diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index 692485d0dcfd..04b31ae2c0b3 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin-limits.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework MultitouchSupport";
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
     substituteInPlace src/core/makefile.x/makefile.osx \
diff --git a/pkgs/applications/audio/freewheeling/default.nix b/pkgs/applications/audio/freewheeling/default.nix
index a2588093309d..34494871f29c 100644
--- a/pkgs/applications/audio/freewheeling/default.nix
+++ b/pkgs/applications/audio/freewheeling/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       configureFlags = oldAttrs.configureFlags ++ [ "--enable-openssl-compatibility" ];
     }))
   ];
-  NIX_CFLAGS_COMPILE = makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ];
+  NIX_CFLAGS_COMPILE = toString
+    (makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ]);
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/audio/svox/default.nix b/pkgs/applications/audio/svox/default.nix
index 8acd8e0b88b1..3e9fe4725afd 100644
--- a/pkgs/applications/audio/svox/default.nix
+++ b/pkgs/applications/audio/svox/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     cp lang/*.bin $out/share/pico/lang
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-include stdint.h" ];
+  NIX_CFLAGS_COMPILE = "-include stdint.h";
 
   meta = with stdenv.lib; {
     description = "Text-to-speech engine";
diff --git a/pkgs/applications/misc/doomseeker/default.nix b/pkgs/applications/misc/doomseeker/default.nix
index 1332b265d54c..fbe21dd9a5b2 100644
--- a/pkgs/applications/misc/doomseeker/default.nix
+++ b/pkgs/applications/misc/doomseeker/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-error=format-security";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with stdenv.lib; {
     homepage = http://doomseeker.drdteam.org/;
diff --git a/pkgs/applications/misc/getxbook/default.nix b/pkgs/applications/misc/getxbook/default.nix
index 56f1ec747ca2..aa901a7ba513 100644
--- a/pkgs/applications/misc/getxbook/default.nix
+++ b/pkgs/applications/misc/getxbook/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ihwrx4gspj8l7fc8vxch6dpjrw1lvv9z3c19f0wxnmnxhv1cjvs";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=format-truncation"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=stringop-overflow"
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index 5a56c0867dd8..43ec0910cc2b 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" "-Wno-error=duplicate-decl-specifier" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
 
   meta = {
     description = "An IRC proxy (bouncer)";
diff --git a/pkgs/applications/science/math/calculix/default.nix b/pkgs/applications/science/math/calculix/default.nix
index 24d5f99ec32a..6f2d61cd80f0 100644
--- a/pkgs/applications/science/math/calculix/default.nix
+++ b/pkgs/applications/science/math/calculix/default.nix
@@ -13,9 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ arpack spooles openblas ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${spooles}/include/spooles"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
 
   patches = [
     ./calculix.patch
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 3c7784e85062..45b427341a21 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -23,9 +23,7 @@ stdenv.mkDerivation {
     "SVN_INCLUDE=${subversion.dev}/include/subversion-1"
   ];
 
-  NIX_LDFLAGS = [
-    "-lsvn_fs-1"
-  ];
+  NIX_LDFLAGS = "-lsvn_fs-1";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/svn-all-fast-export/svn2git;
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index 862b9eacd628..3283a3c046a4 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     make $checkFlags check || print_logs_and_fail
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-std=c99" ];
+  NIX_CFLAGS_COMPILE = "-std=c99";
 
   hardeningDisable = stdenv.lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 7b4e7787985f..603aa68207a7 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -53,9 +53,7 @@ rec {
       patchPhase = ''
       '';
 
-      NIX_CFLAGS_COMPILE = [
-        "-DMINIMAL=ON"
-      ];
+      NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
     });
   in
     stdenv.mkDerivation ((optionalAttrs (stdenv.isLinux) {
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index 39508412333c..fcc599b451f0 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -13,10 +13,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
 
