diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index d5d893891ff..b146fcecc8e 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder ''out''}"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DLSP_NO_EXPERIMENTAL" ];
+  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
 
   doCheck = true;
 
diff --git a/pkgs/applications/audio/pianobooster/default.nix b/pkgs/applications/audio/pianobooster/default.nix
index fee456ae717..f2130fe5559 100644
--- a/pkgs/applications/audio/pianobooster/default.nix
+++ b/pkgs/applications/audio/pianobooster/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation  {
   preConfigure = "cd src";
 
   buildInputs = [ alsaLib cmake makeWrapper libGLU libGL qt4 ];
-  NIX_LDFLAGS = [ "-lGL" "-lpthread" ];
+  NIX_LDFLAGS = "-lGL -lpthread";
 
   postInstall = ''
     wrapProgram $out/bin/pianobooster \
diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
index 8c7ed20e748..48dd3f39e88 100644
--- a/pkgs/applications/audio/timemachine/default.nix
+++ b/pkgs/applications/audio/timemachine/default.nix
@@ -19,9 +19,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS =  [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 8ca3f8cb2a9..91e2427a6c8 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     git
     python3
   ];
-  NIX_LDFLAGS = [ "-lz" ];
+  NIX_LDFLAGS = "-lz";
 
   postInstall = "wrapProgram $out/bin/texmacs --suffix PATH : " +
         (if ghostscriptX == null then "" else "${ghostscriptX}/bin:") +
diff --git a/pkgs/applications/graphics/xournal/default.nix b/pkgs/applications/graphics/xournal/default.nix
index cd9d068b8ac..6d10a7cae23 100644
--- a/pkgs/applications/graphics/xournal/default.nix
+++ b/pkgs/applications/graphics/xournal/default.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
 
-  NIX_LDFLAGS = [ "-lz" ]
-    ++ stdenv.lib.optionals (!isGdkQuartzBackend) [ "-lX11" ];
+  NIX_LDFLAGS = "-lz"
+    + stdenv.lib.optionalString (!isGdkQuartzBackend) " -lX11";
 
   desktopItem = makeDesktopItem {
     name = name;
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index e643c212225..08643577b49 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   postInstall = ''
     wrapProgram $out/bin/merkaartor \
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 443fe2f1d6c..531f8d851f1 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -62,10 +62,8 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = [
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
-    "-Wno-error=deprecated-declarations"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/navit/default.nix b/pkgs/applications/misc/navit/default.nix
index 29e768c257f..2263dfc1fbc 100644
--- a/pkgs/applications/misc/navit/default.nix
+++ b/pkgs/applications/misc/navit/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./CMakeLists.txt.patch ];
 
-  NIX_CFLAGS_COMPILE = optional sdlSupport "-I${SDL.dev}/include/SDL"
-    ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher";
+  NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
+    ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher");
 
   # we choose only cmdline and speech-dispatcher speech options.
   # espeak builtins is made for non-cmdline OS as winCE
diff --git a/pkgs/applications/misc/netsurf/libcss/default.nix b/pkgs/applications/misc/netsurf/libcss/default.nix
index 55538925abd..ed0b7b12e98 100644
--- a/pkgs/applications/misc/netsurf/libcss/default.nix
+++ b/pkgs/applications/misc/netsurf/libcss/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE=[ "-Wno-error=implicit-fallthrough" ];
+  NIX_CFLAGS_COMPILE= "-Wno-error=implicit-fallthrough";
 
   meta = with stdenv.lib; {
     homepage = http://www.netsurf-browser.org/;
diff --git a/pkgs/applications/misc/osm2xmap/default.nix b/pkgs/applications/misc/osm2xmap/default.nix
index 1c19238541c..e5838dc1bbe 100644
--- a/pkgs/applications/misc/osm2xmap/default.nix
+++ b/pkgs/applications/misc/osm2xmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "INSTALL_MANDIR=${placeholder ''out''}/share/man/man1"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   buildInputs = [ libroxml proj libyamlcpp boost ];
 
diff --git a/pkgs/applications/misc/tangogps/default.nix b/pkgs/applications/misc/tangogps/default.nix
index 08bea18d8e9..10b487828ea 100644
--- a/pkgs/applications/misc/tangogps/default.nix
+++ b/pkgs/applications/misc/tangogps/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext gtk2 gconf curl libexif sqlite libxml2 ];
-  NIX_LDFLAGS = [ "-lm" ];
+  NIX_LDFLAGS = "-lm";
 
