diff --git a/maintainers/scripts/nixpkgs-lint.nix b/maintainers/scripts/nixpkgs-lint.nix
index b0267281b389..873905373af0 100644
--- a/maintainers/scripts/nixpkgs-lint.nix
+++ b/maintainers/scripts/nixpkgs-lint.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation {
   name = "nixpkgs-lint-1";
 
-  buildInputs = [ makeWrapper perl perlPackages.XMLSimple ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl perlPackages.XMLSimple ];
 
   dontUnpack = true;
   buildPhase = "true";
diff --git a/pkgs/applications/audio/MMA/default.nix b/pkgs/applications/audio/MMA/default.nix
index ade595732c3b..25cb96965092 100644
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@@ -9,7 +9,8 @@
     sha256 = "18k0hwlqky5x4y461fxmw77gvz7z8jyrvxicrqphsgvwwinzy732";
   };
 
-  buildInputs = [ makeWrapper python3 alsaUtils timidity ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 alsaUtils timidity ];
 
   patchPhase = ''
     sed -i 's@/usr/bin/aplaymidi@/${alsaUtils}/bin/aplaymidi@g' mma-splitrec
diff --git a/pkgs/applications/audio/baudline/default.nix b/pkgs/applications/audio/baudline/default.nix
index 29c5130f575c..7d6d51011cc2 100644
--- a/pkgs/applications/audio/baudline/default.nix
+++ b/pkgs/applications/audio/baudline/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     else
       throw "baudline isn't supported (yet?) on ${stdenv.hostPlatform.system}";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # Prebuilt binary distribution.
   # "patchelf --set-rpath" seems to break the application (cannot start), using
diff --git a/pkgs/applications/audio/caudec/default.nix b/pkgs/applications/audio/caudec/default.nix
index 0360922c8196..15ebb85136b0 100644
--- a/pkgs/applications/audio/caudec/default.nix
+++ b/pkgs/applications/audio/caudec/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     patchShebangs ./install.sh
   '';
 
-  buildInputs = [ bash makeWrapper ];
+  nativeBuildInputs = [ bash makeWrapper ];
 
   installPhase = ''
     ./install.sh --prefix=$out/bin
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index be0f2f72529c..e665edabd074 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -24,7 +24,7 @@ let
     ./clementine-spotify-blob.patch
   ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
 
   buildInputs = [
     boost
@@ -68,7 +68,7 @@ let
     inherit src patches nativeBuildInputs postPatch;
 
     # gst_plugins needed for setup-hooks
-    buildInputs = buildInputs ++ [ makeWrapper ] ++ gst_plugins;
+    buildInputs = buildInputs ++ gst_plugins;
 
     preConfigure = ''
       rm -rf ext/{,lib}clementine-spotifyblob
@@ -102,7 +102,7 @@ let
     # Use the same patches and sources as Clementine
     inherit src nativeBuildInputs patches postPatch;
 
-    buildInputs = buildInputs ++ [ libspotify makeWrapper ];
+    buildInputs = buildInputs ++ [ libspotify ];
     # Only build and install the Spotify blob
     preBuild = ''
       cd ext/clementine-spotifyblob
diff --git a/pkgs/applications/audio/clerk/default.nix b/pkgs/applications/audio/clerk/default.nix
index 0724632a63e1..a2e71b955ec4 100644
--- a/pkgs/applications/audio/clerk/default.nix
+++ b/pkgs/applications/audio/clerk/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0y045my65hr3hjyx13jrnyg6g3wb41phqb1m7azc4l6vx6r4124b";
   };
 
-  buildInputs = [ makeWrapper pythonPackages.mpd2 ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pythonPackages.mpd2 ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/audio/deadbeef/wrapper.nix b/pkgs/applications/audio/deadbeef/wrapper.nix
index cd45ef5926b0..66108deab1e3 100644
--- a/pkgs/applications/audio/deadbeef/wrapper.nix
+++ b/pkgs/applications/audio/deadbeef/wrapper.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ deadbeef ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/deadbeef \
diff --git a/pkgs/applications/audio/faust/faust1.nix b/pkgs/applications/audio/faust/faust1.nix
index 6d7d2e2c2bae..81ce11b9ea19 100644
--- a/pkgs/applications/audio/faust/faust1.nix
+++ b/pkgs/applications/audio/faust/faust1.nix
@@ -30,7 +30,7 @@ let
 
     inherit src;
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     passthru = {
       inherit wrap wrapWithBuildEnv;
@@ -159,8 +159,7 @@ let
 
     stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ pkg-config makeWrapper ];
 
       propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
 
@@ -195,7 +194,7 @@ let
 
     in stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       postFixup = ''
         for script in "$out"/bin/*; do
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 990d073528e1..051caf120fa2 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -168,8 +168,7 @@ let
 
     stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ pkg-config makeWrapper ];
 
       propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
 
@@ -209,7 +208,7 @@ let
 
     in stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       postFixup = ''
         for script in "$out"/bin/*; do
diff --git a/pkgs/applications/audio/google-play-music-desktop-player/default.nix b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
index 0be1cc45717b..f86eed1d34da 100644
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
   };
 
   dontBuild = true;
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ dpkg makeWrapper ];
 
   unpackPhase = ''
     dpkg -x $src .
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index f111c4e99d7c..325d115b5816 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g5v74cm0q3p3pzl6xmnp4rqayaymfli7c6z8s78h9rgd24fwbvn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 makeWrapper ]
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
   NIX_LDFLAGS = "-ldl";
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index eb355a434096..74bbeb9b7bb7 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation  rec {
   # http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/822346
   patches = [ ./socket.patch ./gcc-47.patch ];
 
-  buildInputs = [ alsaLib gtk2 libjack2 libxml2 makeWrapper
-    pkg-config readline ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ alsaLib gtk2 libjack2 libxml2 readline ];
   propagatedBuildInputs = [ libuuid ];
   NIX_LDFLAGS = "-lm -lpthread -luuid";
 
diff --git a/pkgs/applications/audio/linuxband/default.nix b/pkgs/applications/audio/linuxband/default.nix
index 118b54ad8587..ec034ae238de 100644
--- a/pkgs/applications/audio/linuxband/default.nix
+++ b/pkgs/applications/audio/linuxband/default.nix
@@ -11,8 +11,8 @@ in stdenv.mkDerivation rec {
     sha256 = "1r71h4yg775m4gax4irrvygmrsclgn503ykmc2qwjsxa42ri4n2n";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper MMA libjack2 libsmf python pyGtkGlade pygtksourceview ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ MMA libjack2 libsmf python pyGtkGlade pygtksourceview ];
 
   patchPhase = ''
     sed -i 's@/usr/@${MMA}/@g' src/main/config/linuxband.rc.in
diff --git a/pkgs/applications/audio/puredata/wrapper.nix b/pkgs/applications/audio/puredata/wrapper.nix
index 80968e2700b4..3444ef9acbdc 100644
--- a/pkgs/applications/audio/puredata/wrapper.nix
+++ b/pkgs/applications/audio/puredata/wrapper.nix
@@ -7,7 +7,7 @@ in symlinkJoin {
 
   paths = [ puredata ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/pd \
diff --git a/pkgs/applications/audio/real_time_config_quick_scan/default.nix b/pkgs/applications/audio/real_time_config_quick_scan/default.nix
index 3fb476b65cc4..8bc2553f521b 100644
--- a/pkgs/applications/audio/real_time_config_quick_scan/default.nix
+++ b/pkgs/applications/audio/real_time_config_quick_scan/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "16kanzp5i353x972zjkwgi3m8z90wc58613mlfzb0n01djdnm6k5";
   };
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/audio/rubyripper/default.nix b/pkgs/applications/audio/rubyripper/default.nix
index b7abfa40b863..e8a275db98d8 100644
--- a/pkgs/applications/audio/rubyripper/default.nix
+++ b/pkgs/applications/audio/rubyripper/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
   preConfigure = "patchShebangs .";
 
   configureFlags = [ "--enable-cli" ];
-  buildInputs = [ ruby cdparanoia makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ruby cdparanoia ];
   postInstall = ''
     wrapProgram "$out/bin/rrip_cli" \
       --prefix PATH : "${ruby}/bin" \
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 43ecb67d64a3..655a047a3a63 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -81,7 +81,8 @@ stdenv.mkDerivation {
     sha512 = "5b3d5d1f52a554c8e775b8aed16ef84e96bf3b61a2b53266e10d3c47e341899310af13cc8513b04424fc14532e36543a6fae677f80a036e3f51c75166d8d53d1";
   };
 
-  buildInputs = [ squashfsTools makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ squashfsTools ];
 
   dontStrip = true;
   dontPatchELF = true;
diff --git a/pkgs/applications/audio/vkeybd/default.nix b/pkgs/applications/audio/vkeybd/default.nix
index 3409d8a49070..943bd0d8032b 100644
--- a/pkgs/applications/audio/vkeybd/default.nix
+++ b/pkgs/applications/audio/vkeybd/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation  rec {
     sha256 = "0107b5j1gf7dwp7qb4w2snj4bqiyps53d66qzl2rwj4jfpakws5a";
   };
 
-  buildInputs = [ alsaLib libX11 makeWrapper tcl tk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ alsaLib libX11 tcl tk ];
 
   configurePhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index cff482e887d3..2c067250309b 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -162,7 +162,7 @@ in rec {
       # Eclipse.
       name = (lib.meta.appendToName "with-plugins" eclipse).name;
     in
-      runCommand name { buildInputs = [ makeWrapper ]; } ''
+      runCommand name { nativeBuildInputs = [ makeWrapper ]; } ''
         mkdir -p $out/bin $out/etc
 
         # Prepare an eclipse.ini with the plugin directory.
diff --git a/pkgs/applications/editors/kakoune/wrapper.nix b/pkgs/applications/editors/kakoune/wrapper.nix
index 7ac56d9cb1e0..451507885ce0 100644
--- a/pkgs/applications/editors/kakoune/wrapper.nix
+++ b/pkgs/applications/editors/kakoune/wrapper.nix
@@ -9,7 +9,7 @@ in
   symlinkJoin {
     name = "kakoune-${kakoune.version}";
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     paths = [ kakoune ] ++ requestedPlugins;
 
