffortran/package.nix
+++ b/pkgs/by-name/ne/netcdffortran/package.nix
@@ -27,8 +27,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  FFLAGS = [ "-std=legacy" ];
-  FCFLAGS = [ "-std=legacy" ];
+  env = {
+    FFLAGS = toString [ "-std=legacy" ];
+    FCFLAGS = toString [ "-std=legacy" ];
+  };
 
   meta = {
     description = "Fortran API to manipulate netcdf files";
diff --git a/pkgs/by-name/ne/newsboat/package.nix b/pkgs/by-name/ne/newsboat/package.nix
index a2e87e041013..bd821281dcfe 100644
--- a/pkgs/by-name/ne/newsboat/package.nix
+++ b/pkgs/by-name/ne/newsboat/package.nix
@@ -66,12 +66,14 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
   ];
 
-  # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
-  # these for all platforms, since upstream's gettext crate behavior might
-  # change in the future.
-  GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
-  GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
-  GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
+  env = {
+    # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
+    # these for all platforms, since upstream's gettext crate behavior might
+    # change in the future.
+    GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
+    GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
+    GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
+  };
 
   makeFlags = [ "prefix=$(out)" ];
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/no/nostui/package.nix b/pkgs/by-name/no/nostui/package.nix
index ee987669e91e..d7a113a01d9b 100644
--- a/pkgs/by-name/no/nostui/package.nix
+++ b/pkgs/by-name/no/nostui/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-7i76JPg6MAk4/sO8/JI4ody4iYFJPeLkD2SWncFhT4o=";
   };
 
-  GIT_HASH = "000000000000000000000000000000000000000000000000000";
+  env.GIT_HASH = "000000000000000000000000000000000000000000000000000";
 
   checkFlags = [
     # skip failing test due to nix build timestamps
diff --git a/pkgs/by-name/op/openzwave/package.nix b/pkgs/by-name/op/openzwave/package.nix
index 1d27e9bf8640..a593b6c93ed4 100644
--- a/pkgs/by-name/op/openzwave/package.nix
+++ b/pkgs/by-name/op/openzwave/package.nix
@@ -46,8 +46,10 @@ stdenv.mkDerivation {
     "PREFIX=${placeholder "out"}"
   ];
 
-  FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
-  FONTCONFIG_PATH = "${fontconfig.out}/etc/fonts/";
+  env = {
+    FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+    FONTCONFIG_PATH = "${fontconfig.out}/etc/fonts/";
+  };
 
   postPatch = ''
     substituteInPlace cpp/src/Options.cpp \
diff --git a/pkgs/by-name/pr/proxysql/package.nix b/pkgs/by-name/pr/proxysql/package.nix
index 885bf4d5de3d..373a1bab4b58 100644
--- a/pkgs/by-name/pr/proxysql/package.nix
+++ b/pkgs/by-name/pr/proxysql/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  GIT_VERSION = finalAttrs.version;
+  env.GIT_VERSION = finalAttrs.version;
 
   dontConfigure = true;
 
diff --git a/pkgs/by-name/qc/qcdnum/package.nix b/pkgs/by-name/qc/qcdnum/package.nix
index 0b147eddce75..96887b55ff2c 100644
--- a/pkgs/by-name/qc/qcdnum/package.nix
+++ b/pkgs/by-name/qc/qcdnum/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ gfortran ];
   buildInputs = [ zlib ];
 
-  FFLAGS = [
+  env.FFLAGS = toString [
     "-std=legacy" # fix build with gfortran 10
   ];
 
diff --git a/pkgs/by-name/sa/sagoin/package.nix b/pkgs/by-name/sa/sagoin/package.nix
index 1b75e28938fd..73452dc2f3bf 100644
--- a/pkgs/by-name/sa/sagoin/package.nix
+++ b/pkgs/by-name/sa/sagoin/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion artifacts/sagoin.{bash,fish} --zsh artifacts/_sagoin
   '';
 