   # bogus includes fail with newer library version
   postPatch = ''
diff --git a/pkgs/applications/misc/xsw/default.nix b/pkgs/applications/misc/xsw/default.nix
index aa851e14ab5..c7c10254c0c 100644
--- a/pkgs/applications/misc/xsw/default.nix
+++ b/pkgs/applications/misc/xsw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ];
+  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
 
   patches = [
     ./parse.patch # Fixes compilation error by avoiding redundant definitions.
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index e24e47f2fe7..e01e4c4fc44 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -31,8 +31,8 @@ rustPlatform.buildRustPackage rec {
     make
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=sign-compare" ]
-    ++ stdenv.lib.optional stdenv.isDarwin "-Wno-error=format-security";
+  NIX_CFLAGS_COMPILE = "-Wno-error=sign-compare"
+    + stdenv.lib.optionalString stdenv.isDarwin " -Wno-error=format-security";
 
   doCheck = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
index 44133e777c7..e9a0812e925 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gjm0z4wa5vi9x1xk43rany5pffrwg958n180ahdj9a7sa8a4hpm";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     # glib-2.62 deprecations
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
     # override "-O0 -Werror" set by build system
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
index ef298883b1b..c38ff8f454e 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0p93jpjpx7hszwffzgixw04zkrpsiyzz4za3gfr4j07krc4771fp";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=cast-function-type" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin libwebp libgcrypt gettext ];
diff --git a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
index 3ac2b567a8c..8093f91feb3 100644
--- a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   patches = [ ./conference.patch ];
 
   buildInputs = [ cmake lame id3lib libvorbis qt4 libogg ];
-  NIX_LDFLAGS = [ "-lvorbis" ];
+  NIX_LDFLAGS = "-lvorbis";
 
   meta = {
     homepage = http://atdot.ch/scr/;
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index d1d69b3d837..d47b7d00af9 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ GConf ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${libxml2.dev}/include/libxml2"
     "-I${miniupnpc}/include/miniupnpc"
     "-I${qtwebkit.dev}/include/QtWebKit"
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index d1b950a7757..f78053bdc37 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -46,7 +46,7 @@ in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   enableParallelBuilding = true;
 
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_VERSION_TAGGING=1" ];
+  NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   buildInputs =
        [ cmake makeWrapper qtbase ]
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index 8c2d9ac36e9..49182ec182f 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isUnix ''
     perl mkfiles.pl
diff --git a/pkgs/applications/office/planner/default.nix b/pkgs/applications/office/planner/default.nix
index f454d8830cb..6189132d0f9 100644
--- a/pkgs/applications/office/planner/default.nix
+++ b/pkgs/applications/office/planner/default.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation {
   ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = ''./autogen.sh'';
   configureFlags = [
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 016540c1e67..f5c89ae51ce 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -50,9 +50,7 @@ stdenv.mkDerivation rec {
     Mako cheetah numpy scipy matplotlib pyqt4 pygtk wxPython pyopengl
   ];
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 3434c0624ed..2268cdf725d 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   buildInputs = [ glib pkgconfig gtk2 hamlib ];
 
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index e4db7ea5994..cf160d8af53 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     # igrone glib-2.62 deprecations
     # Drop in next stable release.
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index 92df54d6e83..f15a7ef0f9d 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -148,7 +148,7 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24.
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC 8
diff --git a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index d29178b220d..582793ff590 100644
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -148,11 +148,9 @@ stdenv.mkDerivation rec {
     "-Dudev_dir=${placeholder "out"}/lib/udev"
   ];
 
-  NIX_CFLAGS_COMPILE = [
     # Default for release buildtype but passed manually because
     # we're using plain
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 59f282d7411..83778aa8fff 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -9,7 +9,7 @@ mkXfceDerivation {
 
   nativeBuildInputs = [ automakeAddFlags ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${dbus-glib.dev}/include/dbus-1.0" "-I${dbus.dev}/include/dbus-1.0" ];
+  NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
 
   postPatch = ''
     substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index dee0b351a60..bdb16c92207 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -14,13 +14,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [
-    "-lcrypto"
-    "-lpcre"
-    "-lreadline"
-    "-lgc"
-    "-lsqlite3"
-  ];
+  NIX_LDFLAGS = "-lcrypto -lpcre -lreadline -lgc -lsqlite3";
 