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index e0704cdbc859..aa7b7b194486 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -29,7 +29,8 @@ in
         inherit sha256;
     };
 
-    buildInputs = [ makeWrapper libXScrnSaver ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ libXScrnSaver ];
 
     desktopItem = makeDesktopItem {
       name = "kodestudio";
diff --git a/pkgs/applications/editors/music/tuxguitar/default.nix b/pkgs/applications/editors/music/tuxguitar/default.nix
index 63be87ee86c7..90879b352e18 100644
--- a/pkgs/applications/editors/music/tuxguitar/default.nix
+++ b/pkgs/applications/editors/music/tuxguitar/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = metadata.sha256;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 5c6c6c1a8d57..41ff62a619fb 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -106,7 +106,7 @@ let
 
     preferLocalBuild = true;
 
-    buildInputs = [makeWrapper];
+    nativeBuildInputs = [ makeWrapper ];
     passthru = { unwrapped = neovim; };
 
     meta = neovim.meta // {
diff --git a/pkgs/applications/editors/netbeans/default.nix b/pkgs/applications/editors/netbeans/default.nix
index 9206b296b9ac..f968b85c6ff1 100644
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@@ -56,7 +56,8 @@ stdenv.mkDerivation {
     ln -s ${desktopItem}/share/applications/* $out/share/applications
   '';
 
-  buildInputs = [ makeWrapper perl python unzip libicns imagemagick ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl python unzip libicns imagemagick ];
 
   meta = {
     description = "An integrated development environment for Java, C, C++ and PHP";
diff --git a/pkgs/applications/editors/supertux-editor/default.nix b/pkgs/applications/editors/supertux-editor/default.nix
index e474ff5f19bb..6e3580a563cc 100644
--- a/pkgs/applications/editors/supertux-editor/default.nix
+++ b/pkgs/applications/editors/supertux-editor/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "08y5haclgxvcii3hpdvn1ah8qd0f3n8xgxxs8zryj02b8n7cz3vx";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [mono gtk-sharp-2_0 makeWrapper gnome2.libglade gtk2 ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [mono gtk-sharp-2_0 gnome2.libglade gtk2 ];
 
   installPhase = ''
     mkdir -p $out/bin $out/lib/supertux-editor
diff --git a/pkgs/applications/editors/vim/macvim-configurable.nix b/pkgs/applications/editors/vim/macvim-configurable.nix
index 6ea6b6c60940..7ed3dee9b6b9 100644
--- a/pkgs/applications/editors/vim/macvim-configurable.nix
+++ b/pkgs/applications/editors/vim/macvim-configurable.nix
@@ -29,7 +29,7 @@ let
           "/Applications/MacVim.app/Contents/MacOS"
           "/Applications/MacVim.app/Contents/bin"
         ];
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
         # We need to do surgery on the resulting app. We can't just make a wrapper for vim because this
         # is a GUI app. We need to copy the actual GUI executable image as AppKit uses the loaded image's
         # path to locate the bundle. We can use symlinks for other executables and resources though.
diff --git a/pkgs/applications/editors/vscode/with-extensions.nix b/pkgs/applications/editors/vscode/with-extensions.nix
index c30b52782ef3..d2c91f155d53 100644
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@@ -57,7 +57,8 @@ in
 # When no extensions are requested, we simply redirect to the original
 # non-wrapped vscode executable.
 runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}" {
-  buildInputs = [ vscode makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ vscode ];
   dontPatchELF = true;
   dontStrip = true;
   meta = vscode.meta;
diff --git a/pkgs/applications/graphics/gimp/wrapper.nix b/pkgs/applications/graphics/gimp/wrapper.nix
index 8fde04d0d1df..bb81a374fea2 100644
--- a/pkgs/applications/graphics/gimp/wrapper.nix
+++ b/pkgs/applications/graphics/gimp/wrapper.nix
@@ -11,7 +11,7 @@ in symlinkJoin {
 
   paths = [ gimp ] ++ selectedPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for each in gimp-${versionBranch} gimp-console-${versionBranch}; do
diff --git a/pkgs/applications/graphics/glimpse/wrapper.nix b/pkgs/applications/graphics/glimpse/wrapper.nix
index cdfb2f668731..daa540d31e50 100644
--- a/pkgs/applications/graphics/glimpse/wrapper.nix
+++ b/pkgs/applications/graphics/glimpse/wrapper.nix
@@ -12,7 +12,7 @@ symlinkJoin {
 
   paths = [ glimpse ] ++ selectedPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for each in glimpse-${versionBranch} glimpse-console-${versionBranch}; do
diff --git a/pkgs/applications/graphics/imagej/default.nix b/pkgs/applications/graphics/imagej/default.nix
index 7e3238e94bbc..312316b33974 100644
--- a/pkgs/applications/graphics/imagej/default.nix
+++ b/pkgs/applications/graphics/imagej/default.nix
@@ -15,7 +15,8 @@ let
       url = "https://wsr.imagej.net/distros/cross-platform/ij150.zip";
       sha256 = "97aba6fc5eb908f5160243aebcdc4965726693cb1353d9c0d71b8f5dd832cb7b";
     };
-    buildInputs = [ unzip makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ unzip ];
     inherit jre;
 
     # JAR files that are intended to be used by other packages
diff --git a/pkgs/applications/graphics/inkscape/with-extensions.nix b/pkgs/applications/graphics/inkscape/with-extensions.nix
index cca7b1fc3a54..c558a6bb0622 100644
--- a/pkgs/applications/graphics/inkscape/with-extensions.nix
+++ b/pkgs/applications/graphics/inkscape/with-extensions.nix
@@ -10,7 +10,7 @@ symlinkJoin {
 
   paths = [ inkscape ] ++ inkscapeExtensions;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     rm -f $out/bin/inkscape
diff --git a/pkgs/applications/graphics/tesseract/wrapper.nix b/pkgs/applications/graphics/tesseract/wrapper.nix
index 313920d8154e..1dfc4393c46b 100644
--- a/pkgs/applications/graphics/tesseract/wrapper.nix
+++ b/pkgs/applications/graphics/tesseract/wrapper.nix
@@ -17,7 +17,7 @@ let
   tesseractWithData = tesseractBase.overrideAttrs (_: {
     inherit tesseractBase tessdata;
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     buildCommand = ''
       makeWrapper {$tesseractBase,$out}/bin/tesseract --set-default TESSDATA_PREFIX $out/share/tessdata
diff --git a/pkgs/applications/graphics/unigine-valley/default.nix b/pkgs/applications/graphics/unigine-valley/default.nix
index 0c5c8f3ff281..3187f573de70 100644
--- a/pkgs/applications/graphics/unigine-valley/default.nix
+++ b/pkgs/applications/graphics/unigine-valley/default.nix
@@ -38,7 +38,7 @@ in
     sourceRoot = "Unigine_Valley-${version}";
     instPath = "lib/unigine/valley";
 
-    buildInputs = [file makeWrapper];
+    nativeBuildInputs = [file makeWrapper];
 
     libPath = lib.makeLibraryPath [
       stdenv.cc.cc  # libstdc++.so.6
diff --git a/pkgs/applications/misc/ape/default.nix b/pkgs/applications/misc/ape/default.nix
index f16d6e157332..c359d606a859 100644
--- a/pkgs/applications/misc/ape/default.nix
+++ b/pkgs/applications/misc/ape/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
   inherit pname;
   version = "2019-08-10";
 
-  buildInputs = [ swiProlog makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ swiProlog ];
 
   src = fetchFromGitHub {
      owner = "Attempto";
diff --git a/pkgs/applications/misc/audio/wavesurfer/default.nix b/pkgs/applications/misc/audio/wavesurfer/default.nix
index 6e276d592b0e..b7e738cfc125 100644
--- a/pkgs/applications/misc/audio/wavesurfer/default.nix
+++ b/pkgs/applications/misc/audio/wavesurfer/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1yx9s1j47cq0v40cwq2gn7bdizpw46l95ba4zl9z4gg31mfvm807";
   };
 
-  buildInputs = [ snack tcl tk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ snack tcl tk ];
 
   installPhase = ''
     mkdir -p $out/{bin,nix-support,share/wavesurfer/}
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
index 4a023849f390..d50f36379881 100644
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     sha256 = "044nxgd3ic2qr6hgq5nymn3dyf5i4s8mv5z4az6jvwlrjnvbg8cp";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   patchPhase = ''
     patchShebangs install.sh
diff --git a/pkgs/applications/misc/cli-visualizer/default.nix b/pkgs/applications/misc/cli-visualizer/default.nix
index 74dd82a3c6e5..524f89855370 100644
--- a/pkgs/applications/misc/cli-visualizer/default.nix
+++ b/pkgs/applications/misc/cli-visualizer/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
     sed '1i#include <cmath>' -i src/Transformer/SpectrumCircleTransformer.cpp
   '';
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake makeWrapper ];
 
-  buildInputs = [ fftw ncurses5 libpulseaudio makeWrapper ];
+  buildInputs = [ fftw ncurses5 libpulseaudio ];
 
   buildFlags = [ "ENABLE_PULSE=1" ];
 
diff --git a/pkgs/applications/misc/clipmenu/default.nix b/pkgs/applications/misc/clipmenu/default.nix
index e3a0046205e0..c47dd972ccfd 100644
--- a/pkgs/applications/misc/clipmenu/default.nix
+++ b/pkgs/applications/misc/clipmenu/default.nix
@@ -27,8 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
-  buildInputs = [ makeWrapper ];
-  nativeBuildInputs = [ xsel clipnotify ];
+  nativeBuildInputs = [ makeWrapper xsel clipnotify ];
 
   postFixup = ''
     sed -i "$out/bin/clipctl" -e 's,clipmenud\$,\.clipmenud-wrapped\$,'
diff --git a/pkgs/applications/misc/ding/default.nix b/pkgs/applications/misc/ding/default.nix
index 36e2923522de..649fbe55fae2 100644
--- a/pkgs/applications/misc/ding/default.nix
+++ b/pkgs/applications/misc/ding/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aabIH894WihsBTo1LzIBzIZxxyhRYVxLcHpDQwmwmOU=";
   };
 
