diff --git a/pkgs/applications/editors/glow/default.nix b/pkgs/applications/editors/glow/default.nix
index 728f5e54a3c6..dde5083d9c8d 100644
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags= -s -w -X=main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
   meta = with lib; {
     description = "Render markdown on the CLI, with pizzazz!";
diff --git a/pkgs/applications/editors/micro/default.nix b/pkgs/applications/editors/micro/default.nix
index c10a436b7396..c3c42ac24cba 100644
--- a/pkgs/applications/editors/micro/default.nix
+++ b/pkgs/applications/editors/micro/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-YcAKl4keizkbgQLAZGiCG3CGpNTNad8EvOJEXLX2s0s=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/zyedidia/micro/v2/internal/util.Version=${version} -X github.com/zyedidia/micro/v2/internal/util.CommitHash=${src.rev}" ];
+  ldflags = [ "-s" "-w" "-X github.com/zyedidia/micro/v2/internal/util.Version=${version}" "-X github.com/zyedidia/micro/v2/internal/util.CommitHash=${src.rev}" ];
 
   postInstall = ''
     installManPage assets/packaging/micro.1
diff --git a/pkgs/applications/logging/humioctl/default.nix b/pkgs/applications/logging/humioctl/default.nix
index 5ec33d88cddb..b5d0578b1220 100644
--- a/pkgs/applications/logging/humioctl/default.nix
+++ b/pkgs/applications/logging/humioctl/default.nix
@@ -20,7 +20,7 @@ in buildGoModule {
       sha256 = sha256;
     };
 
-    buildFlagsArray = "-ldflags=-X main.version=${humioCtlVersion}";
+    ldflags = [ "-X main.version=${humioCtlVersion}" ];
 
     nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/archiver/default.nix b/pkgs/applications/misc/archiver/default.nix
index 4d46047bb964..cf76eda2720c 100644
--- a/pkgs/applications/misc/archiver/default.nix
+++ b/pkgs/applications/misc/archiver/default.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "0avnskay23mpl3qkyf1h75rr7szpsxis2bj5pplhwf8q8q0212xf";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev} -X main.date=unknown" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" "-X main.date=unknown" ];
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/charm/default.nix b/pkgs/applications/misc/charm/default.nix
index 97e8227e6c96..224336dffabf 100644
--- a/pkgs/applications/misc/charm/default.nix
+++ b/pkgs/applications/misc/charm/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags= -s -w -X=main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
   meta = with lib; {
     description = "Manage your charm account on the CLI";
diff --git a/pkgs/applications/misc/dstask/default.nix b/pkgs/applications/misc/dstask/default.nix
index c17ed9b3af5e..4e03059a8cc4 100644
--- a/pkgs/applications/misc/dstask/default.nix
+++ b/pkgs/applications/misc/dstask/default.nix
@@ -24,11 +24,11 @@ buildGoModule rec {
   # The other variables are set so that the output of dstask version shows the
   # git ref and the release version from github.
   # Ref <https://github.com/NixOS/nixpkgs/pull/87383#discussion_r432097657>
-  buildFlagsArray = [ ''
-    -ldflags=-w -s
-    -X "github.com/naggie/dstask.VERSION=${version}"
-    -X "github.com/naggie/dstask.GIT_COMMIT=v${version}"
-  '' ];
+  ldflags = [
+    "-w" "-s"
+    "-X github.com/naggie/dstask.VERSION=${version}"
+    "-X github.com/naggie/dstask.GIT_COMMIT=v${version}"
+  ];
 
   subPackages = [ "cmd/dstask.go" ];
 
diff --git a/pkgs/applications/misc/expenses/default.nix b/pkgs/applications/misc/expenses/default.nix
index cd40b381cb74..052a7905f5b3 100644
--- a/pkgs/applications/misc/expenses/default.nix
+++ b/pkgs/applications/misc/expenses/default.nix
@@ -23,8 +23,8 @@ buildGoModule rec {
 
   buildInputs = [ sqlite ];
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X github.com/manojkarthick/expenses/cmd.Version=${version}"
+  ldflags = [
+    "-s" "-w" "-X github.com/manojkarthick/expenses/cmd.Version=${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/wtf/default.nix b/pkgs/applications/misc/wtf/default.nix
index 867dee5bcd30..30ae2d9be0f6 100644
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index ebc1144e1576..617d84e43db6 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = "-ldflags=-X main.Version=${version}";
+  ldflags = [ "-X main.Version=${version}" ];
 
   meta = with lib; {
     description = "CloudFlare Argo Tunnel daemon (and DNS-over-HTTPS client)";
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index d82537beac85..4101ac9f3fd0 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -22,11 +22,10 @@ buildGoModule rec {
     packr
   '';
 
-  buildFlagsArray =
+  ldflags =
     let package_url = "github.com/argoproj/argo-cd/v2/common"; in
     [
-      "-ldflags="
-      "-s -w"
+      "-s" "-w"
       "-X ${package_url}.version=${version}"
       "-X ${package_url}.buildDate=unknown"
       "-X ${package_url}.gitCommit=${commit}"
diff --git a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
index 287640bf5a54..619b2834e5c6 100644
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@@ -25,8 +25,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index a4699bacba9c..729f7e472280 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/flux" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/fluxctl/default.nix b/pkgs/applications/networking/cluster/fluxctl/default.nix
index 003f6722d1da..4fe8bea90717 100644
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/fluxctl" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   postInstall = ''
     for shell in bash fish zsh; do
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index af2771f98587..6d70b405e168 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/roboll/helmfile/pkg/app/version.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/roboll/helmfile/pkg/app/version.Version=${version}" ];
 
   postInstall = ''
     wrapProgram $out/bin/helmfile \
diff --git a/pkgs/applications/networking/cluster/hetzner-kube/default.nix b/pkgs/applications/networking/cluster/hetzner-kube/default.nix
index f66e5f88e729..bf4183268e53 100644
--- a/pkgs/applications/networking/cluster/hetzner-kube/default.nix
+++ b/pkgs/applications/networking/cluster/hetzner-kube/default.nix
@@ -22,10 +22,9 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = ''
-    -ldflags=
-    -X github.com/xetys/hetzner-kube/cmd.version=${version}
-  '';
+  ldflags = [
+    "-X github.com/xetys/hetzner-kube/cmd.version=${version}"
+  ];
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index 747523103af8..e4ef8d1aa8d7 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -17,14 +17,14 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles ];
 
   # Bundle release metadata
-  buildFlagsArray = let
+  ldflags = let
     attrs = [
       "istio.io/pkg/version.buildVersion=${version}"
       "istio.io/pkg/version.buildStatus=Nix"
       "istio.io/pkg/version.buildTag=${version}"
       "istio.io/pkg/version.buildHub=docker.io/istio"
     ];
-  in ["-ldflags=-s -w ${lib.concatMapStringsSep " " (attr: "-X ${attr}") attrs}"];
+  in ["-s" "-w" "${lib.concatMapStringsSep " " (attr: "-X ${attr}") attrs}"];
 
   subPackages = [ "istioctl/cmd/istioctl" ];
 
diff --git a/pkgs/applications/networking/cluster/jx/default.nix b/pkgs/applications/networking/cluster/jx/default.nix
index d7fc1cb22429..d9b04aaf7fc6 100644
--- a/pkgs/applications/networking/cluster/jx/default.nix
+++ b/pkgs/applications/networking/cluster/jx/default.nix
@@ -19,13 +19,12 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildFlagsArray = ''
-    -ldflags=
-    -s -w
-    -X github.com/jenkins-x/jx/pkg/version.Version=${version}
-    -X github.com/jenkins-x/jx/pkg/version.Revision=${src.rev}
-    -X github.com/jenkins-x/jx/pkg/version.GitTreeState=clean
-  '';
+  ldflags = [
+    "-s -w"
+    "-X github.com/jenkins-x/jx/pkg/version.Version=${version}"
+    "-X github.com/jenkins-x/jx/pkg/version.Revision=${src.rev}"
+    "-X github.com/jenkins-x/jx/pkg/version.GitTreeState=clean"
+  ];
 
   postInstall = ''
     for shell in bash zsh; do
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index 3c7b232cc214..871ab8b93456 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -11,12 +11,11 @@ buildGoModule rec {
     sha256 = "sha256-ws5JC2/WkgwxKwYtP9xtFELRhztzL6tNSvopyeC6H0Q=";
   };
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X github.com/derailed/k9s/cmd.version=${version}
-      -X github.com/derailed/k9s/cmd.commit=${src.rev}
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/derailed/k9s/cmd.version=${version}"
+    "-X github.com/derailed/k9s/cmd.commit=${src.rev}"
+  ];
 
   vendorSha256 = "sha256-T9khJeg5XPhVyUiu4gEEHZR6RgJF4P8LYFycqJglms8=";
 
diff --git a/pkgs/applications/networking/cluster/kpt/default.nix b/pkgs/applications/networking/cluster/kpt/default.nix
index be91a64b74f9..3e6475ca6586 100644
--- a/pkgs/applications/networking/cluster/kpt/default.nix
+++ b/pkgs/applications/networking/cluster/kpt/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/GoogleContainerTools/kpt/run.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/GoogleContainerTools/kpt/run.version=${version}" ];
 
   meta = with lib; {
     description = "A toolkit to help you manage, manipulate, customize, and apply Kubernetes Resource configuration data files";
diff --git a/pkgs/applications/networking/cluster/kubelogin/default.nix b/pkgs/applications/networking/cluster/kubelogin/default.nix
index f8bec6e0b109..d5f04c14d572 100644
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@@ -13,11 +13,10 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-vJfTf9gD/qrsPAfJeMYLjGa90mYLOshgDehv2Fcl6xM=";
 
-  buildFlagsArray = ''
-    -ldflags=
-        -X main.version=${version}
-        -X main.goVersion=${lib.getVersion go}
-  '';
+  ldflags = [
+    "-X main.version=${version}"
+    "-X main.goVersion=${lib.getVersion go}"
+  ];
 
   meta = with lib; {
     description = "A Kubernetes credential plugin implementing Azure authentication";
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
index 15670188f14e..13fc7a9605e4 100644
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/kubeseal" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 
   meta = with lib; {
     description = "A Kubernetes controller and tool for one-way encrypted Secrets";
diff --git a/pkgs/applications/networking/cluster/kuttl/default.nix b/pkgs/applications/networking/cluster/kuttl/default.nix
index fe92a5ddf9f2..64f13ad6b60f 100644
--- a/pkgs/applications/networking/cluster/kuttl/default.nix
+++ b/pkgs/applications/networking/cluster/kuttl/default.nix
@@ -16,10 +16,10 @@ buildGoModule rec {
 
   subPackages = [ "cmd/kubectl-kuttl" ];
 