   # we could create a separate derivation for the "written in c" version of nim
   # used for bootstrapping, but koch insists on moving the nim compiler around
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index 1cc96455be7..e6fdd03bb67 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = http://www.dcc.fc.up.pt/~vsc/Yap/;
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 188058a73b5..9c35fc35497 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison flex makeWrapper ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
-  NIX_LDFLAGS = [ "-lLLVMJIT" ];
+  NIX_LDFLAGS = "-lLLVMJIT";
 
   postPatch = ''
     for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
diff --git a/pkgs/development/libraries/mps/default.nix b/pkgs/development/libraries/mps/default.nix
index ec3b4e20147..8c1f3aea466 100644
--- a/pkgs/development/libraries/mps/default.nix
+++ b/pkgs/development/libraries/mps/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ sqlite ];
 
   # needed for 1.116.0 to build with gcc7
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-Wno-implicit-fallthrough"
     "-Wno-error=clobbered"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index b79f940affa..803906b1343 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig python ];
 
   # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [ "--without-gobject" "CFLAGS=--std=gnu99" ];
 
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 408368b89c4..9fffd3d9477 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/prometheus-cpp/default.nix b/pkgs/development/libraries/prometheus-cpp/default.nix
index b047322c35e..0403c7ad10c 100644
--- a/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     "-DCIVETWEB_CXX_LIBRARY=${civetweb}/lib/libcivetweb${stdenv.targetPlatform.extensions.sharedLibrary}"
   ];
 
-  NIX_LDFLAGS = [ "-ldl" ];
+  NIX_LDFLAGS = "-ldl";
 
   meta = {
     description = "Prometheus Client Library for Modern C++";
diff --git a/pkgs/development/libraries/qoauth/default.nix b/pkgs/development/libraries/qoauth/default.nix
index 0d9ae21e87e..83e904e53eb 100644
--- a/pkgs/development/libraries/qoauth/default.nix
+++ b/pkgs/development/libraries/qoauth/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation {
   buildInputs = [ qt5.qtbase qca2-qt5 ];
   nativeBuildInputs = [ qt5.qmake ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${qca2-qt5}/include/Qca-qt5/QtCrypto" ];
-  NIX_LDFLAGS = [ "-lqca-qt5" ];
+  NIX_CFLAGS_COMPILE = "-I${qca2-qt5}/include/Qca-qt5/QtCrypto";
+  NIX_LDFLAGS = "-lqca-qt5";
 
   meta = with stdenv.lib; {
     description = "Qt library for OAuth authentication";
diff --git a/pkgs/development/libraries/science/benchmark/papi/default.nix b/pkgs/development/libraries/science/benchmark/papi/default.nix
index 35d0914e3f7..53ae70f5bf8 100644
--- a/pkgs/development/libraries/science/benchmark/papi/default.nix
+++ b/pkgs/development/libraries/science/benchmark/papi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "13mngf9kl0y2wfxqvkad0smdaag7k8fvw82b4312gx62nwhc1i6r";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   preConfigure = ''
     cd src
diff --git a/pkgs/development/libraries/spatialite-tools/default.nix b/pkgs/development/libraries/spatialite-tools/default.nix
index 2708e49eb2b..83eef355f2d 100644
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [ "-lsqlite3" ];
+  NIX_LDFLAGS = "-lsqlite3";
 
   meta = {
     description = "A complete sqlite3-compatible CLI front-end for libspatialite";
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index a18edc0a6df..f9f5beb5b65 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-dpdk=${dpdk}" ];
 
-  NIX_CFLAGS_COMPILE = [ "-mssse3" ]; # Necessary to compile.
+  NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/unixODBCDrivers/default.nix b/pkgs/development/libraries/unixODBCDrivers/default.nix
index 78f85afca91..6cfaef5ef99 100644
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@@ -100,16 +100,16 @@
   sqlite = stdenv.mkDerivation rec {
     pname = "sqlite-connector-odbc";
     version = "0.9993";
- 
+
     src = fetchurl {
       url = "http://www.ch-werner.de/sqliteodbc/sqliteodbc-${version}.tar.gz";
       sha256 = "0dgsj28sc7f7aprmdd0n5a1rmcx6pv7170c8dfjl0x1qsjxim6hs";
     };
- 
+
     buildInputs = [ unixODBC sqlite zlib libxml2 ];
- 
+
     configureFlags = [ "--with-odbc=${unixODBC}" ];
- 
+
     installTargets = [ "install-3" ];
 