-  buildInputs = [ aspellEnv fortune gnugrep makeWrapper tk tre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ aspellEnv fortune gnugrep tk tre ];
 
   patches = [ ./dict.patch ];
 
diff --git a/pkgs/applications/misc/gremlin-console/default.nix b/pkgs/applications/misc/gremlin-console/default.nix
index 6c3ba132d0b2..22444e22054a 100644
--- a/pkgs/applications/misc/gremlin-console/default.nix
+++ b/pkgs/applications/misc/gremlin-console/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "13ycr6ppyrz9rq7dasabjdk8lcsxdj3krb4j7d2jmbh2hij1rdvf";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/opt
diff --git a/pkgs/applications/misc/icesl/default.nix b/pkgs/applications/misc/icesl/default.nix
index 9f1431a23409..5c50ac245381 100644
--- a/pkgs/applications/misc/icesl/default.nix
+++ b/pkgs/applications/misc/icesl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0sl54fsb2gz6dy0bwdscpdq1ab6ph5b7zald3bwzgkqsvna7p1jr";
   } else throw "Unsupported architecture";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     cp -r ./ $out
     mkdir $out/oldbin
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 28c7de12c8c8..3828fc654d65 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  buildInputs = lib.optionals (!stdenv.isDarwin) [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = lib.optionals (!stdenv.isDarwin) [ jre ];
 
   installPhase =
     if stdenv.isDarwin then ''
diff --git a/pkgs/applications/misc/keepass/default.nix b/pkgs/applications/misc/keepass/default.nix
index 32572ffcdb3b..6388d005fe55 100644
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@@ -12,7 +12,8 @@ with builtins; buildDotnetPackage rec {
 
   sourceRoot = ".";
 
-  buildInputs = [ unzip makeWrapper icoutils ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip icoutils ];
 
   patches = [
     (substituteAll {
diff --git a/pkgs/applications/misc/mpvc/default.nix b/pkgs/applications/misc/mpvc/default.nix
index 64b55cce7a04..69aca239d311 100644
--- a/pkgs/applications/misc/mpvc/default.nix
+++ b/pkgs/applications/misc/mpvc/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/mpvc --prefix PATH : "${socat}/bin/"
   '';
 
-  buildInputs = [ socat makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ socat ];
 
   meta = with lib; {
     description = "A mpc-like control interface for mpv";
diff --git a/pkgs/applications/misc/omegat.nix b/pkgs/applications/misc/omegat.nix
index 7b91d245f810..2bb3d14e1d25 100644
--- a/pkgs/applications/misc/omegat.nix
+++ b/pkgs/applications/misc/omegat.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "0axz7r30p34z5hgvdglznc82g7yvm3g56dv5190jixskx6ba58rs";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   unpackCmd = "unzip -o $curSrc";  # tries to go interactive without -o
 
diff --git a/pkgs/applications/misc/openjump/default.nix b/pkgs/applications/misc/openjump/default.nix
index 28becefa5b12..b3e93ce51271 100644
--- a/pkgs/applications/misc/openjump/default.nix
+++ b/pkgs/applications/misc/openjump/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation {
     cd $out; unzip $src
   '';
 
-  buildInputs = [unzip makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase = ''
     dir=$(echo $out/OpenJUMP-*)
diff --git a/pkgs/applications/misc/projectlibre/default.nix b/pkgs/applications/misc/projectlibre/default.nix
index fd83d74edd54..ceb61d71866c 100644
--- a/pkgs/applications/misc/projectlibre/default.nix
+++ b/pkgs/applications/misc/projectlibre/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vy5vgbp45ai957gaby2dj1hvmbxfdlfnwcanwqm9f8q16qipdbq";
   };
 
-  buildInputs = [ ant jdk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ant jdk ];
   buildPhase = ''
     export ANT_OPTS=-Dbuild.sysclasspath=ignore
     ${ant}/bin/ant -f openproj_build/build.xml
diff --git a/pkgs/applications/misc/sidequest/default.nix b/pkgs/applications/misc/sidequest/default.nix
index 6dad2eaf8128..c904c2212604 100644
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@@ -19,7 +19,7 @@
         sha256 = "0fw952kdh1gn00y6sx2ag0rnb2paxq9ikg4bzgmbj7rrd1c6l2k9";
       };
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       buildCommand = ''
         mkdir -p "$out/lib/SideQuest" "$out/bin"
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index afbf5b364ed4..e1be229b087b 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -34,7 +34,8 @@ let
       patchelf --set-rpath ${libXxf86vm}/lib lib/java3d-1.6/linux/i586/libnativewindow_x11.so
     '';
 
-    buildInputs = [ ant jdk makeWrapper p7zip gtk3 gsettings-desktop-schemas ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ ant jdk p7zip gtk3 gsettings-desktop-schemas ];
 
     buildPhase = ''
       ant furniture textures help
diff --git a/pkgs/applications/misc/sweethome3d/editors.nix b/pkgs/applications/misc/sweethome3d/editors.nix
index 08bc5b90fd9c..c0cdc764dc34 100644
--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@@ -23,7 +23,8 @@ let
       categories = "Graphics;2DGraphics;3DGraphics;";
     };
 
-    buildInputs = [ ant jre jdk makeWrapper gtk3 gsettings-desktop-schemas ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ ant jre jdk gtk3 gsettings-desktop-schemas ];
 
     patchPhase = ''
       sed -i -e 's,../SweetHome3D,${application.src},g' build.xml
diff --git a/pkgs/applications/misc/tabula/default.nix b/pkgs/applications/misc/tabula/default.nix
index 1804f3c04e89..b396c578c903 100644
--- a/pkgs/applications/misc/tabula/default.nix
+++ b/pkgs/applications/misc/tabula/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
 
   installPhase = ''
diff --git a/pkgs/applications/misc/translate-shell/default.nix b/pkgs/applications/misc/translate-shell/default.nix
index 03ed031be857..319ba3643da4 100644
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "075vqnha21rhr1b61dim7dqlfwm1yffyzcaa83s36rpk9r5sddzx";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/misc/viking/default.nix b/pkgs/applications/misc/viking/default.nix
index 61ebfb0fcc6a..71f67baa6c5c 100644
--- a/pkgs/applications/misc/viking/default.nix
+++ b/pkgs/applications/misc/viking/default.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper intltool gettext gtk2 expat curl gpsd bc file gnome-doc-utils
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ intltool gettext gtk2 expat curl gpsd bc file gnome-doc-utils
     libexif libxml2 libxslt scrollkeeper docbook_xml_dtd_412 gexiv2
   ] ++ lib.optional withMapnik mapnik
     ++ lib.optional withGeoClue geoclue2
diff --git a/pkgs/applications/misc/wordnet/default.nix b/pkgs/applications/misc/wordnet/default.nix
index 32c1f0eaa64a..27694174d703 100644
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "08pgjvd2vvmqk3h641x63nxp7wqimb9r30889mkyfh2agc62sjbc";
   };
 
-  buildInputs = [ tcl tk xlibsWrapper makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk xlibsWrapper ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/misc/xfontsel/default.nix b/pkgs/applications/misc/xfontsel/default.nix
index 10034fbe1b1d..365f6217861b 100644
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0700lf6hx7dg88wq1yll7zjvf9gbwh06xff20yffkxb289y0pai5";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libX11 makeWrapper libXaw];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [libX11 libXaw];
 
   # Without this, it gets Xmu as a dependency, but without rpath entry
   NIX_LDFLAGS = "-lXmu";
diff --git a/pkgs/applications/misc/zathura/wrapper.nix b/pkgs/applications/misc/zathura/wrapper.nix
index 60e3bb9fd535..49f78729a310 100644
--- a/pkgs/applications/misc/zathura/wrapper.nix
+++ b/pkgs/applications/misc/zathura/wrapper.nix
@@ -4,8 +4,7 @@ symlinkJoin {
 
   paths = with zathura_core; [ man dev out ] ++ plugins;
 
-
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = let
     fishCompletion = "share/fish/vendor_completions.d/zathura.fish";
diff --git a/pkgs/applications/networking/charles/default.nix b/pkgs/applications/networking/charles/default.nix
index 03d1911333e3..1dd0b408a138 100644
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -28,7 +28,7 @@ let
         url = "https://www.charlesproxy.com/assets/release/${version}/charles-proxy-${version}.tar.gz";
         inherit sha256;
       };
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       installPhase = ''
         makeWrapper ${jdk8.jre}/bin/java $out/bin/charles \
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 071636ec4431..76230b8e1003 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "1a9w5k0207fysgpxx6db3a00fs5hdc2ncx99x4ccy2s0v5ndc66g";
   };
 
-  buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre pythonPackages.python pythonPackages.numpy ]
     ++ optional RSupport R;
 
   untarDir = "${pname}-${version}-bin-without-hadoop";
diff --git a/pkgs/applications/networking/cluster/ssm-agent/default.nix b/pkgs/applications/networking/cluster/ssm-agent/default.nix
index 928fb351c6a0..b042f8ff15f3 100644
--- a/pkgs/applications/networking/cluster/ssm-agent/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-agent/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
     "agent/cli-main"
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     rev    = version;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 59a7039fb280..4a6e95057a4d 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -117,7 +117,7 @@ let
         else
           lib.appendToName "with-plugins" (stdenv.mkDerivation {
             inherit (terraform) name meta;
-            buildInputs = [ makeWrapper ];
+            nativeBuildInputs = [ makeWrapper ];
 
             buildCommand = pluginDir + ''
               mkdir -p $out/bin/
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 17ace3021d87..714ca1c8990f 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "13lzvjli6kbsnkd7lf0rm71l2mnz38pxk76ia9yrjb6clfhlbb73";
   };
 
-  buildInputs = [ makeWrapper pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/gomuks/default.nix b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
index a2d12124dbf1..428e4e706011 100644
--- a/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@@ -26,7 +26,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildInputs = [ makeWrapper olm ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ olm ];
 