-  buildFlagsArray = ''
-    -ldflags=-s -w
-    -X  github.com/kudobuilder/kuttl/pkg/version.gitVersion=${version}
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/kudobuilder/kuttl/pkg/version.gitVersion=${version}"
+  ];
 
   meta = with lib; {
     description = "The KUbernetes Test TooL (KUTTL) provides a declarative approach to testing production-grade Kubernetes operators";
diff --git a/pkgs/applications/networking/cluster/multus-cni/default.nix b/pkgs/applications/networking/cluster/multus-cni/default.nix
index 9e91589478b4..3a8a26af3ff9 100644
--- a/pkgs/applications/networking/cluster/multus-cni/default.nix
+++ b/pkgs/applications/networking/cluster/multus-cni/default.nix
@@ -11,11 +11,11 @@ buildGoModule rec {
     sha256 = "sha256-eVYRbMijOEa+DNCm4w/+WVrTI9607NF9/l5YKkXJuFs=";
   };
 
-  buildFlagsArray = let
+  ldflags = let
     multus = "gopkg.in/intel/multus-cni.v3/pkg/multus";
     commit = "f6298a3a294a79f9fbda0b8f175e521799d5f8d7";
   in [
-    "-ldflags=-s -w -X '${multus}.version=v${version}' -X '${multus}.commit=${commit}'"
+    "-s" "-w" "-X ${multus}.version=v${version}" "-X ${multus}.commit=${commit}"
   ];
 
   preInstall = ''
diff --git a/pkgs/applications/networking/cluster/popeye/default.nix b/pkgs/applications/networking/cluster/popeye/default.nix
index 3751ad25c784..1a7c56bd18b4 100644
--- a/pkgs/applications/networking/cluster/popeye/default.nix
+++ b/pkgs/applications/networking/cluster/popeye/default.nix
@@ -11,11 +11,10 @@ buildGoModule rec {
     sha256 = "sha256-oft1zLLd5TP8S9GMjp5kYaoPoOYnbhJwL2wBerkhp+c=";
   };
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X github.com/derailed/popeye/cmd.version=${version}
-      -X github.com/derailed/popeye/cmd.commit=${version}
+  ldflags = ''
+    "-s" "-w"
+    "-X github.com/derailed/popeye/cmd.version=${version}"
+    "-X github.com/derailed/popeye/cmd.commit=${version}"
   '';
 
   vendorSha256 = "sha256-vUUDLMicop5QzZmAHi5qrc0hx8oV2xWNFHvCWioLhl8=";
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index 6f8e5640539d..3c00bc1eedbe 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -15,12 +15,11 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X github.com/splunk/qbec/internal/commands.version=${version}
-      -X github.com/splunk/qbec/internal/commands.commit=${src.rev}
-      -X github.com/splunk/qbec/internal/commands.goVersion=${lib.getVersion go}
+  ldflags = ''
+    "-s" "-w"
+    "-X github.com/splunk/qbec/internal/commands.version=${version}"
+    "-X github.com/splunk/qbec/internal/commands.commit=${src.rev}"
+    "-X github.com/splunk/qbec/internal/commands.goVersion=${lib.getVersion go}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/sonobuoy/default.nix b/pkgs/applications/networking/cluster/sonobuoy/default.nix
index fc30699f225f..b82b6cf610de 100644
--- a/pkgs/applications/networking/cluster/sonobuoy/default.nix
+++ b/pkgs/applications/networking/cluster/sonobuoy/default.nix
@@ -7,14 +7,14 @@ buildGoModule rec {
   pname = "sonobuoy";
   version = "0.53.2"; # Do not forget to update `rev` above
 
-  buildFlagsArray =
+  ldflags =
     let t = "github.com/vmware-tanzu/sonobuoy";
-    in ''
-      -ldflags=
-        -s -X ${t}/pkg/buildinfo.Version=v${version}
-           -X ${t}/pkg/buildinfo.GitSHA=${rev}
-           -X ${t}/pkg/buildDate=unknown
-    '';
+    in [
+      "-s"
+      "-X ${t}/pkg/buildinfo.Version=v${version}"
+      "-X ${t}/pkg/buildinfo.GitSHA=${rev}"
+      "-X ${t}/pkg/buildDate=unknown"
+    ];
 
   src = fetchFromGitHub {
     sha256 = "sha256-8bUZsknG1Z2TKWwtuJtnauK8ibikGphl3oiLXT3PZzY=";
diff --git a/pkgs/applications/networking/cluster/stern/default.nix b/pkgs/applications/networking/cluster/stern/default.nix
index 602ac8ae5368..74508a73227d 100644
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@@ -19,8 +19,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildFlagsArray =
-    [ "-ldflags=-s -w -X github.com/stern/stern/cmd.version=${version}" ];
+  ldflags =
+    [ "-s" "-w" "-X github.com/stern/stern/cmd.version=${version}" ];
 
   postInstall =
     let stern = if isCrossBuild then buildPackages.stern else "$out";
diff --git a/pkgs/applications/networking/cluster/tanka/default.nix b/pkgs/applications/networking/cluster/tanka/default.nix
index bf11b35d71aa..6aee37c57ed4 100644
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/tk" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -extldflags \"-static\" -X github.com/grafana/tanka/pkg/tanka.CURRENT_VERSION=v${version}" ];
+  ldflags = [ "-s" "-w" "-extldflags '-static'" "-X github.com/grafana/tanka/pkg/tanka.CURRENT_VERSION=v${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index d717bd42652b..b4e44a05d82e 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/tilt" ];
 
-  buildFlagsArray = [ "-ldflags=-X main.version=${version}" ];
+  ldflags = [ "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "Local development tool to manage your developer instance when your team deploys to Kubernetes in production";
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index 80d02eb19ed2..2c7300573c74 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -14,12 +14,11 @@ buildGoModule rec {
     sha256 = "sha256-oFDTjpcwlvSiAROG/EKYRCD+qKyZXu1gKotBcD0dfvk=";
   };
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X github.com/vmware-tanzu/velero/pkg/buildinfo.Version=${version}
-      -X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=${commit}
-      -X github.com/vmware-tanzu/velero/pkg/buildinfo.GitTreeState=clean
+  ldflags = ''
+    "-s" "-w"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.Version=${version}"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=${commit}"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitTreeState=clean"
   '';
 
   vendorSha256 = "sha256-ypgrdv6nVW+AAwyVsiROXs6jGgDTodGrGqiT2s5elOU=";
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 494a40c6bfe0..d767a381ea49 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-s -w" ];
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index 025c58a9383d..4c0f9c1a0fb3 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "NextDNS DNS/53 to DoH Proxy";
diff --git a/pkgs/applications/networking/shellhub-agent/default.nix b/pkgs/applications/networking/shellhub-agent/default.nix
index aa5175fca9ed..ae2dee21fb26 100644
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   vendorSha256 = "18z3vwcwkyj6hcvl35qmj034237h9l18dvcbx1hxry7qdwv807c9";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.AgentVersion=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 
   passthru = {
     updateScript = genericUpdater {
diff --git a/pkgs/applications/version-management/git-and-tools/ghorg/default.nix b/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
index 74f644e23ad2..6a765f8e8b52 100644
--- a/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "Quickly clone an entire org/users repositories into one directory";
diff --git a/pkgs/applications/version-management/git-and-tools/ghq/default.nix b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
index 28020f85369d..b2f5346bbfce 100644
--- a/pkgs/applications/version-management/git-and-tools/ghq/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
@@ -15,10 +15,9 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X=main.Version=${version}
-  '';
+  ldflags = [
+    "-X=main.Version=${version}"
+  ];
 
   postInstall = ''
     install -m 444 -D ${src}/misc/zsh/_ghq $out/share/zsh/site-functions/_ghq
diff --git a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
index a90390ddd3b3..c08e68cc28a1 100644
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@@ -16,12 +16,11 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X github.com/MichaelMure/git-bug/commands.GitCommit=${rev}
-      -X github.com/MichaelMure/git-bug/commands.GitLastTag=${version}
-      -X github.com/MichaelMure/git-bug/commands.GitExactTag=${version}
-  '';
+  ldflags = [
+    "-X github.com/MichaelMure/git-bug/commands.GitCommit=${rev}"
+    "-X github.com/MichaelMure/git-bug/commands.GitLastTag=${version}"
+    "-X github.com/MichaelMure/git-bug/commands.GitExactTag=${version}"
+  ];
 
   postInstall = ''
     install -D -m 0644 misc/bash_completion/git-bug "$out/share/bash-completion/completions/git-bug"
diff --git a/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix b/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
index 19de4b28bfea..143ab6cac9db 100644
--- a/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-jIq+oacyT71m78iMZwWOBsBVAY/WxgyH9zRr8GiMGTU=";
 
-  buildFlagsArray = [ "-ldflags= -s -w -X=main.Version=v${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.Version=v${version}" ];
 
   subPackages = [ "cmd/git-chglog" ];
 
@@ -24,4 +24,3 @@ buildGoModule rec {
     maintainers = with maintainers; [ ldenefle ];
   };
 }
-
diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
index a373d3dbf897..63f42963089a 100644
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   postInstall = ''
     wrapProgram $out/bin/lab --prefix PATH ":" "${lib.makeBinPath [ git xdg-utils ]}";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index ffd6ff7d16c8..46caac00c4fa 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-gTObI0pmRUX6Eh5FVdt+5LbckyBuFq1Ly4oPZztazHQ=";
   buildInputs = [ git ];
-  buildFlagsArray = "-ldflags=-X main.Version=${version}";
+  ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/applications/video/go-chromecast/default.nix b/pkgs/applications/video/go-chromecast/default.nix
index 5b0ddf717362..7c0894ee06d8 100644
--- a/pkgs/applications/video/go-chromecast/default.nix
+++ b/pkgs/applications/video/go-chromecast/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-idxElk4Sy7SE9G1OMRw8YH4o8orBa80qhBXPA+ar620=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev} -X main.date=unknown" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" "-X main.date=unknown" ];
 
   meta = with lib; {
     homepage = "https://github.com/vishen/go-chromecast";
diff --git a/pkgs/applications/virtualization/imgcrypt/default.nix b/pkgs/applications/virtualization/imgcrypt/default.nix
index c985632b9ebc..ce12fb8f387b 100644
--- a/pkgs/applications/virtualization/imgcrypt/default.nix
+++ b/pkgs/applications/virtualization/imgcrypt/default.nix
@@ -11,8 +11,8 @@ buildGoModule rec {
     sha256 = "177fs3p2xzwjsffcxqqllx6wi6ghfyqbvfgn95v3q7a2993yqk4k";
   };
 