     # move libraries to $out/lib where they're expected to be
@@ -117,7 +117,7 @@
       mkdir -p "$out/lib"
       mv "$out"/*.* "$out/lib"
     '';
- 
+
     passthru = {
       fancyName = "SQLite";
       driver = "lib/libsqlite3odbc.so";
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 61246748ac7..5e5f4c9e8ca 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=parentheses" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 4e9336172ad..a02e540173d 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
 
   # with gcc8, -Wclass-memaccess became part of -Wall and causes logging limit
   # to be exceeded
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isGNU "-Wno-class-memaccess";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-class-memaccess";
 
   nativeBuildInputs = [ gn ninja pkgconfig python ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ xcbuild darwin.DarwinTools ];
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index 945ba59cf3d..3a5b1690f2d 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ zeroc_mcpp bzip2 expat openssl lmdb ]
     ++ lib.optionals stdenv.isDarwin [ darwin.cctools libiconv Security ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=class-memaccess" "-Wno-error=deprecated-copy" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
 
   prePatch = lib.optional stdenv.isDarwin ''
     substituteInPlace Make.rules.Darwin \
diff --git a/pkgs/development/libraries/zookeeper_mt/default.nix b/pkgs/development/libraries/zookeeper_mt/default.nix
index ba53e8e5445..127ea4f7162 100644
--- a/pkgs/development/libraries/zookeeper_mt/default.nix
+++ b/pkgs/development/libraries/zookeeper_mt/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
 
   setSourceRoot = "export sourceRoot=${zookeeper.name}/src/c";
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals (!stdenv.isDarwin) [ "-Wno-error=format-overflow" "-Wno-error=stringop-truncation" ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.isDarwin) "-Wno-error=format-overflow -Wno-error=stringop-truncation";
 
   buildInputs = [ zookeeper bash ];
 
diff --git a/pkgs/development/ocaml-modules/curses/default.nix b/pkgs/development/ocaml-modules/curses/default.nix
index dc6b1751283..9bcf4fc411f 100644
--- a/pkgs/development/ocaml-modules/curses/default.nix
+++ b/pkgs/development/ocaml-modules/curses/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ocaml findlib ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index ba5a527fdb0..8f6c7c54cb2 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_LINK = [ "-ludev" ];
+  NIX_CFLAGS_LINK = "-ludev";
 
   meta = with stdenv.lib; {
     description = "Pythonic API to Linux uinput kernel module";
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index cc64e49e1b7..34282a5ec93 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -266,7 +266,7 @@ let
     '';
 
     # FIXME: Tensorflow uses dlopen() for CUDA libraries.
-    NIX_LDFLAGS = lib.optionals cudaSupport [ "-lcudart" "-lcublas" "-lcufft" "-lcurand" "-lcusolver" "-lcusparse" "-lcudnn" ];
+    NIX_LDFLAGS = lib.optionalString cudaSupport "-lcudart -lcublas -lcufft -lcurand -lcusolver -lcusparse -lcudnn";
 
     hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index 8cdcdd6f79d..0ec4b1510e9 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -16,9 +16,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake qttools ];
 
-  NIX_LDFLAGS = [
-    "-lQt5PrintSupport"
-  ];
+  NIX_LDFLAGS = "-lQt5PrintSupport";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/misc/openocd/default.nix b/pkgs/development/tools/misc/openocd/default.nix
index eea27b3e51f..88f75a3081b 100644
--- a/pkgs/development/tools/misc/openocd/default.nix
+++ b/pkgs/development/tools/misc/openocd/default.nix
@@ -25,13 +25,13 @@ stdenv.mkDerivation rec {
     "--enable-remote-bitbang"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     "-Wno-implicit-fallthrough"
     "-Wno-format-truncation"
     "-Wno-format-overflow"
     "-Wno-error=tautological-compare"
     "-Wno-error=array-bounds"
-  ];
+  ]);
 
   postInstall = lib.optionalString stdenv.isLinux ''
     mkdir -p "$out/etc/udev/rules.d"
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 068028c7da9..d8dab6b0358 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  NIX_LDFLAGS = [
-    "-lpcre"
-  ];
+  NIX_LDFLAGS = "-lpcre";
 
   buildPhase = ''
     HOME=$TMPDIR
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index 931c00ecce5..213c926521f 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -40,14 +40,9 @@ mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = [
-    "-lgvc"
-    "-lmysqlclient"
-    "-lecpg"
-    "-lssl"
-  ];
+  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
 