   # Upstream issue: https://github.com/tulir/gomuks/issues/260
   patches = lib.optional stdenv.isLinux (substituteAll {
diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index f3736bfc64f6..cbbe74481c23 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation {
     sha256 = "03pz8wskafn848yvciq29kwdvqcgjrk6sjnm8nk9acl89xf0sn96";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     ar x $src
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
index bc66d77e2246..041ec5e7c5ba 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1argdzbif1vdmwp5vqbgkadq9ancjmgdm2ncp0qfckni715ss4rh";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib telepathy-glib dbus-glib libxslt telepathy-glib.python (lib.getLib dconf) makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ glib telepathy-glib dbus-glib libxslt telepathy-glib.python (lib.getLib dconf) ];
 
   preFixup = ''
     wrapProgram "$out/libexec/telepathy-idle" \
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/applications/networking/instant-messengers/viber/default.nix
index 4389ee153c56..0224edc652fa 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0rs26x0lycavybn6k1hbb5kzms0zzcmxlrmi4g8k7vyafj6s8dqh";
   };
 
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ dpkg ];
 
   dontUnpack = true;
 
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/applications/networking/insync/default.nix
index b52a81932e4f..380aad6c3291 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@@ -12,9 +12,7 @@ stdenv.mkDerivation rec {
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
 
-  buildInputs = [ makeWrapper ];
-
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
 
   postPatch = ''
     patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" client/insync-portable
diff --git a/pkgs/applications/networking/jnetmap/default.nix b/pkgs/applications/networking/jnetmap/default.nix
index bac0048cc28d..e6332832e3ec 100644
--- a/pkgs/applications/networking/jnetmap/default.nix
+++ b/pkgs/applications/networking/jnetmap/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nxsfa600jhazwbabxmr9j37mhwysp0fyrvczhv3f1smiy8rjanl";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   dontUnpack = true;
 
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
index 050082c6f933..ea3f09b8f4c3 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
@@ -4,7 +4,7 @@ symlinkJoin {
   name = "evolution-with-plugins";
   paths = [ gnome3.evolution-data-server ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for i in $out/bin/* $out/libexec/**; do
diff --git a/pkgs/applications/networking/p2p/vuze/default.nix b/pkgs/applications/networking/p2p/vuze/default.nix
index 557914439a9c..fe8743ee1cd1 100644
--- a/pkgs/applications/networking/p2p/vuze/default.nix
+++ b/pkgs/applications/networking/p2p/vuze/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "07w6ipyiy8hi88d6yxbbf3vkv26mj7dcz9yr8141hb2ig03v0h0p";
   };
 
-  buildInputs = [ makeWrapper jdk ant ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ant ];
 
   buildPhase = "ant";
 
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index a9ddf48bae60..f52373f2624d 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -52,7 +52,7 @@ let
       url = "https://download3.vmware.com/software/view/viewclients/CART21FQ4/VMware-Horizon-Client-Linux-2012-8.1.0-17349998.tar.gz";
       sha256 = "0afda1f3116e75a4e7f89990d8ee60ccea5f3bb8a2360652162fa11c795724ce";
     };
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
       mkdir ext $out
       find ${sysArch} -type f -print0 | xargs -0n1 tar -Cext --strip-components=1 -xf
diff --git a/pkgs/applications/networking/sync/unison/default.nix b/pkgs/applications/networking/sync/unison/default.nix
index 86126e861699..23bbd19b00e8 100644
--- a/pkgs/applications/networking/sync/unison/default.nix
+++ b/pkgs/applications/networking/sync/unison/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation (rec {
     sha256 = "sha256-42hmdMwOYSWGiDCmhuqtpCWtvtyD2l+kA/bhHD/Qh5Y=";
   };
 
-  buildInputs = [ ocaml makeWrapper ncurses ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml ncurses ];
 
   preBuild = (if enableX11 then ''
     sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${lablgtk}"/lib/ocaml/*/site-lib/lablgtk2)|" src/Makefile.OCaml
diff --git a/pkgs/applications/networking/tsung/default.nix b/pkgs/applications/networking/tsung/default.nix
index 41bc6c64da80..346fd1752578 100644
--- a/pkgs/applications/networking/tsung/default.nix
+++ b/pkgs/applications/networking/tsung/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "6394445860ef34faedf8c46da95a3cb206bc17301145bc920151107ffa2ce52a";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [
     erlang
     gnuplot
diff --git a/pkgs/applications/networking/wg-bond/default.nix b/pkgs/applications/networking/wg-bond/default.nix
index 32ffbde400b1..bef44d428627 100644
--- a/pkgs/applications/networking/wg-bond/default.nix
+++ b/pkgs/applications/networking/wg-bond/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1v2az0v6l8mqryvq3898hm7bpvqdd2c4kpv6ck7932jfjyna512k";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   postInstall = ''
     wrapProgram $out/bin/wg-bond --set PATH ${
       lib.makeBinPath [ wireguard-tools ]
diff --git a/pkgs/applications/office/docear/default.nix b/pkgs/applications/office/docear/default.nix
index 683e66815731..f8cd25ad7843 100644
--- a/pkgs/applications/office/docear/default.nix
+++ b/pkgs/applications/office/docear/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "1g5n7r2x4gas6dl2fbyh7v9yxdcb6bzml8n3ldmpzv1rncgjcdp4";
   };
 
-  buildInputs = [ oraclejre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ oraclejre ];
 
   buildPhase = "";
   installPhase = ''
diff --git a/pkgs/applications/office/impressive/default.nix b/pkgs/applications/office/impressive/default.nix
index 4614a543694d..f46d893d8948 100644
--- a/pkgs/applications/office/impressive/default.nix
+++ b/pkgs/applications/office/impressive/default.nix
@@ -16,7 +16,8 @@ in stdenv.mkDerivation {
       sha256 = "1r7ihv41awnlnlry1kymb8fka053wdhzibfwcarn78rr3vs338vl";
     };
 
-    buildInputs = [ makeWrapper pythonEnv ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ pythonEnv ];
 
     configurePhase = ''
       # Let's fail at build time if the library we're substituting in doesn't
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 552d28d1e950..1f084e182afc 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0krsj7i5yr76imf83krz2lmlmpbsvpwqg2d4r0jwxiydjfyj4qr4";
   };
 
-  buildInputs = [ wxGTK makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ wxGTK ];
 
   preConfigure = "cd src";
 
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index 7eb3afd437af..b42fed8da281 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -16,7 +16,7 @@ python27Packages.buildPythonApplication rec {
     sha256 = "0abnmn0bh11jihf5d3cggiild1ykawzv5f5fhb4cyyi8fvy4hcxf";
   });
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ python27Packages.biopython wget diamond hmmer ];
 
   # make emapper find diamond & hmmer
diff --git a/pkgs/applications/science/biology/platypus/default.nix b/pkgs/applications/science/biology/platypus/default.nix
index 30bc68fb0e87..d602395b8757 100644
--- a/pkgs/applications/science/biology/platypus/default.nix
+++ b/pkgs/applications/science/biology/platypus/default.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "0nah6r54b8xm778gqyb8b7rsd76z8ji4g73sm6rvpw5s96iib1vw";
   };
 
-  buildInputs = [ htslib python zlib makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ htslib python zlib ];
 
   buildPhase = ''
     patchShebangs .
diff --git a/pkgs/applications/science/biology/snpeff/default.nix b/pkgs/applications/science/biology/snpeff/default.nix
index 32701af8392c..b48e13ecf003 100644
--- a/pkgs/applications/science/biology/snpeff/default.nix
+++ b/pkgs/applications/science/biology/snpeff/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0i12mv93bfv8xjwc3rs2x73d6hkvi7kgbbbx3ry984l3ly4p6nnm";
   };
 
-  buildInputs = [ unzip jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip jre ];
 
   sourceRoot = "snpEff";
 
diff --git a/pkgs/applications/science/biology/varscan/default.nix b/pkgs/applications/science/biology/varscan/default.nix
index 65a19b83a70e..2a232d64693d 100644
--- a/pkgs/applications/science/biology/varscan/default.nix
+++ b/pkgs/applications/science/biology/varscan/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+yO3KrZ2+1qJvQIJHCtsmv8hC5a+4E2d7mrvTYtygU0=";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index a0f81a543f18..600ae83ff912 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       sha256 = "1bibabhlsvf6qsjjkgxcpq3cvl1z7r8yfcgqbhbvsiv69n3gyfk3";
     };
 
-  buildInputs = [ perl polyml z3 makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl polyml z3 ]
              ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];
 
   sourceRoot = dirname;
diff --git a/pkgs/applications/science/logic/leo2/default.nix b/pkgs/applications/science/logic/leo2/default.nix
index 520c47d7500b..fc2c1e5cba4c 100644
--- a/pkgs/applications/science/logic/leo2/default.nix
+++ b/pkgs/applications/science/logic/leo2/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wjpmizb181iygnd18lx7p77fwaci2clgzs5ix5j51cc8f3pazmv";
   };
 
-  buildInputs = [ makeWrapper eprover ocaml perl zlib ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ eprover ocaml perl zlib ];
 
   sourceRoot = "leo2/src";
 
diff --git a/pkgs/applications/science/logic/satallax/default.nix b/pkgs/applications/science/logic/satallax/default.nix
index dffb66b2fcf5..8c88f47327e9 100644
--- a/pkgs/applications/science/logic/satallax/default.nix
+++ b/pkgs/applications/science/logic/satallax/default.nix
@@ -3,7 +3,8 @@ stdenv.mkDerivation rec {
   pname = "satallax";
   version = "2.7";
 
-  buildInputs = [ocaml zlib which eprover makeWrapper coq];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ocaml zlib which eprover coq];
   src = fetchurl {
     url = "https://www.ps.uni-saarland.de/~cebrown/satallax/downloads/${pname}-${version}.tar.gz";
     sha256 = "1kvxn8mc35igk4vigi5cp7w3wpxk2z3bgwllfm4n3h2jfs0vkpib";
diff --git a/pkgs/applications/science/logic/tlaplus/default.nix b/pkgs/applications/science/logic/tlaplus/default.nix
index c4ba334b85ff..f002b808e0af 100644
--- a/pkgs/applications/science/logic/tlaplus/default.nix
+++ b/pkgs/applications/science/logic/tlaplus/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mm6r9bq79zks50yk0agcpdkw9yy994m38ibmgpb3bi3wkpq9891";
   };
 
-  buildInputs = [ makeWrapper adoptopenjdk-bin ant ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ adoptopenjdk-bin ant ];
 
   buildPhase = "ant -f tlatools/org.lamport.tlatools/customBuild.xml compile dist";
   installPhase = ''
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index 1c33d923289f..da8985818e7b 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -28,7 +28,7 @@ in stdenv.mkDerivation {
     sha256 = "0v15wscawair5bghr5ixb4i062kmh9by1m0hnz2r1sawlqyafz02";
   };
 