-  buildFlagsArray = [
-    "-ldflags=-X github.com/containerd/containerd/version.Version=${version}"
+  ldflags = [
+    "-X github.com/containerd/containerd/version.Version=${version}"
   ];
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix b/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
index 4276f71a409b..8cb470d2fa4c 100644
--- a/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
+++ b/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
   };
 
   vendorSha256 = "17zpiyvf22skfcisflsp6pn56y6a793jcx89kw976fq2x5br1bz7";
-  buildFlagsArray = [ "-ldflags=" "-s -w" ];
+  ldflags = [ "-s" "-w" ];
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
diff --git a/pkgs/development/embedded/arduino/arduino-cli/default.nix b/pkgs/development/embedded/arduino/arduino-cli/default.nix
index 84c39dba9000..8fd4cf0a35ae 100644
--- a/pkgs/development/embedded/arduino/arduino-cli/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-cli/default.nix
@@ -19,8 +19,8 @@ let
 
     doCheck = false;
 
-    buildFlagsArray = [
-      "-ldflags=-s -w -X github.com/arduino/arduino-cli/version.versionString=${version} -X github.com/arduino/arduino-cli/version.commit=unknown"
+    ldflags = [
+      "-s" "-w" "-X github.com/arduino/arduino-cli/version.versionString=${version}" "-X github.com/arduino/arduino-cli/version.commit=unknown"
     ] ++ lib.optionals stdenv.isLinux [ "-extldflags '-static'" ];
 
     meta = with lib; {
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index d2de1bcc063b..00852a4c90f1 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.BazeliskVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.BazeliskVersion=${version}" ];
 
   meta = with lib; {
     description = "A user-friendly launcher for Bazel";
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index e181917c417a..4ff5c39fac67 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   excludedPackages = [ "generatetables" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.buildVersion=${version} -X main.buildScmRevision=${src.rev}" ];
+  ldflags = [ "-s" "-w" "-X main.buildVersion=${version}" "-X main.buildScmRevision=${src.rev}" ];
 
   meta = with lib; {
     description = "Tools for working with Google's bazel buildtool. Includes buildifier, buildozer, and unused_deps";
diff --git a/pkgs/development/tools/build-managers/mage/default.nix b/pkgs/development/tools/build-managers/mage/default.nix
index d8ccd3ad2fe0..cf719f2c0ca1 100644
--- a/pkgs/development/tools/build-managers/mage/default.nix
+++ b/pkgs/development/tools/build-managers/mage/default.nix
@@ -15,8 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-X github.com/magefile/mage/mage.commitHash=v${version}"
     "-X github.com/magefile/mage/mage.gitTag=v${version}"
     "-X github.com/magefile/mage/mage.timestamp=1970-01-01T00:00:00Z"
diff --git a/pkgs/development/tools/buildpack/default.nix b/pkgs/development/tools/buildpack/default.nix
index 0f31f7b1b37d..a3e1b093e7b0 100644
--- a/pkgs/development/tools/buildpack/default.nix
+++ b/pkgs/development/tools/buildpack/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/pack" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/buildpacks/pack.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/buildpacks/pack.Version=${version}" ];
 
   postInstall = ''
     installShellCompletion --bash --name pack.bash $(PACK_HOME=$PWD $out/bin/pack completion --shell bash)
diff --git a/pkgs/development/tools/butane/default.nix b/pkgs/development/tools/butane/default.nix
index ccb011360e5b..094aa5fe026c 100644
--- a/pkgs/development/tools/butane/default.nix
+++ b/pkgs/development/tools/butane/default.nix
@@ -19,9 +19,9 @@ buildGoModule rec {
 
   subPackages = [ "internal" ];
 
-  buildFlagsArray = ''
-    -ldflags=-X github.com/coreos/butane/internal/version.Raw=v${version}
-  '';
+  ldflags = [
+    "-X github.com/coreos/butane/internal/version.Raw=v${version}"
+  ];
 
   postInstall = ''
     mv $out/bin/{internal,butane}
diff --git a/pkgs/development/tools/cloud-nuke/default.nix b/pkgs/development/tools/cloud-nuke/default.nix
index aa6472494733..2979ae9f5d1c 100644
--- a/pkgs/development/tools/cloud-nuke/default.nix
+++ b/pkgs/development/tools/cloud-nuke/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-C9UGpm8JBLQpSFQkvib5Bmn3J88LxUNt4ELJXL4ZQ80=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 1ba8cb0a9d3d..74e823ad9b84 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -15,8 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X github.com/open-policy-agent/conftest/internal/commands.version=${version}"
diff --git a/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
index 73aefdd0cda7..4604cca7cfc8 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/bk" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 
   meta = with lib; {
     description = "A command line interface for Buildkite";
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 741bcfbe5a87..0b000b0f4d83 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -17,10 +17,9 @@ buildGoModule rec {
 
   subPackages = [ "fly" ];
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X github.com/concourse/concourse.Version=${version}
-  '';
+  ldflags = [
+    "-X github.com/concourse/concourse.Version=${version}"
+  ];
 
   postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     mkdir -p $out/share/{bash-completion/completions,zsh/site-functions}
diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index 5170297a4330..f177ced3092d 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -16,8 +16,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/cue" ];
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X cuelang.org/go/cmd/cue/cmd.version=${version}"
+  ldflags = [
+    "-s" "-w" "-X cuelang.org/go/cmd/cue/cmd.version=${version}"
   ];
 
   meta = {
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index 3b04c0fb8992..581b0db3b35a 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   buildInputs = lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "A tool for exploring each layer in a docker image";
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index aa1de8acd583..53da9c1fb4ef 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -13,12 +13,11 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-gydhh/EMSuE/beo+A2CRDdDnQGT6DMjMwthylT339I4=";
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X main.Version=v${version}
-      -X main.DefaultBuildkitdImage=earthly/buildkitd:v${version}
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X main.Version=v${version}"
+    "-X main.DefaultBuildkitdImage=earthly/buildkitd:v${version}"
+  ];
 
   BUILDTAGS = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork";
   preBuild = ''
diff --git a/pkgs/development/tools/fission/default.nix b/pkgs/development/tools/fission/default.nix
index a87b20402d95..0151a6fb38ba 100644
--- a/pkgs/development/tools/fission/default.nix
+++ b/pkgs/development/tools/fission/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-1ujJuhK7pm/A1Dd+Wm9dtc65mx9pwLBWMWwEJnbja8s=";
 
-  buildFlagsArray = "-ldflags=-s -w -X info.Version=${version}";
+  ldflags = [ "-s" "-w" "-X info.Version=${version}" ];
 
   subPackages = [ "cmd/fission-cli" ];
 
diff --git a/pkgs/development/tools/github/bump/default.nix b/pkgs/development/tools/github/bump/default.nix
index 791b8b7aa916..3531926e4bc4 100644
--- a/pkgs/development/tools/github/bump/default.nix
+++ b/pkgs/development/tools/github/bump/default.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags=-X main.buildVersion=${version} -X main.buildCommit=${version} -X main.buildDate=1970-01-01"
+  ldflags = [
+    "-X main.buildVersion=${version}" "-X main.buildCommit=${version}" "-X main.buildDate=1970-01-01"
   ];
 
   meta = with lib; {
@@ -26,4 +26,3 @@ buildGoModule rec {
     maintainers = with maintainers; [ doronbehar ];
   };
 }
-
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index 60f53e1e253c..1ec03ed2a69d 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -11,8 +11,8 @@ buildGoModule rec {
     sha256 = "sha256-l+ngvmTb9yVgQYT+OeaVd0zz/xNZeXWrjMpVkMpbQIw=";
   };
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.version=${version}"
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}"
   ];
 
   vendorSha256 = "sha256-hn222ifKRYbASAHBJyMTCDwhykf2Jg9IqIUlK/GabJA=";
diff --git a/pkgs/development/tools/go-swagger/default.nix b/pkgs/development/tools/go-swagger/default.nix
index 2147ed00c77c..20c2a2b9e991 100644
--- a/pkgs/development/tools/go-swagger/default.nix
+++ b/pkgs/development/tools/go-swagger/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/swagger" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/go-swagger/go-swagger/cmd/swagger/commands.Version=${version} -X github.com/go-swagger/go-swagger/cmd/swagger/commands.Commit=${src.rev}" ];
+  ldflags = [ "-s" "-w" "-X github.com/go-swagger/go-swagger/cmd/swagger/commands.Version=${version}" "-X github.com/go-swagger/go-swagger/cmd/swagger/commands.Commit=${src.rev}" ];
 
   meta = with lib; {
     description = "Golang implementation of Swagger 2.0, representation of your RESTful API";
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index c1cff6562f23..4c7d20bb74b9 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -17,8 +17,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/task" ];
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.version=${version}"
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}"
   ];
 
   postInstall = ''
diff --git a/pkgs/development/tools/gomplate/default.nix b/pkgs/development/tools/gomplate/default.nix
index 45602a053522..10f853a65237 100644
--- a/pkgs/development/tools/gomplate/default.nix
+++ b/pkgs/development/tools/gomplate/default.nix
@@ -19,8 +19,7 @@ buildGoModule rec {
     rm net/net_test.go
   '';
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X github.com/${owner}/${pname}/v3/version.Version=${rev}"
diff --git a/pkgs/development/tools/gosec/default.nix b/pkgs/development/tools/gosec/default.nix
index 9264ac27fa2a..9f9bb882de08 100644
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version} -X main.GitTag=${src.rev} -X main.BuildDate=unknown" ];
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" "-X main.GitTag=${src.rev}" "-X main.BuildDate=unknown" ];
 
   meta = with lib; {
     homepage = "https://github.com/securego/gosec";
@@ -27,4 +27,3 @@ buildGoModule rec {
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
-
diff --git a/pkgs/development/tools/gotestsum/default.nix b/pkgs/development/tools/gotestsum/default.nix
index 1e63b07d03ed..161aba5d68f6 100644
--- a/pkgs/development/tools/gotestsum/default.nix
+++ b/pkgs/development/tools/gotestsum/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index fe3dfb9a34c8..f77e3832fe78 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/hetznercloud/cli/cli.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/hetznercloud/cli/cli.Version=${version}" ];
 
   postInstall = ''
     for shell in bash zsh; do
diff --git a/pkgs/development/tools/jsonnet-bundler/default.nix b/pkgs/development/tools/jsonnet-bundler/default.nix
index 4286a454ff02..87da63f0f354 100644
--- a/pkgs/development/tools/jsonnet-bundler/default.nix
+++ b/pkgs/development/tools/jsonnet-bundler/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/jb" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
 
   meta = with lib; {
     description = "A jsonnet package manager";
diff --git a/pkgs/development/tools/kubepug/default.nix b/pkgs/development/tools/kubepug/default.nix
index 639e72edb8c1..df619086861d 100644
--- a/pkgs/development/tools/kubepug/default.nix
+++ b/pkgs/development/tools/kubepug/default.nix
@@ -13,9 +13,9 @@ buildGoModule rec {
 
   vendorSha256 = "0jzry4znq4kcl6i9jcawilyjm8av1zxbml6nlr96v8x47ijxav5j";
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X=github.com/rikatz/kubepug/version.Version=${src.rev}
-  '';
+  ldflags = [
+    "-s" "-w" "-X=github.com/rikatz/kubepug/version.Version=${src.rev}"
+  ];
 
   subPackages = [ "cmd/kubepug.go" ];
 