-  NIX_CFLAGS_COMPILE = [
-    "-DPR_SET_CHILD_SUBREAPER=36"
-    "-DPR_GET_CHILD_SUBREAPER=37"
-  ];
+  NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
 
   buildInputs = [ cmake glibc glibc.static ];
 
diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix
index 822575d85b9e..1d0e01fcb822 100644
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@@ -167,7 +167,7 @@ callPackage (import ./generic.nix (rec {
     xenpmdpatch
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC8
diff --git a/pkgs/applications/window-managers/compton/default.nix b/pkgs/applications/window-managers/compton/default.nix
index 0941329bdbe5..3f7cfd4864d6 100644
--- a/pkgs/applications/window-managers/compton/default.nix
+++ b/pkgs/applications/window-managers/compton/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     libxdg_basedir
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-fno-strict-aliasing" ];
+  NIX_CFLAGS_COMPILE = "-fno-strict-aliasing";
 
   mesonFlags = [
     "-Dbuild_docs=true"
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 355cc58f348f..183e72565d3d 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
     source "$setupHook"
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   postInstall = ''
     # fix use of $out variable
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 5ff687adcf6f..3c89f9ff0fcc 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -16,5 +16,5 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtk2 intltool GConf enchant isocodes gnome_icon_theme ];
 
-  NIX_LDFLAGS = [ "-lgthread-2.0" ];
+  NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index a0fc30c85868..c0fd742082f3 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isGNU "-Wno-error=format-truncation";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
 
   /*
   ** We patch out a very annoying 'feature' in ./configure, which
diff --git a/pkgs/development/compilers/eql/default.nix b/pkgs/development/compilers/eql/default.nix
index cb960227bebe..aac619126896 100644
--- a/pkgs/development/compilers/eql/default.nix
+++ b/pkgs/development/compilers/eql/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ecl qt4 xorgserver xkbcomp xkeyboard_config ];
 
-  NIX_CFLAGS_COMPILE = [ "-fPIC" ];
+  NIX_CFLAGS_COMPILE = "-fPIC";
 
   postPatch = ''
     sed -re 's@[(]in-home "gui/.command-history"[)]@(concatenate '"'"'string (ext:getenv "HOME") "/.eql-gui-command-history")@' -i gui/gui.lisp
diff --git a/pkgs/development/compilers/gerbil/build.nix b/pkgs/development/compilers/gerbil/build.nix
index b5ccbca6f7e6..e2ab09764827 100644
--- a/pkgs/development/compilers/gerbil/build.nix
+++ b/pkgs/development/compilers/gerbil/build.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gambit rsync bash ]
     ++ buildInputs_libraries ++ buildInputs_staticLibraries;
 
-  NIX_CFLAGS_COMPILE = [ "-I${libmysqlclient}/include/mysql" "-L${libmysqlclient}/lib/mysql" ];
+  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   postPatch = ''
     echo '(define (gerbil-version-string) "v${git-version}")' > src/gerbil/runtime/gx-version.scm
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 11a94ebcce59..438c899f5168 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -242,10 +242,7 @@ in rec {
                   'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = [
-      "-Wno-error=format-overflow" # newly detected by gcc7
-      "-Wno-error=nonnull"
-    ];
+    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index e365b9b28b35..b8381feef095 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -61,13 +61,13 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+    NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = lib.optionals (!headless) [
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
-    ];
+    ]);
 
     buildFlags = [ "all" ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 43fe8ed83876..c6bff3961088 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -84,7 +84,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/libraries/bamf/default.nix b/pkgs/development/libraries/bamf/default.nix
index 1bce315878d0..60322f530166 100644
--- a/pkgs/development/libraries/bamf/default.nix
+++ b/pkgs/development/libraries/bamf/default.nix
@@ -88,9 +88,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-  ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = with stdenv.lib; {
     description = "Application matching framework";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 1745614f741c..0d3df37d8e09 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/buddy/default.nix b/pkgs/development/libraries/buddy/default.nix
index fb25b0a58108..9b722602a65c 100644
--- a/pkgs/development/libraries/buddy/default.nix
+++ b/pkgs/development/libraries/buddy/default.nix
@@ -11,9 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison ];
   patches = [ ./gcc-4.3.3-fixes.patch ];
   configureFlags = [ "CFLAGS=-O3" "CXXFLAGS=-O3" ];
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
index d172ab55fa3c..dc742a5c051a 100644
--- a/pkgs/development/libraries/cpp-hocon/default.nix
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/cppdb/default.nix b/pkgs/development/libraries/cppdb/default.nix
index a21b3cc93faa..bb521ba3ec0c 100644
--- a/pkgs/development/libraries/cppdb/default.nix
+++ b/pkgs/development/libraries/cppdb/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ cmake sqlite libmysqlclient postgresql unixODBC ];
 