-  buildInputs = [ makeWrapper  ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/science/logic/why3/with-provers.nix b/pkgs/applications/science/logic/why3/with-provers.nix
index 3528dbd3a647..d4fdbfd6937c 100644
--- a/pkgs/applications/science/logic/why3/with-provers.nix
+++ b/pkgs/applications/science/logic/why3/with-provers.nix
@@ -15,7 +15,8 @@ in stdenv.mkDerivation {
 
   phases = [ "buildPhase" "installPhase" ];
 
-  buildInputs = [ why3 makeWrapper ] ++ provers;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ why3 ] ++ provers;
 
   buildPhase = ''
       mkdir -p $out/share/why3/
diff --git a/pkgs/applications/science/logic/workcraft/default.nix b/pkgs/applications/science/logic/workcraft/default.nix
index cb0d668f5365..7fb73419c072 100644
--- a/pkgs/applications/science/logic/workcraft/default.nix
+++ b/pkgs/applications/science/logic/workcraft/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0v71x3fph2j3xrnysvkm7zsgnbxisfbdfgxzvzxxfdg59a6l3xid";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix
index c5449171fff7..9c5a8960d32b 100644
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
       --replace '-install_name ''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}'
   '';
 
-  buildInputs = [ util-linux makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ util-linux ]
              ++ lib.optionals enableReadline [ readline ncurses ];
 
   makeFlags = [
diff --git a/pkgs/applications/science/math/weka/default.nix b/pkgs/applications/science/math/weka/default.nix
index 179801da379f..05b95140b1bd 100644
--- a/pkgs/applications/science/math/weka/default.nix
+++ b/pkgs/applications/science/math/weka/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0zwmhspmqb0a7cm6k6i0s6q3w19ws1g9dx3cp2v3g3vsif6cdh31";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   # The -Xmx1000M comes suggested from their download page:
   # http://www.cs.waikato.ac.nz/ml/weka/downloading.html
diff --git a/pkgs/applications/science/medicine/aliza/default.nix b/pkgs/applications/science/medicine/aliza/default.nix
index c6bfd6361f20..e8e764ef26d0 100644
--- a/pkgs/applications/science/medicine/aliza/default.nix
+++ b/pkgs/applications/science/medicine/aliza/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     name = "aliza.rpm";
   };
 
-  buildInputs = [ rpmextract makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ rpmextract ];
 
   unpackCmd = "rpmextract $curSrc";
 
diff --git a/pkgs/applications/science/misc/cytoscape/default.nix b/pkgs/applications/science/misc/cytoscape/default.nix
index db98e0db3487..3ab7d57f95a3 100644
--- a/pkgs/applications/science/misc/cytoscape/default.nix
+++ b/pkgs/applications/science/misc/cytoscape/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [jre makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -pv $out/{share,bin}
diff --git a/pkgs/applications/science/programming/plm/default.nix b/pkgs/applications/science/programming/plm/default.nix
index dd61c3668cc6..e56282b68631 100644
--- a/pkgs/applications/science/programming/plm/default.nix
+++ b/pkgs/applications/science/programming/plm/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
     name = "${pname}-${version}.jar";
   };
 
-  buildInputs = [ makeWrapper jre gcc valgrind ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre gcc valgrind ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
index b03acb99530a..5255d40b9ce2 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
@@ -40,7 +40,7 @@ let
 
         paths = [ rxvt-unicode-unwrapped ] ++ plugins ++ extraDeps;
 
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
 
         postBuild = ''
           wrapProgram $out/bin/urxvt \
diff --git a/pkgs/applications/terminal-emulators/terminus/default.nix b/pkgs/applications/terminal-emulators/terminus/default.nix
index 67c660275f55..87394241ef76 100644
--- a/pkgs/applications/terminal-emulators/terminus/default.nix
+++ b/pkgs/applications/terminal-emulators/terminus/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     url = "https://github.com/Eugeny/terminus/releases/download/v${version}/terminus_${version}_amd64.deb";
     sha256 = "1r5n75n71zwahg4rxlnf9qzrb0651gxv0987m6bykqmfpnw91nmb";
   };
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ dpkg ];
   unpackPhase = ''
     mkdir pkg
     dpkg-deb -x $src pkg
diff --git a/pkgs/applications/version-management/cvs2svn/default.nix b/pkgs/applications/version-management/cvs2svn/default.nix
index ae1929565b6e..af2b5cdc9a3d 100644
--- a/pkgs/applications/version-management/cvs2svn/default.nix
+++ b/pkgs/applications/version-management/cvs2svn/default.nix
@@ -12,7 +12,7 @@ python2Packages.buildPythonApplication  rec {
     sha256 = "1ska0z15sjhyfi860rjazz9ya1gxbf5c0h8dfqwz88h7fccd22b4";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   checkInputs = [ subversion git breezy ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
index 1ffc06536750..036eef1c9c36 100644
--- a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
@@ -15,7 +15,8 @@ in
       sha256 = "1kn84rsvms1v5l1j2xgrk7dc7mnsmxkc6sqd94mnim22vnwvl8mz";
     };
 
-    buildInputs = [ jre makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ jre ];
 
     phases = "installPhase";
 
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index 5aea15769c0b..565fe180ba13 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0hzyh66rlawxip4n2pvz7pbs0cq82clqv1d6c7hf60v1drjxw287";
   };
 
-  buildInputs = [mercurial.python mercurial makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [mercurial.python mercurial];
 
   installPhase = ''
     binPath=$out/bin
diff --git a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
index 08875dabd0fe..f0184c663777 100644
--- a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
@@ -13,9 +13,9 @@ stdenv.mkDerivation rec {
     sha256 = "13m9y0m6gc3mlw3pqv9x4i0him2ycbysizigdvdanhh514kga602";
   };
 
-  nativeBuildInputs = [ libxslt ];
+  nativeBuildInputs = [ libxslt makeWrapper ];
 
-  buildInputs = [ openssl makeWrapper ];
+  buildInputs = [ openssl ];
 
   patchPhase = ''
     substituteInPlace commands.cpp \
diff --git a/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix b/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
index 942a12e239b9..7b8b5fed90f4 100644
--- a/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "prefix=$(out)" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # perl provides shasum
   postInstall = ''
diff --git a/pkgs/applications/version-management/git-and-tools/git-open/default.nix b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
index 5e5bba3df728..c67a575172cb 100644
--- a/pkgs/applications/version-management/git-and-tools/git-open/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "11n46bngvca5wbdbfcxzjhjbfdbad7sgf7h9gf956cb1q8swsdm0";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildPhase = null;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-recent/default.nix b/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
index 2ecc5d872b88..1a1811b2f438 100644
--- a/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g8i6vpjnnfh7vc1269c91bap267w4bxdqqwnzb8x18vqgn2fx8i";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildPhase = null;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix b/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
index 037de14658d6..ec1c44b96134 100644
--- a/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0v0yxydpw6r4awy0hb7sbnh520zsk86ibzh1xjf3983yhsvkfk5v";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
index eea7bed011b0..3143d7ef9c3a 100644
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation {
     sha256 = "0hc7yavcp8jmn6b7wngjqhy8kl7f4191sfpik8ycvqghkvvimxj4";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -D git-secret $out/bin/git-secret
diff --git a/pkgs/applications/version-management/git-and-tools/git-sync/default.nix b/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
index 87cb7452c75b..add7bfc5526f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "01if8y93wa0mwbkzkzx2v1vqh47zlz4k1dysl6yh5rmppd1psknz";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 8761fc9fbcaf..c955c04d7796 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -67,10 +67,10 @@ stdenv.mkDerivation {
         --subst-var-by gettext ${gettext}
   '';
 
-  nativeBuildInputs = [ gettext perlPackages.perl ]
+  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
     ++ lib.optionals withManual [ asciidoctor texinfo xmlto docbook2x
          docbook_xsl docbook_xsl_ns docbook_xml_dtd_45 libxslt ];
-  buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
+  buildInputs = [curl openssl zlib expat cpio libiconv]
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
diff --git a/pkgs/applications/version-management/git-and-tools/gitflow/default.nix b/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
index 08bf5eb6ba07..6572b9b7fc86 100644
--- a/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kHirHG/bfsU6tKyQ0khNSTyChhzHfzib+HyA3LOtBI8=";
   };
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ pkgs.makeWrapper ];
 
   preBuild = ''
     makeFlagsArray+=(prefix="$out")
diff --git a/pkgs/applications/version-management/git-and-tools/svn2git/default.nix b/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
index 69742b6d7603..74f10a142883 100644
--- a/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0ly2vrv6q31n0xhciwb7a1ilr5c6ndyi3bg81yfp4axiypps7l41";
   };
 
-  buildInputs = [ ruby makeWrapper ];
+  nativeBuildInputs = [ ruby makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix b/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
index aebd488fe305..3225744abc57 100644
--- a/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1dkr69plk16wllk5bzlkchrzw63pk239dgbjhrb3mb61i065jdam";
   };
 
-  buildInputs = [ makeWrapper git openssl coreutils util-linux gnugrep gnused gawk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ git openssl coreutils util-linux gnugrep gnused gawk ];
 
   patches = [ ./helper-scripts_depspathprefix.patch ];
 
diff --git a/pkgs/applications/version-management/mercurial/4.9.nix b/pkgs/applications/version-management/mercurial/4.9.nix
index 29440724274a..f499be17f7c8 100644
--- a/pkgs/applications/version-management/mercurial/4.9.nix
+++ b/pkgs/applications/version-management/mercurial/4.9.nix
@@ -21,7 +21,8 @@ in python2Packages.buildPythonApplication {
 
   inherit python; # pass it so that the same version can be used in hg2git
 
-  buildInputs = [ makeWrapper docutils unzip ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ docutils unzip ]
     ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];
 
   propagatedBuildInputs = [ hg-git dulwich ];
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index c841482126a1..7c0a96583e70 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -19,7 +19,8 @@ in python3Packages.buildPythonApplication rec {
 
   passthru = { inherit python; }; # pass it so that the same version can be used in hg2git
 