-  GEN_ARTIFACTS = "artifacts";
+  env.GEN_ARTIFACTS = "artifacts";
 
   meta = {
     description = "Command-line submission tool for the UMD CS Submit Server";
diff --git a/pkgs/by-name/ve/verible/package.nix b/pkgs/by-name/ve/verible/package.nix
index ae5a1c37bec8..fc7ea87868e1 100644
--- a/pkgs/by-name/ve/verible/package.nix
+++ b/pkgs/by-name/ve/verible/package.nix
@@ -19,15 +19,18 @@ let
     rev = "3f863a3f35f31b61982d813835d8637b3d93d87a";
     hash = "sha256-BsxP3GrS98ubIAkFx/c4pB1i97ZZL2TijS+2ORnooww=";
   };
-in
-buildBazelPackage rec {
-  pname = "verible";
-
-  # These environment variables are read in bazel/build-version.py to create
-  # a build string shown in the tools --version output.
-  # If env variables not set, it would attempt to extract it from .git/.
   GIT_DATE = "2025-08-29";
   GIT_VERSION = "v0.0-4023-gc1271a00";
+in
+buildBazelPackage {
+  pname = "verible";
+
+  env = {
+    # These environment variables are read in bazel/build-version.py to create
+    # a build string shown in the tools --version output.
+    # If env variables not set, it would attempt to extract it from .git/.
+    inherit GIT_DATE GIT_VERSION;
+  };
 
   # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
   version = builtins.concatStringsSep "." (
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 2fc9c6dbe630..213dcf3935c1 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -35,6 +35,15 @@ let
       django = prev.django_5;
     };
   };
+
+  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
+    pango
+    harfbuzz
+    librsvg
+    gdk-pixbuf
+    glib
+    gobject-introspection
+  ];
 in
 python.pkgs.buildPythonApplication rec {
   pname = "weblate";
@@ -197,14 +206,10 @@ python.pkgs.buildPythonApplication rec {
   };
 
   # We don't just use wrapGAppsNoGuiHook because we need to expose GI_TYPELIB_PATH
-  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
-    pango
-    harfbuzz
-    librsvg
-    gdk-pixbuf
-    glib
-    gobject-introspection
-  ];
+  env = {
+    inherit GI_TYPELIB_PATH;
+  };
+
   makeWrapperArgs = [ "--set GI_TYPELIB_PATH \"$GI_TYPELIB_PATH\"" ];
 
   nativeCheckInputs =
diff --git a/pkgs/by-name/xg/xgboost/package.nix b/pkgs/by-name/xg/xgboost/package.nix
index 486801e20524..134da018efd4 100644
--- a/pkgs/by-name/xg/xgboost/package.nix
+++ b/pkgs/by-name/xg/xgboost/package.nix
@@ -90,9 +90,6 @@ effectiveStdenv.mkDerivation rec {
     ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ]
     ++ lib.optionals rLibrary [ "-DR_LIB=ON" ];
 
-  # on Darwin, cmake uses find_library to locate R instead of using the PATH
-  env.NIX_LDFLAGS = "-L${R}/lib/R/lib";
-
   preConfigure = lib.optionals rLibrary ''
     substituteInPlace cmake/RPackageInstall.cmake.in --replace "CMD INSTALL" "CMD INSTALL -l $out/library"
     export R_LIBS_SITE="$R_LIBS_SITE''${R_LIBS_SITE:+:}$out/library"
@@ -106,70 +103,75 @@ effectiveStdenv.mkDerivation rec {
     ctest --force-new-ctest-process ${lib.optionalString cudaSupport "-E TestXGBoostLib"}
   '';
 