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index cae13140b04f..36c425aef18f 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -6,12 +6,12 @@ buildGoModule rec {
   # rev is the commit of the tag, mainly for kustomize version command output
   rev = "9e8e7a7fe99ec9fbf801463e8607928322fc5245";
 
-  buildFlagsArray = let t = "sigs.k8s.io/kustomize/api/provenance"; in
-    ''
-      -ldflags=
-        -s -X ${t}.version=${version}
-           -X ${t}.gitCommit=${rev}
-    '';
+  ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
+    [
+      "-s"
+      "-X ${t}.version=${version}"
+      "-X ${t}.gitCommit=${rev}"
+    ];
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index c7e3a1fabdc9..21d9f9903d26 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   vendorSha256 = null;
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-X main.version=${version} -X main.buildSource=nix" ];
+  ldflags = [ "-X main.version=${version}" "-X main.buildSource=nix" ];
 
   meta = with lib; {
     description = "Simple terminal UI for git commands";
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 890229ebc815..6ce86c44d7f9 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/CircleCI-Public/circleci-cli/version.Version=${version} -X github.com/CircleCI-Public/circleci-cli/version.Commit=${src.rev} -X github.com/CircleCI-Public/circleci-cli/version.packageManager=nix" ];
+  ldflags = [ "-s" "-w" "-X github.com/CircleCI-Public/circleci-cli/version.Version=${version}" "-X github.com/CircleCI-Public/circleci-cli/version.Commit=${src.rev}" "-X github.com/CircleCI-Public/circleci-cli/version.packageManager=nix" ];
 
   preBuild = ''
     substituteInPlace data/data.go \
diff --git a/pkgs/development/tools/misc/k2tf/default.nix b/pkgs/development/tools/misc/k2tf/default.nix
index 904256ee66a9..bc24d4563a5c 100644
--- a/pkgs/development/tools/misc/k2tf/default.nix
+++ b/pkgs/development/tools/misc/k2tf/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "1c2mwhrj0xapc661z1nb6am4qq3rd1pvbvjaxikjyx95n0gs8gjk";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=v${version}" ];
 
   meta = with lib; {
     description = "Kubernetes YAML to Terraform HCL converter";
diff --git a/pkgs/development/tools/misc/mkcert/default.nix b/pkgs/development/tools/misc/mkcert/default.nix
index 0f110ae0b082..bfd551570090 100644
--- a/pkgs/development/tools/misc/mkcert/default.nix
+++ b/pkgs/development/tools/misc/mkcert/default.nix
@@ -15,9 +15,9 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X main.Version=v${version}
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.Version=v${version}"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/FiloSottile/mkcert";
diff --git a/pkgs/development/tools/misc/reviewdog/default.nix b/pkgs/development/tools/misc/reviewdog/default.nix
index 075698ac43dc..b39ab68f06c0 100644
--- a/pkgs/development/tools/misc/reviewdog/default.nix
+++ b/pkgs/development/tools/misc/reviewdog/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/reviewdog" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/reviewdog/reviewdog/commands.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/reviewdog/reviewdog/commands.Version=${version}" ];
 
   meta = with lib; {
     description = "Automated code review tool integrated with any code analysis tools regardless of programming language";
diff --git a/pkgs/development/tools/misc/terracognita/default.nix b/pkgs/development/tools/misc/terracognita/default.nix
index 1d33f5929bbf..c10543e17689 100644
--- a/pkgs/development/tools/misc/terracognita/default.nix
+++ b/pkgs/development/tools/misc/terracognita/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/cycloidio/terracognita/cmd.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/cycloidio/terracognita/cmd.Version=${version}" ];
 
   meta = with lib; {
     description = "Reads from existing Cloud Providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration";
diff --git a/pkgs/development/tools/renderizer/default.nix b/pkgs/development/tools/renderizer/default.nix
index 18d5cae542cc..d9987137ce65 100644
--- a/pkgs/development/tools/renderizer/default.nix
+++ b/pkgs/development/tools/renderizer/default.nix
@@ -11,8 +11,8 @@ buildGoModule rec {
     sha256 = "sha256-jl98LuEsGN40L9IfybJhLnbzoYP/XpwFVQnjrlmDL9A=";
   };
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.version=${version} -X main.commitHash=${src.rev} -X main.date=19700101T000000"
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}" "-X main.commitHash=${src.rev}" "-X main.date=19700101T000000"
   ];
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 2490c3a3ce27..dcacd997d7de 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -15,13 +15,12 @@ buildGoModule rec {
 
   subPackages = ["cmd/skaffold"];
 
-  buildFlagsArray = let t = "github.com/GoogleContainerTools/skaffold/pkg/skaffold"; in  ''
-    -ldflags=
-      -s -w
-      -X ${t}/version.version=v${version}
-      -X ${t}/version.gitCommit=${src.rev}
-      -X ${t}/version.buildDate=unknown
-  '';
+  ldflags = let t = "github.com/GoogleContainerTools/skaffold/pkg/skaffold"; in [
+    "-s" "-w"
+    "-X ${t}/version.version=v${version}"
+    "-X ${t}/version.gitCommit=${src.rev}"
+    "-X ${t}/version.buildDate=unknown"
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/tf2pulumi/default.nix b/pkgs/development/tools/tf2pulumi/default.nix
index 8a1a03c16359..6f195d86849a 100644
--- a/pkgs/development/tools/tf2pulumi/default.nix
+++ b/pkgs/development/tools/tf2pulumi/default.nix
@@ -13,9 +13,9 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-wsgNrDnFXbpanEULEjf6OxOeMYmWzjE7vpVUB/UFNp8=";
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X=github.com/pulumi/tf2pulumi/version.Version=${src.rev}
-  '';
+  ldflags = [
+    "-s" "-w" "-X=github.com/pulumi/tf2pulumi/version.Version=${src.rev}"
+  ];
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/yj/default.nix b/pkgs/development/tools/yj/default.nix
index 303f325dec18..017434134ca1 100644
--- a/pkgs/development/tools/yj/default.nix
+++ b/pkgs/development/tools/yj/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "0y0n9fsb85qlpf9slwsxzarmfi98asa4x04qp2r8pagl28l0i8wv";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
 
   meta = with lib; {
     description = "Convert YAML <=> TOML <=> JSON <=> HCL";
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 71db0f89cd73..c222d5232bac 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/superfly/flyctl/flyctl.Version=${version} -X github.com/superfly/flyctl/flyctl.Commit=${src.rev} -X github.com/superfly/flyctl/flyctl.BuildDate=1970-01-01T00:00:00+0000 -X github.com/superfly/flyctl/flyctl.Environment=production" ];
+  ldflags = [ "-s" "-w" "-X github.com/superfly/flyctl/flyctl.Version=${version}" "-X github.com/superfly/flyctl/flyctl.Commit=${src.rev}" "-X github.com/superfly/flyctl/flyctl.BuildDate=1970-01-01T00:00:00+0000" "-X github.com/superfly/flyctl/flyctl.Environment=production" ];
 
   meta = with lib; {
     description = "Command line tools for fly.io services";
diff --git a/pkgs/development/web/minify/default.nix b/pkgs/development/web/minify/default.nix
index ac040d0a9156..31c6ba9253bb 100644
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
 
   meta = with lib; {
     description = "Minifiers for web formats";
diff --git a/pkgs/os-specific/darwin/smimesign/default.nix b/pkgs/os-specific/darwin/smimesign/default.nix
index 6b7e38891619..d50e00f984e5 100644
--- a/pkgs/os-specific/darwin/smimesign/default.nix
+++ b/pkgs/os-specific/darwin/smimesign/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "1cldxykm9qj5rvyfafam45y5xj4f19700s2f9w7ndhxgfp9vahvz";
 
-  buildFlagsArray = "-ldflags=-X main.versionString=v${version}";
+  ldflags = [ "-X main.versionString=v${version}" ];
 
   meta = with lib; {
     description = "An S/MIME signing utility for macOS and Windows that is compatible with Git";
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index 8d75b89d0d8a..b10f8919af7a 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -33,12 +33,11 @@ buildGoModule rec {
 
   buildInputs = [ bzip2 lz4 rocksdb snappy zeromq zlib ];
 
-  buildFlagsArray = ''
-    -ldflags=
-       -X github.com/trezor/blockbook/common.version=${version}
-       -X github.com/trezor/blockbook/common.gitcommit=${commit}
-       -X github.com/trezor/blockbook/common.buildDate=unknown
-  '';
+  ldflags = [
+    "-X github.com/trezor/blockbook/common.version=${version}"
+    "-X github.com/trezor/blockbook/common.gitcommit=${commit}"
+    "-X github.com/trezor/blockbook/common.buildDate=unknown"
+  ];
 
   preBuild = lib.optionalString stdenv.isDarwin ''
     ulimit -n 8192
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 9d577047ee21..0f4282699ee2 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -17,8 +17,8 @@ buildGoModule rec {
     "cmd/dex"
   ];
 