-  NIX_CFLAGS_COMPILE = [ "-L${libmysqlclient}/lib/mysql" "-I${libmysqlclient}/include/mysql" ];
+  NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
 
   qtWrapperArgs = [
     ''--prefix PATH : ${lib.getBin graphviz}/bin''
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index 8102235d88e..42464f71ae3 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     nvidia-texture-tools libsodium
   ] ++ lib.optional withEditor wxGTK;
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${xorgproto}/include/X11"
     "-I${libX11.dev}/include/X11"
     "-I${libXcursor.dev}/include/X11"
diff --git a/pkgs/games/macopix/default.nix b/pkgs/games/macopix/default.nix
index 2639765c5d1..7879b68c857 100644
--- a/pkgs/games/macopix/default.nix
+++ b/pkgs/games/macopix/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = "Mascot Constructive Pilot for X";
diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
index 4654456bd6c..c26536c5c2a 100644
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@@ -40,7 +40,7 @@ let
       "-DOpenGL_GL_PREFERENCE=GLVND"
     ];
 
-    NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+    NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
     nativeBuildInputs = [ cmake doxygen graphviz ];
 
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index 618e78553a5..2ad23a72368 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--no-werror" ];
 
   # Without this libvorbisfile.so is not getting linked properly for some reason.
-  NIX_CFLAGS_LINK = [ "-lvorbisfile" ];
+  NIX_CFLAGS_LINK = "-lvorbisfile";
 
   preBuild = ''
     sed -i 's/.dll//g' Makefile
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index d59afc330a7..f6841abb1d0 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -15,9 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake ogre cegui boost sfml openal ois ];
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   meta = with stdenv.lib; {
     description = "An open source, real time strategy game sharing game elements with the Dungeon Keeper series and Evil Genius.";
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index de05e1944f3..b00524461a4 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = [ "-lopenal" ];
+  NIX_CFLAGS_LINK = "-lopenal";
 
   meta = with stdenv.lib; {
     description = "A compatible client of Ace of Spades 0.75";
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index e32bc06b8f5..2e4ce270b82 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     "pokerth.pro"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${SDL.dev}/include/SDL" ];
+  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/rogue/default.nix b/pkgs/games/rogue/default.nix
index c8af2331b08..1e27d67eb03 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/games/rogue/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   buildInputs = [ ncurses ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   meta = with stdenv.lib; {
     homepage = http://rogue.rogueforge.net/rogue-5-4/;
diff --git a/pkgs/games/scorched3d/default.nix b/pkgs/games/scorched3d/default.nix
index a2859c11712..c86df396ff1 100644
--- a/pkgs/games/scorched3d/default.nix
+++ b/pkgs/games/scorched3d/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-fftw=${fftwSinglePrec.dev}" ];
 
-  NIX_LDFLAGS = [ "-lopenal" ];
+  NIX_LDFLAGS = "-lopenal";
 
   meta = with stdenv.lib; {
     homepage = http://scorched3d.co.uk/;
diff --git a/pkgs/games/tdm/default.nix b/pkgs/games/tdm/default.nix
index fef3350a061..949f5a3e2ab 100644
--- a/pkgs/games/tdm/default.nix
+++ b/pkgs/games/tdm/default.nix
@@ -91,7 +91,7 @@ EOF
 
   enableParallelBuilding = true;
   sconsFlags = [ "BUILD=release" "TARGET_ARCH=x64" ];
-  NIX_CFLAGS_COMPILE = ["-Wno-error=format-security"];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   meta = with stdenv.lib; {
     description = "The Dark Mod - stealth FPS inspired by the Thief series";
     homepage = "http://www.thedarkmod.com";
diff --git a/pkgs/games/tome4/default.nix b/pkgs/games/tome4/default.nix
index 2d9ef45a9e0..b31b53922ff 100644
--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -41,11 +41,7 @@ in stdenv.mkDerivation rec {
   # disable parallel building as it caused sporadic build failures
   enableParallelBuilding = false;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-    "-I${SDL2_image}/include/SDL2"
-    "-I${SDL2_ttf}/include/SDL2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
 
   makeFlags = [ "config=release" ];
 
diff --git a/pkgs/games/xbill/default.nix b/pkgs/games/xbill/default.nix
index 119cd8f0876..8a6d4cf14cd 100644
--- a/pkgs/games/xbill/default.nix
+++ b/pkgs/games/xbill/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 libXpm libXt motif ];
 