-  buildInputs = [ makeWrapper docutils unzip ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ docutils unzip ]
     ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/applications/version-management/monotone-viz/default.nix b/pkgs/applications/version-management/monotone-viz/default.nix
index d6d55eaa4eb6..56cc2a4ea5a5 100644
--- a/pkgs/applications/version-management/monotone-viz/default.nix
+++ b/pkgs/applications/version-management/monotone-viz/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
   version = "1.0.2";
   pname = "monotone-viz";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ocaml lablgtk libgnomecanvas glib graphviz_2_0 makeWrapper camlp4];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ocaml lablgtk libgnomecanvas glib graphviz_2_0 camlp4];
   src = fetchurl {
     url = "http://oandrieu.nerim.net/monotone-viz/${pname}-${version}-nolablgtk.tar.gz";
     sha256 = "1l5x4xqz5g1aaqbc1x80mg0yzkiah9ma9k9mivmn08alkjlakkdk";
diff --git a/pkgs/applications/video/lightworks/default.nix b/pkgs/applications/video/lightworks/default.nix
index 1776aab00336..0312c34bf702 100644
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@@ -30,7 +30,8 @@ let
         }
       else throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
 
-    buildInputs = [ dpkg makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ dpkg ];
 
     phases = [ "unpackPhase" "installPhase" ];
     unpackPhase = "dpkg-deb -x ${src} ./";
diff --git a/pkgs/applications/video/quvi/tool.nix b/pkgs/applications/video/quvi/tool.nix
index 6718fc1dc36d..87c8066a976c 100644
--- a/pkgs/applications/video/quvi/tool.nix
+++ b/pkgs/applications/video/quvi/tool.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h52s265rp3af16dvq1xlscp2926jqap2l4ah94vrfchv6m1hffb";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ lua5 curl quvi_scripts libquvi glib makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ lua5 curl quvi_scripts libquvi glib ];
   postInstall = ''
       wrapProgram $out/bin/quvi --set LUA_PATH "${lua5_sockets}/share/lua/${lua5.luaversion}/?.lua"
   '';
diff --git a/pkgs/applications/video/xscast/default.nix b/pkgs/applications/video/xscast/default.nix
index 49f5b43bb734..6501a3990885 100644
--- a/pkgs/applications/video/xscast/default.nix
+++ b/pkgs/applications/video/xscast/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0br27bq9bpglfdpv63h827bipgvhlh10liyhmhcxls4227kagz72";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/virtualization/docker/gc.nix b/pkgs/applications/virtualization/docker/gc.nix
index f7bd5a4b0696..52ca54501d75 100644
--- a/pkgs/applications/virtualization/docker/gc.nix
+++ b/pkgs/applications/virtualization/docker/gc.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "07wf9yn0f771xkm3x12946x5rp83hxjkd70xgfgy35zvj27wskzm";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/window-managers/leftwm/default.nix b/pkgs/applications/window-managers/leftwm/default.nix
index 72170401d793..04c232a3e89e 100644
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-j57LHPU3U3ipUGQDrZ8KCuELOVJ3BxhLXsJePOO6rTM=";
 
-  buildInputs = [ makeWrapper libX11 libXinerama ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libX11 libXinerama ];
 
   postInstall = ''
     wrapProgram $out/bin/leftwm --prefix LD_LIBRARY_PATH : "${rpath}"
diff --git a/pkgs/build-support/templaterpm/default.nix b/pkgs/build-support/templaterpm/default.nix
index ffe5b0b45816..efe70efe6c44 100644
--- a/pkgs/build-support/templaterpm/default.nix
+++ b/pkgs/build-support/templaterpm/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation {
   pname = "nix-template-rpm";
   version = "0.1";
 
-  buildInputs = [ makeWrapper python toposort rpm ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python toposort rpm ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/common-updater/scripts.nix b/pkgs/common-updater/scripts.nix
index 351db6198846..26c77e876362 100644
--- a/pkgs/common-updater/scripts.nix
+++ b/pkgs/common-updater/scripts.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation {
   name = "common-updater-scripts";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/desktops/xfce/core/thunar/wrapper.nix b/pkgs/desktops/xfce/core/thunar/wrapper.nix
index b0b4268db6ec..4e9732ce1c4a 100644
--- a/pkgs/desktops/xfce/core/thunar/wrapper.nix
+++ b/pkgs/desktops/xfce/core/thunar/wrapper.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ thunar ] ++ thunarPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram "$out/bin/thunar" \
diff --git a/pkgs/development/compilers/aldor/default.nix b/pkgs/development/compilers/aldor/default.nix
index 2654cc467fe2..3799f2c92127 100644
--- a/pkgs/development/compilers/aldor/default.nix
+++ b/pkgs/development/compilers/aldor/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     rev = "15471e75f3d65b93150f414ebcaf59a03054b68d";
   };
 
-  buildInputs = [ gmp which flex bison makeWrapper autoconf automake libtool
-                  jdk perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gmp which flex bison autoconf automake libtool jdk perl ];
 
   preConfigure = ''
     cd aldor ;
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 4c84ef8c42b0..10cf91579a40 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -18,7 +18,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index 7102126206ae..a6d19eaeb137 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -17,7 +17,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/factor-lang/default.nix b/pkgs/development/compilers/factor-lang/default.nix
index fc5f478177cb..2c9999ccdb49 100644
--- a/pkgs/development/compilers/factor-lang/default.nix
+++ b/pkgs/development/compilers/factor-lang/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
     ./fuel-dir.patch
   ];
 
-  buildInputs = with xorg; [ git rlwrap curl pkg-config perl makeWrapper
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = with xorg; [ git rlwrap curl pkg-config perl
     libX11 pango cairo gtk2 gdk-pixbuf gtkglext
     mesa libXmu libXt libICE libSM openssl unzip ];
 
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index cd613c1b33be..2ddc5b3d3a89 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -12,7 +12,8 @@ in stdenv.mkDerivation {
   };
 
   propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper unzip ] ;
+  buildInputs = [ unzip ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/mercury/default.nix b/pkgs/development/compilers/mercury/default.nix
index e063c4c09217..c5e767a46cde 100644
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
   };
 
-  buildInputs = [ gcc flex bison texinfo jdk erlang makeWrapper
-                  readline ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gcc flex bison texinfo jdk erlang readline ];
 
   patchPhase = ''
     # Fix calls to programs in /bin
diff --git a/pkgs/development/compilers/mozart/binary.nix b/pkgs/development/compilers/mozart/binary.nix
index 8366fd77a47a..b043187e6c1e 100644
--- a/pkgs/development/compilers/mozart/binary.nix
+++ b/pkgs/development/compilers/mozart/binary.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   TK_LIBRARY = "${tk-8_5}/lib/tk8.5";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir $out
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 7a6cdf4d7052..41f4befe469f 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -83,11 +83,9 @@ let result = stdenv.mkDerivation rec {
       sha256 = sha256.${stdenv.hostPlatform.system};
     };
 
-  nativeBuildInputs = [ file ]
+  nativeBuildInputs = [ file makeWrapper ]
     ++ lib.optional installjce unzip;
 
-  buildInputs = [ makeWrapper ];
-
   # See: https://github.com/NixOS/patchelf/issues/10
   dontStrip = 1;
 
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 770cc3415f2c..ce4250f675e9 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -83,8 +83,8 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
-    buildInputs = [ makeWrapper bash ]
-      ++ lib.optional stdenv.isDarwin Security;
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ bash ] ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
       patchShebangs .
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index f28359196310..aa55866def51 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -28,8 +28,8 @@ rustPlatform.buildRustPackage rec {
   # rls-rustc links to rustc_private crates
   CARGO_BUILD_RUSTFLAGS = if stdenv.isDarwin then "-C rpath" else null;
 
-  nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ openssh openssl curl zlib libiconv makeWrapper rustPlatform.rust.rustc.llvm ]
+  nativeBuildInputs = [ pkg-config cmake makeWrapper ];
+  buildInputs = [ openssh openssl curl zlib libiconv rustPlatform.rust.rustc.llvm ]
     ++ (lib.optionals stdenv.isDarwin [ CoreFoundation Security ]);
 
   doCheck = true;
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index cb42235bc8e2..8bdbbadc9d60 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/compilers/scala/2.x.nix b/pkgs/development/compilers/scala/2.x.nix
index d3fa31ddd94b..a91e0dbe1c72 100644
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ jre ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
       mkdir -p $out
diff --git a/pkgs/development/compilers/scala/dotty-bare.nix b/pkgs/development/compilers/scala/dotty-bare.nix
index b173de58049b..66a634914dfb 100644
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ jre ncurses.dev ] ;
-  buildInputs = [ makeWrapper ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix
index 113b22768d9f..91eb9fc84172 100644
--- a/pkgs/development/compilers/smlnj/bootstrap.nix
+++ b/pkgs/development/compilers/smlnj/bootstrap.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "12jn50h5jz0ac1vzld2mb94p1dyc8h0mk0hip2wj5xqk1dbzwxl4";
   };
 
-  buildInputs = [ cpio rsync makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ cpio rsync ];
 
   unpackPhase = ''
     ${xar}/bin/xar -xf $src
diff --git a/pkgs/development/compilers/tinygo/default.nix b/pkgs/development/compilers/tinygo/default.nix
index 0aee1ca1f394..218b207f2435 100644
--- a/pkgs/development/compilers/tinygo/default.nix
+++ b/pkgs/development/compilers/tinygo/default.nix
@@ -40,7 +40,8 @@ buildGoModule rec {
   '';
 
   subPackages = [ "." ];
-  buildInputs = [ llvm clang-unwrapped makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ llvm clang-unwrapped ];
   propagatedBuildInputs = [ lld avrgcc avrdude openocd gcc-arm-embedded ];
 
   postInstall = ''
diff --git a/pkgs/development/compilers/urn/default.nix b/pkgs/development/compilers/urn/default.nix
index f7e338cf43ff..8b74f46fd040 100644
--- a/pkgs/development/compilers/urn/default.nix
+++ b/pkgs/development/compilers/urn/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     sha256 = "0nclr3d8ap0y5cg36i7g4ggdqci6m5q27y9f26b57km8p266kcpy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   # Any packages that depend on the compiler have a transitive
   # dependency on the Urn runtime support.
   propagatedBuildInputs = [ urn-rt ];
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index 96c884ab602e..92531eacd20d 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     sha256 = "0nd63i924ifh39cba1hd4sbi6vh1cb73v97nrn4bf8rrjh3k8pdi";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     make install PREFIX="$out"
diff --git a/pkgs/development/interpreters/clojure/clooj.nix b/pkgs/development/interpreters/clojure/clooj.nix
index 57da5e862e99..baf83c647767 100644
--- a/pkgs/development/interpreters/clojure/clooj.nix
+++ b/pkgs/development/interpreters/clojure/clooj.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0hbc29bg2a86rm3sx9kvj7h7db9j0kbnrb706wsfiyk3zi3bavnd";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = "installPhase";
 