-  buildFlagsArray = [
-    "-ldflags=-w -s -X github.com/dexidp/dex/version.Version=${src.rev}"
+  ldflags = [
+    "-w" "-s" "-X github.com/dexidp/dex/version.Version=${src.rev}"
   ];
 
   postInstall = ''
diff --git a/pkgs/servers/hasura/cli.nix b/pkgs/servers/hasura/cli.nix
index 4338f1bcaed8..a65d4bb38234 100644
--- a/pkgs/servers/hasura/cli.nix
+++ b/pkgs/servers/hasura/cli.nix
@@ -13,11 +13,11 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [''-ldflags=
-    -X github.com/hasura/graphql-engine/cli/version.BuildVersion=${version}
-    -s
-    -w
-  ''];
+  ldflags = [
+    "-X github.com/hasura/graphql-engine/cli/version.BuildVersion=${version}"
+    "-s"
+    "-w"
+  ];
 
   postInstall = ''
     mkdir -p $out/share/{bash-completion/completions,zsh/site-functions}
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index ea9628417d7d..7b28200b284e 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
     "cmd/pomerium-cli"
   ];
 
-  buildFlagsArray = let
+  ldflags = let
     # Set a variety of useful meta variables for stamping the build with.
     setVars = {
       Version = "v${version}";
@@ -35,7 +35,7 @@ buildGoModule rec {
     };
     varFlags = concatStringsSep " " (mapAttrsToList (name: value: "-X github.com/pomerium/pomerium/internal/version.${name}=${value}") setVars);
   in [
-    "-ldflags=${varFlags}"
+    "${varFlags}"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/maddy/default.nix b/pkgs/servers/maddy/default.nix
index bc6071bff0d2..c5fa1b5e670a 100644
--- a/pkgs/servers/maddy/default.nix
+++ b/pkgs/servers/maddy/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-bxKEQaOubjRfLX+dMxVDzLOUInHykUdy9X8wvFE6Va4=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/foxcpp/maddy.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/foxcpp/maddy.Version=${version}" ];
 
   subPackages = [ "cmd/maddy" "cmd/maddyctl" ];
 
diff --git a/pkgs/servers/matrix-corporal/default.nix b/pkgs/servers/matrix-corporal/default.nix
index e489e774be5e..ae455168778f 100644
--- a/pkgs/servers/matrix-corporal/default.nix
+++ b/pkgs/servers/matrix-corporal/default.nix
@@ -11,8 +11,8 @@ buildGoModule rec {
     sha256 = "sha256-u1ppwy+t2ewAH0/+R6e0Ja5A3PQG/lUy2b6kgcMVj8E=";
   };
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.GitCommit=${version} -X main.GitBranch=${version} -X main.GitState=nixpkgs -X main.GitSummary=${version} -X main.Version=${version}"
+  ldflags = [
+    "-s" "-w" "-X main.GitCommit=${version}" "-X main.GitBranch=${version}" "-X main.GitState=nixpkgs" "-X main.GitSummary=${version}" "-X main.Version=${version}"
   ];
 
   vendorSha256 = "sha256-YmUiGsg2UZfV6SHEPwnbmWPhGQ5teV+we9MBaJyrJr4=";
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index f66468b240f8..fe61e5fc8b84 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -22,9 +22,9 @@ in buildGoModule {
     go test $(go list ./... | grep -v client)
   ''; # skip client tests as they require network access
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X miniflux.app/version.Version=${version}
-  '';
+  ldflags = [
+    "-s" "-w" "-X miniflux.app/version.Version=${version}"
+  ];
 
   postInstall = ''
     mv $out/bin/miniflux.app $out/bin/miniflux
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index 0a09293226ed..75bc9f8e6088 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -17,10 +17,9 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  buildFlagsArray = ''
-    -ldflags=
-    -s -w -extldflags '-static'
-  '';
+  ldflags = [
+    "-s" "-w" "-extldflags '-static'"
+  ];
 
   subPackages = [ "cmd/gobgpd" ];
 
diff --git a/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix b/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
index f5d4f6ca88f3..5a2fcc4a8976 100644
--- a/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
+++ b/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-VLG15IXS/fXFMTCJKEqGW6qZ9aOLPhazidVsOywG+w4=";
 
-  buildFlagsArray = [ "-ldflags=-s -w" ];
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Alertmanager IRC Relay is a bot relaying Prometheus alerts to IRC";
diff --git a/pkgs/servers/monitoring/cadvisor/default.nix b/pkgs/servers/monitoring/cadvisor/default.nix
index 8501aa5e02cd..2db3cd084470 100644
--- a/pkgs/servers/monitoring/cadvisor/default.nix
+++ b/pkgs/servers/monitoring/cadvisor/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-FMO+wNmjFFD9+/9mhNcyZftk8ryhwFXDZeEy/h5EMWc=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/google/cadvisor/version.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/google/cadvisor/version.Version=${version}" ];
 
   postInstall = ''
     mv $out/bin/{cmd,cadvisor}
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index d6e3accdf41d..5f70bf702a6b 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -11,10 +11,9 @@ buildGoModule rec {
     sha256 = "sha256-boEgCC3uWvJvb6VKpNhh6vHCfeE7oun5oneI2ITKh9g=";
   };
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X main.version=${version}
-  '';
+  ldflags = [
+    "-X main.version=${version}"
+  ];
 
   vendorSha256 = null;
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 56f8b30fbb44..996637f51b9e 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -43,9 +43,9 @@ buildGoModule rec {
     rm -r scripts/go
   '';
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X main.version=${version}
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}"
+  ];
 
   postInstall = ''
     tar -xvf $srcStatic
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index d8987f9e5adc..21776c352af1 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -19,11 +19,10 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = ''
-    -ldflags=
-    -X=main.version=${version}
-    -X=main.gitcommit=v${version}
-  '';
+  ldflags = [
+    "-X=main.version=${version}"
+    "-X=main.gitcommit=v${version}"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/mackerel-agent \
diff --git a/pkgs/servers/monitoring/mtail/default.nix b/pkgs/servers/monitoring/mtail/default.nix
index c0a7e1129a14..e5a3179a86c0 100644
--- a/pkgs/servers/monitoring/mtail/default.nix
+++ b/pkgs/servers/monitoring/mtail/default.nix
@@ -21,8 +21,8 @@ buildGoModule rec {
     go generate -x ./internal/vm/
   '';
 
-  buildFlagsArray = [
-    "-ldflags=-X main.Version=${version}"
+  ldflags = [
+    "-X main.Version=${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
index 5e7d386d7e1c..a91a267bb210 100644
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@@ -16,14 +16,13 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = ''
-     -ldflags=
-      -s -w
-      -X github.com/prometheus/common/version.Version=${version}
-      -X github.com/prometheus/common/version.Revision=${rev}
-      -X github.com/prometheus/common/version.Branch=master
-      -X github.com/prometheus/common/version.BuildDate=19700101-00:00:00
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/prometheus/common/version.Version=${version}"
+    "-X github.com/prometheus/common/version.Revision=${rev}"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.BuildDate=19700101-00:00:00"
+  ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) artifactory; };
 
diff --git a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
index e31800f43c0e..894fbd1ab3f1 100644
--- a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
@@ -14,14 +14,14 @@ buildGoModule rec {
 
   vendorSha256 = "19785rfzlx8h0h8vmg0ghd40h3p4y6ikhgf8rd2qfj5f6qxfhrgv";
 
-  buildFlagsArray = let t = "github.com/prometheus/common/version"; in ''
-    -ldflags=
-        -s -w -X ${t}.Version=${version}
-        -X ${t}.Revision=${rev}
-        -X ${t}.Branch=unknown
-        -X ${t}.BuildUser=nix@nixpkgs
-        -X ${t}.BuildDate=unknown
-  '';
+  ldflags = let t = "github.com/prometheus/common/version"; in [
+    "-s" "-w"
+    "-X ${t}.Version=${version}"
+    "-X ${t}.Revision=${rev}"
+    "-X ${t}.Branch=unknown"
+    "-X ${t}.BuildUser=nix@nixpkgs"
+    "-X ${t}.BuildDate=unknown"
+  ];
 
   # skips tests with external dependencies, e.g. on mysqld
   checkFlags = [ "-short" ];
diff --git a/pkgs/servers/monitoring/prometheus/promscale.nix b/pkgs/servers/monitoring/prometheus/promscale.nix
index 0727616de311..546bfbb7e28c 100644
--- a/pkgs/servers/monitoring/prometheus/promscale.nix
+++ b/pkgs/servers/monitoring/prometheus/promscale.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-DFDTYT7UK1cYwGeCgeQcJmrCoqGPDzicusRPPUbH0Gs=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/timescale/promscale/pkg/version.Version=${version} -X github.com/timescale/promscale/pkg/version.CommitHash=${src.rev}" ];
+  ldflags = [ "-s" "-w" "-X github.com/timescale/promscale/pkg/version.Version=${version}" "-X github.com/timescale/promscale/pkg/version.CommitHash=${src.rev}" ];
 
   doCheck = false; # Requires access to a docker daemon
   doInstallCheck = true;
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index a2636d9f7147..d209f52ef585 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -13,11 +13,10 @@ buildGoModule rec {
 
   vendorSha256 = "11237959ikd7l5glkhfz0g55mbld2hq985b5crwb9bnimaly5lga";
 
-  buildFlagsArray = ''
-    -ldflags=
-       -X main.BuildVersion=${version}
-       -X main.BuildCommitSha=unknown
-       -X main.BuildDate=unknown
+  ldflags = ''
+    "-X main.BuildVersion=${version}"
+    "-X main.BuildCommitSha=unknown"
+    "-X main.BuildDate=unknown"
   '';
 
   # needs a redis server
diff --git a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
index b998e1d24c6c..8b1cbb962ade 100644
--- a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
+++ b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
   pname = "smokeping_prober";
   version = "${baseVersion}-g${commit}";
 
-  buildFlagsArray = let
+  ldflags = let
     setVars = {
       Version = baseVersion;
       Revision = commit;
@@ -17,7 +17,7 @@ buildGoModule rec {
     };
     varFlags = lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "-X github.com/prometheus/common/version.${name}=${value}") setVars);
   in [
-    "-ldflags=${varFlags} -s -w"
+    "${varFlags}" "-s" "-w"
   ];
 
   src = fetchFromGitHub {
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index 881d677b3e59..23294dfb88c4 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -20,13 +20,12 @@ let
 
   doCheck = false;
 