-  # Disable finicky tests from dmlc core that fail in Hydra. XGboost team
-  # confirmed xgboost itself does not use this part of the dmlc code.
-  GTEST_FILTER =
-    let
-      # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
-      xsimdTests = lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-        "ThreadGroup.TimerThread"
-        "ThreadGroup.TimerThreadSimple"
-      ];
-      networkingTest = [
-        "AllgatherTest.Basic"
-        "AllgatherTest.VAlgo"
-        "AllgatherTest.VBasic"
-        "AllgatherTest.VRing"
-        "AllreduceGlobal.Basic"
-        "AllreduceGlobal.Small"
-        "AllreduceTest.Basic"
-        "AllreduceTest.BitOr"
-        "AllreduceTest.Restricted"
-        "AllreduceTest.Sum"
-        "Approx.PartitionerColumnSplit"
-        "BroadcastTest.Basic"
-        "CPUHistogram.BuildHistColSplit"
-        "CPUHistogram.BuildHistColumnSplit"
-        "CPUPredictor.CategoricalPredictLeafColumnSplit"
-        "CPUPredictor.CategoricalPredictionColumnSplit"
-        "ColumnSplit/ColumnSplitTrainingTest*"
-        "ColumnSplit/TestApproxColumnSplit*"
-        "ColumnSplit/TestHistColumnSplit*"
-        "ColumnSplitObjective/TestColumnSplit*"
-        "Cpu/ColumnSplitTrainingTest*"
-        "CommGroupTest.Basic"
-        "CommTest.Channel"
-        "CpuPredictor.BasicColumnSplit"
-        "CpuPredictor.IterationRangeColmnSplit"
-        "CpuPredictor.LesserFeaturesColumnSplit"
-        "CpuPredictor.SparseColumnSplit"
-        "DistributedMetric/TestDistributedMetric.BinaryAUCRowSplit/Dist_*"
-        "InitEstimation.FitStumpColumnSplit"
-        "MetaInfo.GetSetFeatureColumnSplit"
-        "Quantile.ColumnSplit"
-        "Quantile.ColumnSplitBasic"
-        "Quantile.ColumnSplitSorted"
-        "Quantile.ColumnSplitSortedBasic"
-        "Quantile.Distributed"
-        "Quantile.DistributedBasic"
-        "Quantile.SameOnAllWorkers"
-        "Quantile.SortedDistributed"
-        "Quantile.SortedDistributedBasic"
-        "QuantileHist.MultiPartitionerColumnSplit"
-        "QuantileHist.PartitionerColumnSplit"
-        "Stats.SampleMean"
-        "Stats.WeightedSampleMean"
-        "SimpleDMatrix.ColumnSplit"
-        "TrackerAPITest.CAPI"
-        "TrackerTest.AfterShutdown"
-        "TrackerTest.Bootstrap"
-        "TrackerTest.GetHostAddress"
-        "TrackerTest.Print"
-        "VectorAllgatherV.Basic"
-      ];
-      excludedTests = xsimdTests ++ networkingTest;
-    in
-    "-${builtins.concatStringsSep ":" excludedTests}";
+  env = {
+    # on Darwin, cmake uses find_library to locate R instead of using the PATH
+    NIX_LDFLAGS = "-L${R}/lib/R/lib";
+
+    # Disable finicky tests from dmlc core that fail in Hydra. XGboost team
+    # confirmed xgboost itself does not use this part of the dmlc code.
+    GTEST_FILTER =
+      let
+        # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
+        xsimdTests = lib.optionals effectiveStdenv.hostPlatform.isDarwin [
+          "ThreadGroup.TimerThread"
+          "ThreadGroup.TimerThreadSimple"
+        ];
+        networkingTest = [
+          "AllgatherTest.Basic"
+          "AllgatherTest.VAlgo"
+          "AllgatherTest.VBasic"
+          "AllgatherTest.VRing"
+          "AllreduceGlobal.Basic"
+          "AllreduceGlobal.Small"
+          "AllreduceTest.Basic"
+          "AllreduceTest.BitOr"
+          "AllreduceTest.Restricted"
+          "AllreduceTest.Sum"