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index aaf368017ffb..0e4beaa8508f 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -20,7 +20,8 @@ in
 
     inherit src version;
 
-    buildInputs = [ erlang makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ erlang ];
 
     LANG = "C.UTF-8";
     LC_TYPE = "C.UTF-8";
diff --git a/pkgs/development/interpreters/groovy/default.nix b/pkgs/development/interpreters/groovy/default.nix
index 0e3a0a46afde..114bc13f5d8a 100644
--- a/pkgs/development/interpreters/groovy/default.nix
+++ b/pkgs/development/interpreters/groovy/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xdpjqx7qaq0syw448b32q36g12pgh1hn6knyqi3k5isp0f09qmr";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/interpreters/jruby/default.nix b/pkgs/development/interpreters/jruby/default.nix
index f792471c0619..fb1fdd3c8e08 100644
--- a/pkgs/development/interpreters/jruby/default.nix
+++ b/pkgs/development/interpreters/jruby/default.nix
@@ -13,7 +13,7 @@ jruby = stdenv.mkDerivation rec {
     sha256 = "1dg0fz9b8m1k0sypvpxnf4xjqwc0pyy35xw4rsg4a7pha4jkprrj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
      mkdir -pv $out/docs
diff --git a/pkgs/development/interpreters/jython/default.nix b/pkgs/development/interpreters/jython/default.nix
index 61cc8f9cd0f5..38b599d339e7 100644
--- a/pkgs/development/interpreters/jython/default.nix
+++ b/pkgs/development/interpreters/jython/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "142285hd9mx0nx5zw0jvkpqkb4kbhgyyy52p5bj061ya8bg5jizy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/interpreters/picolisp/default.nix b/pkgs/development/interpreters/picolisp/default.nix
index 341797fa3f4c..623eefec4162 100644
--- a/pkgs/development/interpreters/picolisp/default.nix
+++ b/pkgs/development/interpreters/picolisp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     url = "https://www.software-lab.de/${pname}-${version}.tgz";
     sha256 = "0l51x98bn1hh6kv40sdgp0x09pzg5i8yxbcjvm9n5bxsd6bbk5w2";
   };
-  buildInputs = [makeWrapper openssl] ++ optional stdenv.is64bit jdk;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [openssl] ++ optional stdenv.is64bit jdk;
   patchPhase = ''
     sed -i "s/which java/command -v java/g" mkAsm
 
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 19e6c93378f7..863df66899b1 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256="0px6x5ivcdbbp2pz5n1r1cwg1syadklhjw8piqhl63n91i4r7iyb";
   };
 
-  buildInputs = [ bison flex makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bison flex ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
   NIX_LDFLAGS = "-lLLVMJIT";
 
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 5eccebf02452..42e82cd3a51b 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wccVMEUAfTWs/8hnrT7nrxfYPHyNl+lXt+KUDkyplto=";
   };
 
-  buildInputs = [ rakudo makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ rakudo ];
 
   installPhase = ''
     mkdir -p "$out"
diff --git a/pkgs/development/interpreters/rascal/default.nix b/pkgs/development/interpreters/rascal/default.nix
index cd2b74db0520..8b49a743b4a9 100644
--- a/pkgs/development/interpreters/rascal/default.nix
+++ b/pkgs/development/interpreters/rascal/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1z4mwdbdc3r24haljnxng8znlfg2ihm9bf9zq8apd9a32ipcw4i6";
   };
 
-  buildInputs = [ makeWrapper jdk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/libraries/hunspell/wrapper.nix b/pkgs/development/libraries/hunspell/wrapper.nix
index 34c3d26c55ec..4ae177232751 100644
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" hunspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index ddf95ead249a..5519a1fb7665 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1msys7xkaj0d7fi112fmb2z50mk46db58agzrrdyimggsszwn1kj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   outputs = [ "out" "bin" ];
 
diff --git a/pkgs/development/libraries/neardal/default.nix b/pkgs/development/libraries/neardal/default.nix
index 5e02a9fd5222..43f63d91a618 100644
--- a/pkgs/development/libraries/neardal/default.nix
+++ b/pkgs/development/libraries/neardal/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "12qwg7qiw2wfpaxfg2fjkmj5lls0g33xp6w433g8bnkvwlq4s29g";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool glib readline makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ autoconf automake libtool glib readline ];
 
   preConfigure = ''
     substituteInPlace "ncl/Makefile.am" --replace "noinst_PROGRAMS" "bin_PROGRAMS"
diff --git a/pkgs/development/libraries/nuspell/wrapper.nix b/pkgs/development/libraries/nuspell/wrapper.nix
index 4386542ff20e..ab09931579c7 100644
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" nuspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/rabbitmq-java-client/default.nix b/pkgs/development/libraries/rabbitmq-java-client/default.nix
index b649b1d9c113..e5657bcb3c30 100644
--- a/pkgs/development/libraries/rabbitmq-java-client/default.nix
+++ b/pkgs/development/libraries/rabbitmq-java-client/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "03kspkgzzjsbq6f8yl2zj5m30qwgxv3l58hrbf6gcgxb5rpfk6sh";
   };
 
-  buildInputs = [ ant jdk python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ant jdk python ];
 
   buildPhase = "ant dist";
 
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 5602f598e9d6..1aa81132c260 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lvfdlpmmsyq2i9gs4mf6a8fxkfimdr4rhyihqnfhjij3fzxz4lk";
   };
 
-  buildInputs = [ makeWrapper which xdg-utils ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which xdg-utils ];
 
   unpackPhase = ''
     mkdir -p phony-home $out/share/applications
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
index f471dc977b3d..601cac372c8c 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
index 0742247893c3..52257bfd4611 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
index 965a385ac56c..78044752b54c 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index b4842da12dd7..cf869b6e5ef9 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -29,9 +29,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xda4fj8p5102lh9xmrn5mv3s0ps6yykqj3mpjf72gf4zd6fzcn7";
   }) ];
 
-  buildInputs = [ which makeWrapper ocaml findlib
-    lwt_react pgocaml camlzip ocaml_sqlite3
-  ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which ocaml findlib lwt_react pgocaml camlzip ocaml_sqlite3 ];
 
   propagatedBuildInputs = [ cryptokit ipaddr lwt_log lwt_ssl ocamlnet
     ocaml_pcre tyxml xml-light
diff --git a/pkgs/development/perl-modules/ham/default.nix b/pkgs/development/perl-modules/ham/default.nix
index 4f6dc5d9ddb7..8b19c9404fe0 100644
--- a/pkgs/development/perl-modules/ham/default.nix
+++ b/pkgs/development/perl-modules/ham/default.nix
@@ -13,7 +13,7 @@ buildPerlPackage {
 
   outputs = [ "out" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ openssh GitRepository URI XMLMini ];
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 6b27e8e5d425..30a7e5174a6d 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -9,7 +9,7 @@ let
   withPlugins = plugins: buildPythonPackage {
     name = "${package.name}-with-plugins";
     phases = [ "installPhase" "fixupPhase" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     propagatedBuildInputs = plugins ++ package.propagatedBuildInputs;
 
     installPhase = ''
diff --git a/pkgs/development/python-modules/livestreamer/default.nix b/pkgs/development/python-modules/livestreamer/default.nix
index 184a215c407a..98878c90640f 100644
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "1fp3d3z2grb1ls97smjkraazpxnvajda2d1g1378s6gzmda2jvjd";
   };
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ pkgs.makeWrapper ];
 
   propagatedBuildInputs = [ pkgs.rtmpdump pycrypto requests ]
     ++ lib.optionals isPy27 [ singledispatch futures ];
diff --git a/pkgs/development/python-modules/pyxml/default.nix b/pkgs/development/python-modules/pyxml/default.nix
index a528de8e0ca2..49796054b564 100644
--- a/pkgs/development/python-modules/pyxml/default.nix
+++ b/pkgs/development/python-modules/pyxml/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "04wc8i7cdkibhrldy6j65qp5l75zjxf5lx6qxdxfdf2gb3wndawz";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildPhase = "${python.interpreter} ./setup.py build";
   installPhase = ''
     ${python.interpreter} ./setup.py install --prefix="$out" || exit 1
diff --git a/pkgs/development/tools/analysis/lcov/default.nix b/pkgs/development/tools/analysis/lcov/default.nix
index 35c75d67da50..30df5daed6ff 100644
--- a/pkgs/development/tools/analysis/lcov/default.nix
+++ b/pkgs/development/tools/analysis/lcov/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kvc7fkp45w48f0bxwbxvxkicnjrrydki0hllg294n1wrp80zzyk";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   preBuild = ''
     patchShebangs bin/
diff --git a/pkgs/development/tools/analysis/panopticon/default.nix b/pkgs/development/tools/analysis/panopticon/default.nix
index 91f3f24d6f1f..f7f933392ab4 100644
--- a/pkgs/development/tools/analysis/panopticon/default.nix
+++ b/pkgs/development/tools/analysis/panopticon/default.nix
@@ -12,8 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
   propagatedBuildInputs = with qt5; [
      qt5.qtbase
      qtdeclarative
diff --git a/pkgs/development/tools/build-managers/apache-ant/1.9.nix b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
index 182b8633aa01..93644caa5a4e 100644
--- a/pkgs/development/tools/build-managers/apache-ant/1.9.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix
index d88068c1c3ee..d2ef8361ec0e 100644
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index 4658703f8b10..3a1866e0b399 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i9qlj3vy4j1yyf22nwisd0pg88n9qzp9ymfhwqabadka7br3b96";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   inherit jdk;
 