-      buildFlagsArray = let
+      ldflags = let
         versionPkg = "github.com/sensu/sensu-go/version";
-      in ''
-        -ldflags=
-          -X ${versionPkg}.Version=${version}
-          -X ${versionPkg}.BuildSHA=${shortRev}
-      '';
+      in [
+        "-X ${versionPkg}.Version=${version}"
+        "-X ${versionPkg}.BuildSHA=${shortRev}"
+      ];
 
       meta = {
         homepage = "https://sensu.io";
diff --git a/pkgs/servers/monitoring/thanos/default.nix b/pkgs/servers/monitoring/thanos/default.nix
index 03811314f456..fef179945b38 100644
--- a/pkgs/servers/monitoring/thanos/default.nix
+++ b/pkgs/servers/monitoring/thanos/default.nix
@@ -16,14 +16,13 @@ buildGoModule rec {
 
   subPackages = "cmd/thanos";
 
-  buildFlagsArray = let t = "github.com/prometheus/common/version"; in ''
-    -ldflags=
-       -X ${t}.Version=${version}
-       -X ${t}.Revision=unknown
-       -X ${t}.Branch=unknown
-       -X ${t}.BuildUser=nix@nixpkgs
-       -X ${t}.BuildDate=unknown
-  '';
+  ldflags = let t = "github.com/prometheus/common/version"; in [
+    "-X ${t}.Version=${version}"
+    "-X ${t}.Revision=unknown"
+    "-X ${t}.Branch=unknown"
+    "-X ${t}.BuildUser=nix@nixpkgs"
+    "-X ${t}.BuildDate=unknown"
+  ];
 
   meta = with lib; {
     description = "Highly available Prometheus setup with long term storage capabilities";
diff --git a/pkgs/servers/monitoring/unifi-poller/default.nix b/pkgs/servers/monitoring/unifi-poller/default.nix
index 992a92a2733c..745cfdd34595 100644
--- a/pkgs/servers/monitoring/unifi-poller/default.nix
+++ b/pkgs/servers/monitoring/unifi-poller/default.nix
@@ -13,13 +13,13 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-LOBkdyfsw7ua6TsLglO5jdR9NWo5Df8rnQ8MH+eIz4g=";
 
-  buildFlagsArray = ''
-    -ldflags=-w -s
-      -X github.com/prometheus/common/version.Branch=master
-      -X github.com/prometheus/common/version.BuildDate=unknown
-      -X github.com/prometheus/common/version.Revision=${src.rev}
-      -X github.com/prometheus/common/version.Version=${version}-0
-  '';
+  ldflags = [
+    "-w" "-s"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.BuildDate=unknown"
+    "-X github.com/prometheus/common/version.Revision=${src.rev}"
+    "-X github.com/prometheus/common/version.Version=${version}-0"
+  ];
 
   meta = with lib; {
     description = "Collect ALL UniFi Controller, Site, Device & Client Data - Export to InfluxDB or Prometheus";
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index df3e116ab74a..4f10beda85cc 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   excludedPackages = "test";
 
diff --git a/pkgs/servers/nosql/victoriametrics/default.nix b/pkgs/servers/nosql/victoriametrics/default.nix
index 12ad70375121..4ef8fe9575f2 100644
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo.Version=${version}" ];
 
   passthru.tests = { inherit (nixosTests) victoriametrics; };
 
diff --git a/pkgs/servers/oauth2-proxy/default.nix b/pkgs/servers/oauth2-proxy/default.nix
index a5aee60d8bb1..dfc1756b3746 100644
--- a/pkgs/servers/oauth2-proxy/default.nix
+++ b/pkgs/servers/oauth2-proxy/default.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   vendorSha256 = "sha256-kclpoZ33JOciP2IUCQZB5idA7rgbWxPPFNwZU+pEJFU=";
 
   # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
-  buildFlagsArray = ("-ldflags=-X main.VERSION=${version}");
+  ldflags = [ "-X main.VERSION=${version}" ];
 
   meta = with lib; {
     description = "A reverse proxy that provides authentication with Google, Github, or other providers";
diff --git a/pkgs/servers/pg_featureserv/default.nix b/pkgs/servers/pg_featureserv/default.nix
index fd31d728a3b2..9a4fd071338e 100644
--- a/pkgs/servers/pg_featureserv/default.nix
+++ b/pkgs/servers/pg_featureserv/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "1jqrkx850ghmpnfjhqky93r8fq7q63m5ivs0lzljzbvn7ya75f2r";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/CrunchyData/pg_featureserv/conf.setVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/CrunchyData/pg_featureserv/conf.setVersion=${version}" ];
 
   meta = with lib; {
     description = "Lightweight RESTful Geospatial Feature Server for PostGIS in Go";
diff --git a/pkgs/servers/pg_tileserv/default.nix b/pkgs/servers/pg_tileserv/default.nix
index b7f1fa0c1c9d..a380af0311b3 100644
--- a/pkgs/servers/pg_tileserv/default.nix
+++ b/pkgs/servers/pg_tileserv/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-qdlh9H039GwKTxOhx+dzyUHkzJbaOeuguKnBOyAPe/E=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.programVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.programVersion=${version}" ];
 
   doCheck = false;
 
diff --git a/pkgs/servers/reproxy/default.nix b/pkgs/servers/reproxy/default.nix
index 0d25b4267838..25fb5268c146 100644
--- a/pkgs/servers/reproxy/default.nix
+++ b/pkgs/servers/reproxy/default.nix
@@ -27,8 +27,8 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.revision=${version}"
+  ldflags = [
+    "-s" "-w" "-X main.revision=${version}"
   ];
 
   installPhase = ''
diff --git a/pkgs/servers/rtsp-simple-server/default.nix b/pkgs/servers/rtsp-simple-server/default.nix
index 58b565851236..c6897167cefa 100644
--- a/pkgs/servers/rtsp-simple-server/default.nix
+++ b/pkgs/servers/rtsp-simple-server/default.nix
@@ -19,10 +19,10 @@ buildGoModule rec {
   # Tests need docker
   doCheck = false;
 
-  buildFlagsArray = [
-    # In the future, we might need to switch to `main.Version`, considering:
-    # https://github.com/aler9/rtsp-simple-server/issues/503
-    "-ldflags=-X github.com/aler9/rtsp-simple-server/internal/core.version=v${version}"
+  # In the future, we might need to switch to `main.Version`, considering:
+  # https://github.com/aler9/rtsp-simple-server/issues/503
+  ldflags = [
+    "-X github.com/aler9/rtsp-simple-server/internal/core.version=v${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index 6ef08992f963..0916c9b25b59 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -6,7 +6,7 @@ buildGoModule rec {
 
   excludedPackages = [ "website" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/elves/elvish/pkg/buildinfo.Version==${version} -X github.com/elves/elvish/pkg/buildinfo.Reproducible=true" ];
+  ldflags = [ "-s" "-w" "-X github.com/elves/elvish/pkg/buildinfo.Version==${version}" "-X github.com/elves/elvish/pkg/buildinfo.Reproducible=true" ];
 
   src = fetchFromGitHub {
     owner = "elves";
diff --git a/pkgs/shells/zsh/antibody/default.nix b/pkgs/shells/zsh/antibody/default.nix
index d5c197d5da6e..1db4321259df 100644
--- a/pkgs/shells/zsh/antibody/default.nix
+++ b/pkgs/shells/zsh/antibody/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "The fastest shell plugin manager";
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index c17160152817..afc493c3b6a1 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -34,10 +34,9 @@ buildGoModule rec {
   subPackages = [ "." ];
 
   # set the version. see: aws-vault's Makefile
-  buildFlagsArray = ''
-    -ldflags=
-    -X main.Version=v${version}
-  '';
+  ldflags = [
+    "-X main.Version=v${version}"
+  ];
 
   doInstallCheck = true;
 
diff --git a/pkgs/tools/admin/awsweeper/default.nix b/pkgs/tools/admin/awsweeper/default.nix
index 0ff42ca20fcf..7d1935415ab7 100644
--- a/pkgs/tools/admin/awsweeper/default.nix
+++ b/pkgs/tools/admin/awsweeper/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-1u1mzANLlWduAQF1GUX7BJSyYlSZwNQISqKwbyRlGog=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/jckuester/awsweeper/internal.version=${version} -X github.com/jckuester/awsweeper/internal.commit=${src.rev} -X github.com/jckuester/awsweeper/internal.date=unknown" ];
+  ldflags = [ "-s" "-w" "-X github.com/jckuester/awsweeper/internal.version=${version}" "-X github.com/jckuester/awsweeper/internal.commit=${src.rev}" "-X github.com/jckuester/awsweeper/internal.date=unknown" ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 524970925ddc..d69e96a45551 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-XpLLolxWu9aMp1cyG4dUQk4YtknbIRMmBUdSeyY4PNk=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
 
   meta = with lib; {
     description =
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
index 0c71850f849e..9cfb23ab9daa 100644
--- a/pkgs/tools/admin/credhub-cli/default.nix
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -28,8 +28,7 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X code.cloudfoundry.org/credhub-cli/version.Version=${version}"
diff --git a/pkgs/tools/admin/fioctl/default.nix b/pkgs/tools/admin/fioctl/default.nix
index 6e20a32cf21b..98e68c10fb9d 100644
--- a/pkgs/tools/admin/fioctl/default.nix
+++ b/pkgs/tools/admin/fioctl/default.nix
@@ -15,9 +15,9 @@ buildGoModule rec {
 
   runVend = true;
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X github.com/foundriesio/fioctl/subcommands/version.Commit=${src.rev}
-  '';
+  ldflags = [
+    "-s" "-w" "-X github.com/foundriesio/fioctl/subcommands/version.Commit=${src.rev}"
+  ];
 
   meta = with lib; {
     description = "A simple CLI to manage your Foundries Factory ";
diff --git a/pkgs/tools/admin/iamy/default.nix b/pkgs/tools/admin/iamy/default.nix
index dd35da451ad8..6ee5f3f880bb 100644
--- a/pkgs/tools/admin/iamy/default.nix
+++ b/pkgs/tools/admin/iamy/default.nix
@@ -15,9 +15,9 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [''-ldflags=
-    -X main.Version=v${version} -s -w
-  ''];
+  ldflags = [
+    "-X main.Version=v${version}" "-s" "-w"
+  ];
 
   meta = with lib; {
     description = "A cli tool for importing and exporting AWS IAM configuration to YAML files";
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index 78f4b8cd2cb2..685679467549 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -17,8 +17,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/lego" ];
 