   cmakeFlags = [ "--no-warn-unused-cli" ];
-  NIX_CFLAGS_COMPILE = [ "-I${libmysqlclient}/include/mysql" "-L${libmysqlclient}/lib/mysql" ];
+  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   meta = with stdenv.lib; {
     homepage = http://cppcms.com/sql/cppdb/;
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index 916ec5b703bb..a7313c205536 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ gflags ];
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isAarch64 "-march=armv8-a+crc";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/google/crc32c;
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index 246dd009820c..d9a17aff9418 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -23,9 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  NIX_LDFLAGS = [
-    "-lbluetooth"
-  ];
+  NIX_LDFLAGS = "-lbluetooth";
 
   postInstall = ''
     # Some programs (for example, cabal-install) have problems with the double 0
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 945f1d4931fb..c0a3d3718f34 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -52,9 +52,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # TODO: some issues with temporary files
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/gdal/gdal-1_11.nix b/pkgs/development/libraries/gdal/gdal-1_11.nix
index a65740534146..6a086d9c998d 100644
--- a/pkgs/development/libraries/gdal/gdal-1_11.nix
+++ b/pkgs/development/libraries/gdal/gdal-1_11.nix
@@ -40,9 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Allow use of old proj_api.h
-  NIX_CFLAGS_COMPILE = [
-    "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1"
-  ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   # Prevent this:
   #
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 97b9ba087e28..1b3d5ba4b7c0 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "1svhbjibm448ybq6gnjjzj0ak42srhihssafj0w402aj71lgaq4a";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=misleading-indentation" "-Wno-error=pointer-compare" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index bc10c9f9bdd6..0e9857549850 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
     substituteInPlace libtool --replace stdc++ c++
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.isDarwin [
-    "-D_XOPEN_SOURCE" "-Wno-aligned-allocation-unavailable"
-  ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
+    "-D_XOPEN_SOURCE -Wno-aligned-allocation-unavailable";
 
   # some packages want to link to the static tcmalloc_minimal
   # to drop the runtime dependency on gperftools
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 44c393baf8e8..b7b9b019b639 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=ignored-qualifiers"
     "-Wno-error=class-memaccess"
     "-Wno-error=catch-value"
diff --git a/pkgs/development/libraries/libmemcached/default.nix b/pkgs/development/libraries/libmemcached/default.nix
index 57053103417a..5655bfe968b9 100644
--- a/pkgs/development/libraries/libmemcached/default.nix
+++ b/pkgs/development/libraries/libmemcached/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive"/*gcc7*/ ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = with stdenv.lib; {
     homepage = https://libmemcached.org;
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index ff8f200a3bba..b2594d7c1d70 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   buildInputs = [ ncurses perl ];
 
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index 22245f5fa2ab..dd6318444e78 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
   # Make sure libqtav finds its libGL dependency at both link and run time
   # by adding libGL to rpath. Not sure why it wasn't done automatically like
   # the other libraries as `libGL` is part of our `buildInputs`.
-  NIX_CFLAGS_LINK = [ "-Wl,-rpath,${libGL}/lib"];
+  NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
 
   preFixup = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/development/libraries/libwhereami/default.nix b/pkgs/development/libraries/libwhereami/default.nix
index 84bd1847faa2..8e190f998d56 100644
--- a/pkgs/development/libraries/libwhereami/default.nix
+++ b/pkgs/development/libraries/libwhereami/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index db8a5e5a41bb..ad27742d0b4c 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   cmakeFlags = [
     (opencvFlag "TIFF" enableTIFF)
diff --git a/pkgs/development/libraries/phonon/backends/gstreamer.nix b/pkgs/development/libraries/phonon/backends/gstreamer.nix
index 20723322c1db..d79078c28369 100644
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
             gst-plugins-bad
             gst-libav
           ]);
-    in [
+    in toString [
       # This flag should be picked up through pkgconfig, but it isn't.
       "-I${gst_all_1.gstreamer.dev}/lib/gstreamer-1.0/include"
 
diff --git a/pkgs/development/libraries/science/math/osi/default.nix b/pkgs/development/libraries/science/math/osi/default.nix
index 1cc80e78a100..6dc7e746fd35 100644
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@@ -22,10 +22,10 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withCplex [ "--with-cplex-incdir=${cplex}/cplex/include/ilcplex" "--with-cplex-lib=-lcplex${cplex.libSuffix}" ];
 