+          "Approx.PartitionerColumnSplit"
+          "BroadcastTest.Basic"
+          "CPUHistogram.BuildHistColSplit"
+          "CPUHistogram.BuildHistColumnSplit"
+          "CPUPredictor.CategoricalPredictLeafColumnSplit"
+          "CPUPredictor.CategoricalPredictionColumnSplit"
+          "ColumnSplit/ColumnSplitTrainingTest*"
+          "ColumnSplit/TestApproxColumnSplit*"
+          "ColumnSplit/TestHistColumnSplit*"
+          "ColumnSplitObjective/TestColumnSplit*"
+          "Cpu/ColumnSplitTrainingTest*"
+          "CommGroupTest.Basic"
+          "CommTest.Channel"
+          "CpuPredictor.BasicColumnSplit"
+          "CpuPredictor.IterationRangeColmnSplit"
+          "CpuPredictor.LesserFeaturesColumnSplit"
+          "CpuPredictor.SparseColumnSplit"
+          "DistributedMetric/TestDistributedMetric.BinaryAUCRowSplit/Dist_*"
+          "InitEstimation.FitStumpColumnSplit"
+          "MetaInfo.GetSetFeatureColumnSplit"
+          "Quantile.ColumnSplit"
+          "Quantile.ColumnSplitBasic"
+          "Quantile.ColumnSplitSorted"
+          "Quantile.ColumnSplitSortedBasic"
+          "Quantile.Distributed"
+          "Quantile.DistributedBasic"
+          "Quantile.SameOnAllWorkers"
+          "Quantile.SortedDistributed"
+          "Quantile.SortedDistributedBasic"
+          "QuantileHist.MultiPartitionerColumnSplit"
+          "QuantileHist.PartitionerColumnSplit"
+          "Stats.SampleMean"
+          "Stats.WeightedSampleMean"
+          "SimpleDMatrix.ColumnSplit"
+          "TrackerAPITest.CAPI"
+          "TrackerTest.AfterShutdown"
+          "TrackerTest.Bootstrap"
+          "TrackerTest.GetHostAddress"
+          "TrackerTest.Print"
+          "VectorAllgatherV.Basic"
+        ];
+        excludedTests = xsimdTests ++ networkingTest;
+      in
+      "-${builtins.concatStringsSep ":" excludedTests}";
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/librsb/default.nix b/pkgs/development/libraries/librsb/default.nix
index e878e84e8d18..83caf9d4ac24 100644
--- a/pkgs/development/libraries/librsb/default.nix
+++ b/pkgs/development/libraries/librsb/default.nix
@@ -45,14 +45,16 @@ stdenv.mkDerivation rec {
   ];
 
   # Ensure C/Fortran code is position-independent.
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-fPIC"
-    "-Ofast"
-  ];
-  FCFLAGS = [
-    "-fPIC"
-    "-Ofast"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-fPIC"
+      "-Ofast"
+    ];
+    FCFLAGS = toString [
+      "-fPIC"
+      "-Ofast"
+    ];
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 059fbf70e4d0..f087e49b13a8 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   # FILECMD was added in libtool 2.4.7; previous versions hardwired `/usr/bin/file`
   #   https://lists.gnu.org/archive/html/autotools-announce/2022-03/msg00000.html
-  FILECMD = "${file}/bin/file";
+  env.FILECMD = "${file}/bin/file";
 
   postPatch =
     # libtool commit da2e352735722917bf0786284411262195a6a3f6 changed
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 1ddcfb22f04b..c7e65d9ce7f9 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   # May have some issues with root compilation because the bootstrap tool
   # cannot be used as a login shell for now.
-  FORCE_UNSAFE_CONFIGURE = lib.optionalString (
+  env.FORCE_UNSAFE_CONFIGURE = lib.optionalString (
     stdenv.hostPlatform.system == "armv7l-linux" || stdenv.hostPlatform.isSunOS
   ) "1";