-  buildFlagsArray = [
-    "-ldflags=-X main.version=${version}"
+  ldflags = [
+    "-X main.version=${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/ssmsh/default.nix b/pkgs/tools/admin/ssmsh/default.nix
index 3ed29af25fdc..6c4785c81c59 100644
--- a/pkgs/tools/admin/ssmsh/default.nix
+++ b/pkgs/tools/admin/ssmsh/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = true;
 
-  buildFlagsArray = [ "-ldflags=-w -s -X main.Version=${version}" ];
+  ldflags = [ "-w" "-s" "-X main.Version=${version}" ];
 
   meta = with lib; {
     homepage = "https://github.com/bwhaley/ssmsh";
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index 32f051f5ad91..ad113ed615ef 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -17,11 +17,10 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildFlagsArray = ''
-    -ldflags=
-       -X github.com/kopia/kopia/repo.BuildVersion=${version}
-       -X github.com/kopia/kopia/repo.BuildInfo=${src.rev}
-  '';
+  ldflags = [
+    "-X github.com/kopia/kopia/repo.BuildVersion=${version}"
+    "-X github.com/kopia/kopia/repo.BuildInfo=${src.rev}"
+  ];
 
   meta = with lib; {
     homepage = "https://kopia.io";
diff --git a/pkgs/tools/filesystems/gocryptfs/default.nix b/pkgs/tools/filesystems/gocryptfs/default.nix
index 4d901d688908..29750531db20 100644
--- a/pkgs/tools/filesystems/gocryptfs/default.nix
+++ b/pkgs/tools/filesystems/gocryptfs/default.nix
@@ -37,12 +37,11 @@ buildGoModule rec {
 
   propagatedBuildInputs = [ libfido2 ];
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X main.GitVersion=${version}
-      -X main.GitVersionFuse=[vendored]
-      -X main.BuildDate=unknown
-  '';
+  ldflags = [
+    "-X main.GitVersion=${version}"
+    "-X main.GitVersionFuse=[vendored]"
+    "-X main.BuildDate=unknown"
+  ];
 
   subPackages = [ "." "gocryptfs-xray" "contrib/statfs" ];
 
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index ff9e7a001333..a60a84475b06 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.version=${version} -X main.builtBy=nixpkgs"
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/misc/duf/default.nix b/pkgs/tools/misc/duf/default.nix
index 076eb33fbb19..e95edb08b84a 100644
--- a/pkgs/tools/misc/duf/default.nix
+++ b/pkgs/tools/misc/duf/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "153z0ccd556c0wpnxgyjq7m0c4y2z6fxsqq2p77kly9nr8cpzdb9";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X=main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
   meta = with lib; {
     homepage = "https://github.com/muesli/duf/";
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 35fc8343b5a1..62c184d6be59 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -13,8 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-7I/955dPHV8Rkp6VevkebkZaNtSlbzIsGc8qFjtcMXk=";
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X main.version=${version}"
diff --git a/pkgs/tools/misc/gotify-cli/default.nix b/pkgs/tools/misc/gotify-cli/default.nix
index 36a7055f875c..05a93b44b94e 100644
--- a/pkgs/tools/misc/gotify-cli/default.nix
+++ b/pkgs/tools/misc/gotify-cli/default.nix
@@ -19,8 +19,8 @@ buildGoModule rec {
     mv $out/bin/cli $out/bin/gotify
   '';
 
-  buildFlagsArray = [
-    "-ldflags=-X main.Version=${version} -X main.Commit=${version} -X main.BuildDate=1970-01-01"
+  ldflags = [
+    "-X main.Version=${version}" "-X main.Commit=${version}" "-X main.BuildDate=1970-01-01"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index 8aa8e9a663b7..b135ed061dee 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.gVersion=r${version}" ];
+  ldflags = [ "-s" "-w" "-X main.gVersion=r${version}" ];
 
   postInstall = ''
     install -D --mode=444 lf.desktop $out/share/applications/lf.desktop
diff --git a/pkgs/tools/misc/microplane/default.nix b/pkgs/tools/misc/microplane/default.nix
index 26ae9f4f16db..a44ae344bf59 100644
--- a/pkgs/tools/misc/microplane/default.nix
+++ b/pkgs/tools/misc/microplane/default.nix
@@ -13,9 +13,9 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-PqSjSFTVrIsQ065blIxZ9H/ARku6BEcnjboH+0K0G14=";
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X main.version=${version}
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}"
+  ];
 
   postInstall = ''
     ln -s $out/bin/microplane $out/bin/mp
diff --git a/pkgs/tools/misc/pgcenter/default.nix b/pkgs/tools/misc/pgcenter/default.nix
index c5ca7e8c911b..ac1c0bd356d2 100644
--- a/pkgs/tools/misc/pgcenter/default.nix
+++ b/pkgs/tools/misc/pgcenter/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd" ];
 
-  buildFlagsArray = [ "-ldflags=-w -s -X main.gitTag=${src.rev} -X main.gitCommit=${src.rev} -X main.gitBranch=master" ];
+  ldflags = [ "-w" "-s" "-X main.gitTag=${src.rev}" "-X main.gitCommit=${src.rev}" "-X main.gitBranch=master" ];
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/pgcenter
diff --git a/pkgs/tools/misc/pgmetrics/default.nix b/pkgs/tools/misc/pgmetrics/default.nix
index 955444ff8c87..c5a240f714ea 100644
--- a/pkgs/tools/misc/pgmetrics/default.nix
+++ b/pkgs/tools/misc/pgmetrics/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     homepage = "https://pgmetrics.io/";
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index 52c83abdf688..6d91a54e56dc 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -35,7 +35,7 @@ buildGoModule rec {
     installManPage pistol.1
   '';
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
 
   meta = with lib; {
     description = "General purpose file previewer designed for Ranger, Lf to make scope.sh redundant";
diff --git a/pkgs/tools/misc/tfk8s/default.nix b/pkgs/tools/misc/tfk8s/default.nix
index 086a05c90169..8ca102444a9d 100644
--- a/pkgs/tools/misc/tfk8s/default.nix
+++ b/pkgs/tools/misc/tfk8s/default.nix
@@ -15,8 +15,7 @@ buildGoModule rec {
   vendorSha256 = "sha256-eLPmghs05pMMtys97Ja7YGdVMZmMmiaFeMwzaWNxW0I=";
   runVend = true;
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-s"
     "-w"
     "-X main.toolVersion=${tag}"
diff --git a/pkgs/tools/misc/vsh/default.nix b/pkgs/tools/misc/vsh/default.nix
index 13a3df4d6b94..416dd4bfcc13 100644
--- a/pkgs/tools/misc/vsh/default.nix
+++ b/pkgs/tools/misc/vsh/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
   vendorSha256 = null;
 
   # make sure version gets set at compile time
-  buildFlagsArray = [ "-ldflags=-s -w -X main.vshVersion=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.vshVersion=v${version}" ];
 
   meta = with lib; {
     description = "HashiCorp Vault interactive shell";
diff --git a/pkgs/tools/networking/cassowary/default.nix b/pkgs/tools/networking/cassowary/default.nix
index 527ecfbf98d3..6280b923ec0c 100644
--- a/pkgs/tools/networking/cassowary/default.nix
+++ b/pkgs/tools/networking/cassowary/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     homepage = "https://github.com/rogerwelin/cassowary";
diff --git a/pkgs/tools/networking/chisel/default.nix b/pkgs/tools/networking/chisel/default.nix
index 5d82a549e889..9df5625c2355 100644
--- a/pkgs/tools/networking/chisel/default.nix
+++ b/pkgs/tools/networking/chisel/default.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-GzsQ6LXxe9UQc13XbsYFOWPe0EzlyHechchKc6xDkAc=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/jpillora/chisel/share.BuildVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/jpillora/chisel/share.BuildVersion=${version}" ];
 
   # tests require access to the network
   doCheck = false;
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index 61e529dc8729..221a6c280b26 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -15,8 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
     "-X github.com/Dreamacro/clash/constant.Version=${version}"
   ];
 
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index 98925489e548..6ba0752222ac 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -17,10 +17,9 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  buildFlagsArray = ''
-    -ldflags=
-    -s -w -extldflags '-static'
-  '';
+  ldflags = [
+    "-s" "-w" "-extldflags '-static'"
+  ];
 
   subPackages = [ "cmd/gobgp" ];
 
diff --git a/pkgs/tools/networking/grpcui/default.nix b/pkgs/tools/networking/grpcui/default.nix
index a9fb7c823f9e..1fa47ba917fc 100644
--- a/pkgs/tools/networking/grpcui/default.nix
+++ b/pkgs/tools/networking/grpcui/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/grpcui" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "An interactive web UI for gRPC, along the lines of postman";
diff --git a/pkgs/tools/networking/grpcurl/default.nix b/pkgs/tools/networking/grpcurl/default.nix
index 734a751daf09..e6cd09dc2fd7 100644
--- a/pkgs/tools/networking/grpcurl/default.nix
+++ b/pkgs/tools/networking/grpcurl/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-nl8vKVhUMSO20qCDyhNkU5cghNy8vIFqSBvLk59nbWg=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers";
diff --git a/pkgs/tools/networking/nebula/default.nix b/pkgs/tools/networking/nebula/default.nix
index 06615ae25fae..2aec2fb50c76 100644
--- a/pkgs/tools/networking/nebula/default.nix
+++ b/pkgs/tools/networking/nebula/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
 
-  buildFlagsArray = [ "-ldflags=" "-X main.Build=${version}" ];
+  ldflags = [ "-X main.Build=${version}" ];
 
   meta = with lib; {
     description = "A scalable overlay networking tool with a focus on performance, simplicity and security";
diff --git a/pkgs/tools/networking/shadowfox/default.nix b/pkgs/tools/networking/shadowfox/default.nix
index e6b1c823eb88..a75936a15204 100644
--- a/pkgs/tools/networking/shadowfox/default.nix
+++ b/pkgs/tools/networking/shadowfox/default.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [
-    "-ldflags=-X main.tag=v${version}"
+  ldflags = [
+    "-X main.tag=v${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/telepresence2/default.nix b/pkgs/tools/networking/telepresence2/default.nix
index 2cbe5fd91849..e7ae903e8682 100644
--- a/pkgs/tools/networking/telepresence2/default.nix
+++ b/pkgs/tools/networking/telepresence2/default.nix
@@ -13,9 +13,9 @@ buildGoModule rec {
 
   vendorSha256 = "1snmp461h8driy1w1xggk669yxl0sjl1m9pbqm7dwk44yb94zi1q";
 