   NIX_LDFLAGS =
-    lib.optional withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
+    lib.optionalString withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
 
-  # Compile errors 
-  NIX_CFLAGS_COMPILE = [ "-Wno-cast-qual" ];
+  # Compile errors
+  NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
   hardeningDisable = [ "format" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/python-modules/pivy/default.nix b/pkgs/development/python-modules/pivy/default.nix
index 93aa5ad144cf..f7ec55bba05e 100644
--- a/pkgs/development/python-modules/pivy/default.nix
+++ b/pkgs/development/python-modules/pivy/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     libXi libXext libSM libICE libX11
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${pkgs.qt5.qtbase.dev}/include/QtCore"
     "-I${pkgs.qt5.qtbase.dev}/include/QtGui"
     "-I${pkgs.qt5.qtbase.dev}/include/QtOpenGL"
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 73216f63f82b..e414dff8aa17 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -9,10 +9,11 @@ buildPythonPackage {
   inherit disabled;
   doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
 
-  NIX_CFLAGS_COMPILE =
+  NIX_CFLAGS_COMPILE = toString (
     # work around python distutils compiling C++ with $CC
     optional stdenv.isDarwin "-I${libcxx}/include/c++/v1"
-    ++ optional (versionOlder protobuf.version "2.7.0") "-std=c++98";
+    ++ optional (versionOlder protobuf.version "2.7.0") "-std=c++98"
+  );
 
   propagatedBuildInputs = [ google_apputils ];
   propagatedNativeBuildInputs = [ protobuf ];  # For protoc.
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index f6a67b051146..e5f7a50476e6 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -65,7 +65,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = lib.optional mysqlSupport "-lz -lssl -lcrypto";
+  NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 206ed02e69ce..af6bc4be3936 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -19,11 +19,8 @@ stdenv.mkDerivation {
     patchShebangs ./configure
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
-
-  NIX_LDFLAGS = [
-    "-ldl"
-  ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
+  NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = http://www.bergo.eng.br/eboard/;
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index e305505d62cb..242e0930db3b 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -41,10 +41,7 @@ in stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-    "-I${SDL2_mixer}/include/SDL2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index 3cd2dc5827b3..c8a5f380900a 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -44,9 +44,7 @@ stdenv.mkDerivation rec {
     '';
   */
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "3D dungeon crawling adventure";
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index 58fdaeb8f740..07f84d7a151a 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   postInstall =
     ''
diff --git a/pkgs/games/globulation/default.nix b/pkgs/games/globulation/default.nix
index b953aad606d6..45c5013705f3 100644
--- a/pkgs/games/globulation/default.nix
+++ b/pkgs/games/globulation/default.nix
@@ -41,9 +41,7 @@ stdenv.mkDerivation rec {
     sconsFlags+=" DATADIR=$out/share/globulation2/glob2"
   '';
 
-  NIX_LDFLAGS = [
-    "-lboost_system"
-  ];
+  NIX_LDFLAGS = "-lboost_system";
 
   meta = with stdenv.lib; {
     description = "RTS without micromanagement";
diff --git a/pkgs/games/xpilot/bloodspilot-client.nix b/pkgs/games/xpilot/bloodspilot-client.nix
index 257b00102458..4a1c25ee12e0 100644
--- a/pkgs/games/xpilot/bloodspilot-client.nix
+++ b/pkgs/games/xpilot/bloodspilot-client.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     libX11 SDL SDL_ttf SDL_image libGLU libGL expat zlib
   ];
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = ''A multiplayer space combat game (client part)'';
diff --git a/pkgs/os-specific/linux/dropwatch/default.nix b/pkgs/os-specific/linux/dropwatch/default.nix
index 061dce048607..69acfa9682b6 100644
--- a/pkgs/os-specific/linux/dropwatch/default.nix
+++ b/pkgs/os-specific/linux/dropwatch/default.nix
@@ -16,10 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libbfd libnl ncurses readline zlib ];
 