-  NIX_CFLAGS_LINK = [ "-lXpm" ];
+  NIX_CFLAGS_LINK = "-lXpm";
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/games/zoom/default.nix b/pkgs/games/zoom/default.nix
index 449d7ae6e2d..827fb351f1d 100644
--- a/pkgs/games/zoom/default.nix
+++ b/pkgs/games/zoom/default.nix
@@ -4,21 +4,15 @@
 
 stdenv.mkDerivation rec {
   name = "zoom-1.1.5";
-  
+
   src = fetchurl {
     url = "https://www.logicalshift.co.uk/unix/zoom/${name}.tar.gz";
     sha256 = "1g6van7f7sg3zfcz80mncnnbccyg2hnm0hq4x558vpsm0lf7z5pj";
   };
-  
-  buildInputs = [ perl expat xlibsWrapper freetype ];
-  
-  NIX_CFLAGS_COMPILE = [
-    # Zoom doesn't add the right directory in the include path.
-    "-I" (freetype + "/include/freetype2")
 
-    # for gcc5; c11 inline semantics breaks the build
-    "-fgnu89-inline"
-  ];
+  buildInputs = [ perl expat xlibsWrapper freetype ];
+
+  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
 
   meta = with stdenv.lib; {
     description = "Player for Z-Code, TADS and HUGO stories or games";
diff --git a/pkgs/misc/drivers/utsushi/default.nix b/pkgs/misc/drivers/utsushi/default.nix
index 8a8556b63df..ad7659d060a 100644
--- a/pkgs/misc/drivers/utsushi/default.nix
+++ b/pkgs/misc/drivers/utsushi/default.nix
@@ -26,11 +26,7 @@ stdenv.mkDerivation rec {
     libusb.dev
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=deprecated-declarations"
-    "-Wno-error=parentheses"
-    "-Wno-error=unused-variable"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=parentheses -Wno-error=unused-variable";
 
   postPatch = ''
     # remove vendored dependencies
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index 47b89f138c5..bfcf58a3530 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libxml2.dev}/include/libxml2" ];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with stdenv.lib; {
     description = "Performance monitoring tool for Linux";
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 5cb49485c5b..ec58d513b09 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = [ "-DENABLE_NOTIFICATIONS" ];
+  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/servers/amqp/qpid-cpp/default.nix b/pkgs/servers/amqp/qpid-cpp/default.nix
index bb7f7def077..97c1ec90ed1 100644
--- a/pkgs/servers/amqp/qpid-cpp/default.nix
+++ b/pkgs/servers/amqp/qpid-cpp/default.nix
@@ -33,7 +33,7 @@ let
       sed -i '/management/d' CMakeLists.txt
     '';
 
-    NIX_CFLAGS_COMPILE = [
+    NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=deprecated-declarations"
       "-Wno-error=int-in-bool-context"
       "-Wno-error=maybe-uninitialized"
diff --git a/pkgs/servers/computing/torque/default.nix b/pkgs/servers/computing/torque/default.nix
index 5e78fe742ac..8eb12a1b811 100644
--- a/pkgs/servers/computing/torque/default.nix
+++ b/pkgs/servers/computing/torque/default.nix
@@ -25,9 +25,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # added to fix build with gcc7
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error" "-fpermissive"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
 
   postPatch = ''
     substituteInPlace Makefile.am \
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 53773302963..328db9ec986 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip postgresql ];
   nativeBuildInputs = [ perl ];
 
-  NIX_CFLAGS_COMPILE = ["-I${libxml2.dev}/include/libxml2"];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
index 379a5c242f7..1467b1577f9 100644
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -84,10 +84,8 @@ stdenv.mkDerivation rec {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-    "-Wno-error=implicit-fallthrough"
-  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
+    + optionalString stdenv.isDarwin " -Wno-error=deprecated-declarations";
 
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
 
diff --git a/pkgs/servers/mail/opensmtpd/extras.nix b/pkgs/servers/mail/opensmtpd/extras.nix
index f7ed6382a7b..5a5fc537d6e 100644
--- a/pkgs/servers/mail/opensmtpd/extras.nix
+++ b/pkgs/servers/mail/opensmtpd/extras.nix
@@ -76,11 +76,10 @@ stdenv.mkDerivation rec {
     "--with-table-redis"
   ];
 