-  buildFlagsArray = ''
-    -ldflags=-s -w -X=github.com/telepresenceio/telepresence/v2/pkg/version.Version=${src.rev}
-  '';
+  ldflags = [
+    "-s" "-w" "-X=github.com/telepresenceio/telepresence/v2/pkg/version.Version=${src.rev}"
+  ];
 
   subPackages = [ "cmd/telepresence" ];
 
diff --git a/pkgs/tools/networking/termshark/default.nix b/pkgs/tools/networking/termshark/default.nix
index 7b9a3c42d606..d35e70ad52e4 100644
--- a/pkgs/tools/networking/termshark/default.nix
+++ b/pkgs/tools/networking/termshark/default.nix
@@ -22,10 +22,9 @@ buildGoModule rec {
     wrapProgram $out/bin/termshark --prefix PATH : ${lib.makeBinPath [ wireshark-cli ]}
   '';
 
-  buildFlagsArray = ''
-    -ldflags=
-    -X github.com/gcla/termshark.Version=${version}
-  '';
+  ldflags = [
+    "-X github.com/gcla/termshark.Version=${version}"
+  ];
 
   meta = with lib; {
     homepage = "https://termshark.io/";
diff --git a/pkgs/tools/networking/yggdrasil/default.nix b/pkgs/tools/networking/yggdrasil/default.nix
index 506869238e57..874205f592bd 100644
--- a/pkgs/tools/networking/yggdrasil/default.nix
+++ b/pkgs/tools/networking/yggdrasil/default.nix
@@ -22,12 +22,11 @@ buildGoModule rec {
 
   subPackages = [ "cmd/yggdrasil" "cmd/yggdrasilctl" ];
 
-  buildFlagsArray = ''
-    -ldflags=
-      -X github.com/yggdrasil-network/yggdrasil-go/src/version.buildVersion=${version}
-      -X github.com/yggdrasil-network/yggdrasil-go/src/version.buildName=${pname}
-      -s -w
-  '';
+  ldflags = [
+    "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildVersion=${version}"
+    "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildName=${pname}"
+    "-s" "-w"
+  ];
 
   passthru.tests.basic = nixosTests.yggdrasil;
 
diff --git a/pkgs/tools/package-management/holo-build/default.nix b/pkgs/tools/package-management/holo-build/default.nix
index 20e3b555fd2f..847c8a726d0f 100644
--- a/pkgs/tools/package-management/holo-build/default.nix
+++ b/pkgs/tools/package-management/holo-build/default.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
 
   subPackages = [ "src/holo-build" ];
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/holocm/holo-build/src/holo-build/common.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/holocm/holo-build/src/holo-build/common.version=${version}" ];
 
   postBuild = ''
     make build/man/holo-build.8 VERSION=${version}
diff --git a/pkgs/tools/package-management/morph/default.nix b/pkgs/tools/package-management/morph/default.nix
index 56d824059f53..e7b6b3adf1f2 100644
--- a/pkgs/tools/package-management/morph/default.nix
+++ b/pkgs/tools/package-management/morph/default.nix
@@ -15,11 +15,9 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper go-bindata ];
 
-  buildFlagsArray = ''
-    -ldflags=
-    -X
-    main.version=${version}
-  '';
+  ldflags = [
+    "-X main.version=${version}"
+  ];
 
   postPatch = ''
     go-bindata -pkg assets -o assets/assets.go data/
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 69d2f0d29f78..9331bdba6843 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "A simple deb and rpm packager written in Go";
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index d9f4f4a01735..476d248c4343 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
   deleteVendor = true;
   vendorSha256 = "+Z8sENIMWXP29Piwb/W6i7UdNXVq6ZnO7AZbSaUYCME=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
   subPackages = [ "cmd/aws-iam-authenticator" ];
 
diff --git a/pkgs/tools/security/cfssl/default.nix b/pkgs/tools/security/cfssl/default.nix
index 6ef07c2c355b..1e95d1d6f2f9 100644
--- a/pkgs/tools/security/cfssl/default.nix
+++ b/pkgs/tools/security/cfssl/default.nix
@@ -34,11 +34,10 @@ buildGoModule rec {
     popd
   '';
 
-  buildFlagsArray = ''
-    -ldflags=
-      -s -w
-      -X github.com/cloudflare/cfssl/cli/version.version=v${version}
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/cloudflare/cfssl/cli/version.version=v${version}"
+  ];
 
   meta = with lib; {
     homepage = "https://cfssl.org/";
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index ad49251aae86..18ca909cd5e0 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-yb7L4GSKtlwagwdxBMd5aSk9fre1NKKsy6CM4Iv2ya8=";
 
-  buildFlagsArray = "-ldflags=-X github.com/DopplerHQ/cli/pkg/version.ProgramVersion=v${version}";
+  ldflags = [ "-X github.com/DopplerHQ/cli/pkg/version.ProgramVersion=v${version}" ];
 
   postInstall = ''
     mv $out/bin/cli $out/bin/doppler
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 358acf376b48..9e56b4c1a4bb 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" ];
 
   wrapperPath = lib.makeBinPath (
     [
diff --git a/pkgs/tools/security/gopass/git-credential.nix b/pkgs/tools/security/gopass/git-credential.nix
index fb0da2c1a093..0b15e9b02353 100644
--- a/pkgs/tools/security/gopass/git-credential.nix
+++ b/pkgs/tools/security/gopass/git-credential.nix
@@ -22,11 +22,9 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  preBuild = ''
-    buildFlagsArray+=(
-      "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev}"
-    )
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}"
+  ];
 
   postFixup = ''
     wrapProgram $out/bin/git-credential-gopass --prefix PATH : "${lib.makeBinPath [ gopass ]}"
diff --git a/pkgs/tools/security/gopass/jsonapi.nix b/pkgs/tools/security/gopass/jsonapi.nix
index e060adbf5bcf..c138bde2cc3c 100644
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@@ -23,11 +23,9 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
-  preBuild = ''
-    buildFlagsArray+=(
-      "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev}"
-    )
-  '';
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}"
+  ];
 
   postFixup = ''
     wrapProgram $out/bin/gopass-jsonapi --prefix PATH : "${lib.makeBinPath [ gopass ]}"
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 8ee2c9a4c4e4..55862623f494 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -20,9 +20,9 @@ buildGoModule rec {
 
   subPackages = [ "." "cmd/saml2aws" ];
 
-  buildFlagsArray = ''
-    -ldflags=-X main.Version=${version}
-  '';
+  ldflags = [
+    "-X main.Version=${version}"
+  ];
 
   meta = with lib; {
     description = "CLI tool which enables you to login and retrieve AWS temporary credentials using a SAML IDP";
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index 63291946e38c..9b645dcba927 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-cFuLW0qkI/l/TvYwQZA2bLlWYjs1hdbQJ5jU7xiuFZI=";
 
-  buildFlagsArray = [ "-ldflags=-buildid=" ];
+  ldflags = [ "-buildid=" ];
 
   nativeBuildInputs = lib.optionals hsmSupport [ pkg-config ];
 
diff --git a/pkgs/tools/security/subjs/default.nix b/pkgs/tools/security/subjs/default.nix
index 1b7986c0a77a..65d3f18be794 100644
--- a/pkgs/tools/security/subjs/default.nix
+++ b/pkgs/tools/security/subjs/default.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "1y01k8pvv7y9zb15wbk068cvkx0g83484jak2dvcvghqcf5j1fr1";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.AppVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.AppVersion=${version}" ];
 
   meta = with lib; {
     description = "Fetcher for Javascript files";
diff --git a/pkgs/tools/system/ctop/default.nix b/pkgs/tools/system/ctop/default.nix
index 45cbca172fa7..36dfd02c33f6 100644
--- a/pkgs/tools/system/ctop/default.nix
+++ b/pkgs/tools/system/ctop/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.build=v${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.build=v${version}" ];
 
   meta = with lib; {
     description = "Top-like interface for container metrics";
diff --git a/pkgs/tools/system/hostctl/default.nix b/pkgs/tools/system/hostctl/default.nix
index 3c366d56fca9..fb3a293a80fd 100644
--- a/pkgs/tools/system/hostctl/default.nix
+++ b/pkgs/tools/system/hostctl/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-rGDWrivIdl5FTu/kNR8nAfE2+1hE4cm3uDg7oBobE9M=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X github.com/guumaster/hostctl/cmd/hostctl/actions.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/guumaster/hostctl/cmd/hostctl/actions.version=${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
@@ -33,4 +33,3 @@ buildGoModule rec {
     maintainers = with maintainers; [ blaggacao ];
   };
 }
-
diff --git a/pkgs/tools/system/netdata/go.d.plugin.nix b/pkgs/tools/system/netdata/go.d.plugin.nix
index be6e8f267637..53ab6d6982d6 100644
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   postInstall = ''
     mkdir -p $out/lib/netdata/conf.d
diff --git a/pkgs/tools/text/mark/default.nix b/pkgs/tools/text/mark/default.nix
index 04b08488ee91..653af8b79692 100644
--- a/pkgs/tools/text/mark/default.nix
+++ b/pkgs/tools/text/mark/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-y3Q8UebNbLy1jmxUC37mv+2l8dCU3b/Fk8XHn5u57p0=";
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "A tool for syncing your markdown documentation with Atlassian Confluence pages";
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index a665e35fdd55..d5c64aa9f7b2 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
     cp -r styles $data/share/vale
   '';
 
-  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
     homepage = "https://docs.errata.ai/vale/about";
diff --git a/pkgs/tools/virtualization/shipyard/default.nix b/pkgs/tools/virtualization/shipyard/default.nix
index cd8a4c36a920..9c67b5462bbf 100644
--- a/pkgs/tools/virtualization/shipyard/default.nix
+++ b/pkgs/tools/virtualization/shipyard/default.nix
@@ -12,8 +12,8 @@ buildGoModule rec {
   };
   vendorSha256 = "sha256-tTkPFftPDNXafIjAjNg6V6e/+2S/v5Do/YyAXPaGIqA=";
 
-  buildFlagsArray = [
-    "-ldflags=-s -w -X main.version=${version}"
+  ldflags = [
+    "-s" "-w" "-X main.version=${version}"
   ];
 
   # Tests require a large variety of tools and resources to run including