   # To avoid running into https://sourceware.org/bugzilla/show_bug.cgi?id=14243 we need to define:
-  NIX_CFLAGS_COMPILE = [
-    "-DPACKAGE=${pname}"
-    "-DPACKAGE_VERSION=${version}"
-  ];
+  NIX_CFLAGS_COMPILE = "-DPACKAGE=${pname} -DPACKAGE_VERSION=${version}";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index 60b87d2dd9aa..c14e04dc3440 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     ./do-not-create-sharedstatedir.patch
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${gnu-efi}/include/efi" "-Wno-error=address-of-packed-member" ];
+  NIX_CFLAGS_COMPILE = "-I${gnu-efi}/include/efi -Wno-error=address-of-packed-member";
 
   # TODO: Just apply the disable to the efi subdir
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 2c0dbc7d6654..2d1b994faab6 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -73,10 +73,10 @@ stdenv.mkDerivation {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString ([
     "-I${libxml2.dev}/include/libxml2"
     "-Wno-error=implicit-fallthrough"
-  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
+  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
 
   configurePlatforms = [];
 
diff --git a/pkgs/servers/uwsgi/default.nix b/pkgs/servers/uwsgi/default.nix
index 556c44b61a75..7669053d2294 100644
--- a/pkgs/servers/uwsgi/default.nix
+++ b/pkgs/servers/uwsgi/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     ${lib.concatMapStringsSep "\n" (x: x.install or "") needed}
   '';
 
-  NIX_CFLAGS_LINK = lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed;
+  NIX_CFLAGS_LINK = toString (lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed);
 
   meta = with stdenv.lib; {
     homepage = https://uwsgi-docs.readthedocs.org/en/latest/;
diff --git a/pkgs/servers/web-apps/fileshelter/default.nix b/pkgs/servers/web-apps/fileshelter/default.nix
index 47184fe9c96b..928d80b1297a 100644
--- a/pkgs/servers/web-apps/fileshelter/default.nix
+++ b/pkgs/servers/web-apps/fileshelter/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libzip boost wt4 libconfig ];
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   postInstall = ''
     ln -s ${wt4}/share/Wt/resources $out/share/fileshelter/docroot/resources
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index 6fc0e3a7f210..3c6f62283293 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 33fc5ce2ab6b..af7ef8b8215b 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ fuse3 glib ];
   checkInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 296ba43a5ed7..3fc82a9c72a0 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString x11Support "-lSDL";
 
   meta = with stdenv.lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 4637a39e6e90..8e766cdeeb5c 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
      void sigint(int sig) FUNCATTR_NORETURN;
     -inline void init(void);
     +static inline void init(void);
-     
+
      /* clear stuff and exit */
     --- a/src/options.c
     +++ b/src/options.c
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
 
   # This code uses inline in the gnu89 sense: see http://clang.llvm.org/compatibility.html#inline
-  NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-std=gnu89" else null;
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-std=gnu89";
 
   meta = with stdenv.lib; {
     description = "A small and simple console-based live network and disk io bandwidth monitor";
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 1b41a176723e..29c0d550fe2f 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 0c254bb28545..4adc81608293 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -15,9 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = http://gdmap.sourceforge.net;
diff --git a/pkgs/tools/system/opencl-info/default.nix b/pkgs/tools/system/opencl-info/default.nix
index 60175d27f151..d1c3d0ec6c0c 100644
--- a/pkgs/tools/system/opencl-info/default.nix
+++ b/pkgs/tools/system/opencl-info/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencl-clhpp ocl-icd ];
 
-  NIX_LDFLAGS = [ "-lOpenCL" ];
+  NIX_LDFLAGS = "-lOpenCL";
 
   installPhase = ''
     install -Dm755 opencl-info $out/bin/opencl-info