-  NIX_CFLAGS_COMPILE =
-    stdenv.lib.optional enableRedis
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString enableRedis
       "-I${hiredis}/include/hiredis -lhiredis"
-    ++ stdenv.lib.optional enableMysql
-      "-L${libmysqlclient}/lib/mysql";
+    + stdenv.lib.optionalString enableMysql
+      " -L${libmysqlclient}/lib/mysql";
 
   meta = with stdenv.lib; {
     homepage = https://www.opensmtpd.org/;
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index b3345f9420c..c0e6252a551 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
-  NIX_LDFLAGS = lib.optional withLDAP "-llber";
+  NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
 
   installTargets = [ "non-interactive-package" ];
 
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index 4c4ac4c5cb6..c2ae83f3e8a 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
   sconsFlags = [
     "--release"
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index ffede7d58b2..da7bfb445a9 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -60,10 +60,8 @@ in buildPythonApplication rec {
     ipaddress idna
   ];
 
-  NIX_CFLAGS_COMPILE = [
     # error: 'import_cairo' defined but not used
-    "-Wno-error=unused-function"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 007ae348bc2..54da1a16401 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat proj bzip2 zlib boost postgresql lua ];
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   meta = with stdenv.lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index 8dcaed706c1..46606e3b43b 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
   buildInputs = [ gtk2 hicolor-icon-theme ];
-  NIX_LDFLAGS = [ "-lgio-2.0" ];
+  NIX_LDFLAGS = "-lgio-2.0";
 
   preFixup = ''
     # Need which and xdotool on path to fix auto-pasting.
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 4428bf1e625..3e7e3870959 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index ee47c17065f..466a5f3faf1 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -49,9 +49,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index ec516555273..6a5ec867222 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index e48f2d7aa5b..4c8b926b582 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   };
 
   # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
+  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=format-truncation"
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index 8d16f71c4af..843985bfa3e 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 0c693ac6288..68f80106031 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -54,8 +54,8 @@ stdenv.mkDerivation rec {
     sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ]
-    ++ stdenv.lib.optional stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  NIX_CFLAGS_COMPILE = "-fpermissive"
+    + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
 
   meta = with stdenv.lib; {
     description = "High-speed web-based traffic analysis and flow collection tool";
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index 4ed0c3393bc..81da427a52c 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   buildInputs = stdenv.lib.optional tlsSupport openssl;
 
-  NIX_LDFLAGS = stdenv.lib.optional tlsSupport [ "-lcrypto" ];
+  NIX_LDFLAGS = stdenv.lib.optionalString tlsSupport "-lcrypto";
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 4062fc0fd58..1d3c4190e38 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-lua=yes" ];
 
-  NIX_LDFLAGS = [ "${libpcap}/lib/libpcap.so" "${libcrafter}/lib/libcrafter.so" ];
+  NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
 
   preAutoreconf = ''
     substituteInPlace Makefile.am --replace "noinst" ""
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 9c8f46bef07..98705430c2f 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,13 +22,13 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
-  
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+
   installPhase = ''
     mkdir -p $out/bin
     cp wrk $out/bin
   '';
-  
+
   meta = with stdenv.lib; {
     description = "HTTP benchmarking tool";
     homepage = https://github.com/wg/wrk;
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 2be1db764e1..7ff079c0116 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cert-paths.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index ff6a6e03cc8..487d6541b5f 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     ./no-files-in-etc-and-var.patch
   ];
 
-  NIX_CFLAGS_COMPILE = optional withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 5a3ba8b6619..64c184a6122 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isi686 "-Wno-error=format";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index c8748efc302..7d3e62d7beb 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/text/multitran/libmtquery/default.nix b/pkgs/tools/text/multitran/libmtquery/default.nix
index 8b2032dcaba..baccdfdedba 100644
--- a/pkgs/tools/text/multitran/libmtquery/default.nix
+++ b/pkgs/tools/text/multitran/libmtquery/default.nix
@@ -9,9 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmtsupport libfacet libbtree multitrandata ];
 
-  NIX_LDFLAGS = [
-    "-lbtree"
-  ];
+  NIX_LDFLAGS = "-lbtree";
 
   patchPhase = ''
     sed -i -e 's@\$(DESTDIR)/usr@'$out'@' \