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index d314064904d1..4735a7559cfd 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -33,7 +33,8 @@ rec {
         echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
       '';
 
-    buildInputs = [ unzip java makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ unzip java ];
 
     meta = {
       description = "Enterprise-grade build system";
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 488697033d91..51b97b242d5c 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ jdk ];
 
   # the jar is not in share/java, because it's a standalone jar and should
diff --git a/pkgs/development/tools/build-managers/redo-sh/default.nix b/pkgs/development/tools/build-managers/redo-sh/default.nix
index d22f4bc487f8..093a825723c0 100644
--- a/pkgs/development/tools/build-managers/redo-sh/default.nix
+++ b/pkgs/development/tools/build-managers/redo-sh/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0d3hz3vy5qmjr9r4f8a5cx9hikpzs8h8f0fsl3dpbialf4wck24g";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   sourceRoot = ".";
   installPhase = ''
diff --git a/pkgs/development/tools/build-managers/sbt-extras/default.nix b/pkgs/development/tools/build-managers/sbt-extras/default.nix
index efc6523cd986..cb977191eafe 100644
--- a/pkgs/development/tools/build-managers/sbt-extras/default.nix
+++ b/pkgs/development/tools/build-managers/sbt-extras/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/database/ephemeralpg/default.nix b/pkgs/development/tools/database/ephemeralpg/default.nix
index ae10c402945f..0fb3ae81030b 100644
--- a/pkgs/development/tools/database/ephemeralpg/default.nix
+++ b/pkgs/development/tools/database/ephemeralpg/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
     url = "http://ephemeralpg.org/code/${pname}-${version}.tar.gz";
     sha256 = "1ap22ki8yz6agd0qybcjgs4b9izw1rwwcgpxn3jah2ccfyax34s6";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out
     PREFIX=$out make install
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index eacd35ed760c..92249282267c 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Zwh8baMD8jt+yfsK0jpsTEU32rT+IAQGwavVT3rpRsU=";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   unpackPhase = ''
     tar xfz ${src}
diff --git a/pkgs/development/tools/database/sqldeveloper/default.nix b/pkgs/development/tools/database/sqldeveloper/default.nix
index c42197e13cf1..8fb7677f5845 100644
--- a/pkgs/development/tools/database/sqldeveloper/default.nix
+++ b/pkgs/development/tools/database/sqldeveloper/default.nix
@@ -49,7 +49,8 @@ in
     sha256 = "1h53gl41ydr7kim6q9ckg3xyhb0rhmwj7jnis0xz6vms52b3h59k";
   };
 
-  buildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   unpackCmd = "unzip $curSrc";
 
diff --git a/pkgs/development/tools/google-app-engine-go-sdk/default.nix b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
index 4d572e070e76..c20d7a2e49a6 100644
--- a/pkgs/development/tools/google-app-engine-go-sdk/default.nix
+++ b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
         sha256 = "0s8sqyc72lnc7dxd4cl559gyfx83x71jjpsld3i3nbp3mwwamczp";
       };
 
-  buildInputs = [ python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/
diff --git a/pkgs/development/tools/jbake/default.nix b/pkgs/development/tools/jbake/default.nix
index 97d1c7536821..e14cfe874040 100644
--- a/pkgs/development/tools/jbake/default.nix
+++ b/pkgs/development/tools/jbake/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ripayv1vf4f4ylxr7h9kad2xhy3y98ca8s4p38z7dn8l47zg0qw";
   };
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/development/tools/jsduck/default.nix b/pkgs/development/tools/jsduck/default.nix
index 233b39338760..15a3a6834034 100644
--- a/pkgs/development/tools/jsduck/default.nix
+++ b/pkgs/development/tools/jsduck/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ env makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ env ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/autobuild/default.nix b/pkgs/development/tools/misc/autobuild/default.nix
index da387105cef5..186608cde3f1 100644
--- a/pkgs/development/tools/misc/autobuild/default.nix
+++ b/pkgs/development/tools/misc/autobuild/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gv7g61ja9q9zg1m30k4snqwwy1kq7b4df6sb7d2qra7kbdq8af1";
   };
 
-  buildInputs = [ makeWrapper perl openssh rsync ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl openssh rsync ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/cbrowser/default.nix b/pkgs/development/tools/misc/cbrowser/default.nix
index 0f7edeea812f..62aa0ab5decf 100644
--- a/pkgs/development/tools/misc/cbrowser/default.nix
+++ b/pkgs/development/tools/misc/cbrowser/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./backslashes-quotes.diff ];
 
-  buildInputs = [ tk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tk ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/${name}
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index d62166ca2b4a..5797fcc4109c 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -Dm644 $src $out/share/java/${pname}.jar
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 285805ccb02c..612514345785 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0qfj2wd4qk1yn9yzam6g8nmyxfazcc0knjyyibycb2ainkhp21hd";
   };
 
-  buildInputs = [ expect makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ expect ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/fswatch/default.nix b/pkgs/development/tools/misc/fswatch/default.nix
index 6f9f5e113c06..47716b5ea9e8 100644
--- a/pkgs/development/tools/misc/fswatch/default.nix
+++ b/pkgs/development/tools/misc/fswatch/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "11479ac436g8bwk0lfnmdms0cirv9k11pdvfrrg9jwkki1j1abkk";
   };
 
-  nativeBuildInputs = [ autoreconfHook ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
-  buildInputs = [ gettext libtool makeWrapper texinfo ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = [ gettext libtool texinfo ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/misc/gpshell/default.nix b/pkgs/development/tools/misc/gpshell/default.nix
index 13437b719536..f5298d685eba 100644
--- a/pkgs/development/tools/misc/gpshell/default.nix
+++ b/pkgs/development/tools/misc/gpshell/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "19a77zvyf2vazbv17185s4pynhylk2ky8vhl4i8pg9zww29sicqi";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ globalplatform pcsclite makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ globalplatform pcsclite ];
 
   postFixup = ''
     wrapProgram "$out/bin/gpshell" --prefix LD_LIBRARY_PATH : "${gppcscconnectionplugin}/lib"
diff --git a/pkgs/development/tools/misc/kibana/6.x.nix b/pkgs/development/tools/misc/kibana/6.x.nix
index 3fa2d219fe3a..9ba19c836b59 100644
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/kibana/7.x.nix b/pkgs/development/tools/misc/kibana/7.x.nix
index 7f46d6f65120..754559969d50 100644
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check-7.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/macdylibbundler/default.nix b/pkgs/development/tools/misc/macdylibbundler/default.nix
index c92d7b077983..f37815081ee4 100644
--- a/pkgs/development/tools/misc/macdylibbundler/default.nix
+++ b/pkgs/development/tools/misc/macdylibbundler/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "149p3dcnap4hs3nhq5rfvr3m70rrb5hbr5xkj1h0gsfp0d7gvxnj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/development/tools/misc/rolespec/default.nix b/pkgs/development/tools/misc/rolespec/default.nix
index d86277993caa..b26fbf75031d 100644
--- a/pkgs/development/tools/misc/rolespec/default.nix
+++ b/pkgs/development/tools/misc/rolespec/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     inherit name;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # The default build phase (`make`) runs the test code. It's difficult to do
   # the test in the build environment because it depends on the system package
diff --git a/pkgs/development/tools/neoload/default.nix b/pkgs/development/tools/neoload/default.nix
index fb85aa80dc35..63452728b91e 100644
--- a/pkgs/development/tools/neoload/default.nix
+++ b/pkgs/development/tools/neoload/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation {
       { url = "http://neoload.installers.neotys.com/documents/download/neoload/v4.1/neoload_4_1_4_linux_x86.sh";
         sha256 = "1z66jiwcxixsqqwa0f4q8m2p5kna4knq6lic8y8l74dgv25mw912"; } );
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   phases = [ "installPhase" ];
 
   # TODO: load generator / monitoring agent only builds
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 31358129821e..475c08eb169f 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     ln -s $out/share/nwjs/nwjc $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 72177582919a..67a86ca8dec5 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1cly9lhrawnc42r31b7r0p0i6hcx8r00aa17gv7w9pcpj8ngb4v2";
   };
 
-  buildInputs = [ makeWrapper nim pcre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ nim pcre ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index d3490b2b9c99..1356bc46ced8 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -83,7 +83,7 @@ in stdenv.mkDerivation rec {
       ln -s $out/share/nwjs/nw $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
index 047246cd0a0d..5a4b55cc7fec 100644
--- a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
+++ b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation {
   patchFlags = [ "-p0" ];
   patches = [ ./warn.patch ];
 
-  buildInputs = [ ocaml makeWrapper ncurses ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml ncurses ];
 
   phases = "unpackPhase patchPhase buildPhase";
   buildPhase = ''
diff --git a/pkgs/development/tools/ocaml/opam/1.2.2.nix b/pkgs/development/tools/ocaml/opam/1.2.2.nix
index a128f2144e9f..610093af19ff 100644
--- a/pkgs/development/tools/ocaml/opam/1.2.2.nix
+++ b/pkgs/development/tools/ocaml/opam/1.2.2.nix
@@ -47,7 +47,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "1.2.2";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml ];
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index b99880fe7f33..30bc089ee0fe 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -63,7 +63,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "2.0.8";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index 2cc46d018ec9..0df9b0e15d1d 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -17,7 +17,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/operator-sdk" ];
 
-  buildInputs = [ go makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ go ];
 
   # operator-sdk uses the go compiler at runtime
   allowGoReference = true;
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index 4547012e2f32..597d680cc2bb 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -4,7 +4,7 @@ buildGoModule rec {
   pname = "out-of-tree";
   version = "1.4.0";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index c5d65a8239ea..641c1581b051 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -37,7 +37,7 @@ let
 
 in runCommand "systemtap-${kernel.version}-${version}" {
   inherit stapBuild kernelBuildDir;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   meta = {
     homepage = "https://sourceware.org/systemtap/";
     repositories.git = url;
diff --git a/pkgs/development/tools/quilt/default.nix b/pkgs/development/tools/quilt/default.nix
index 71cf10e63b91..94b5e5a6dcc2 100644
--- a/pkgs/development/tools/quilt/default.nix
+++ b/pkgs/development/tools/quilt/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "01vfvk4pqigahx82fhaaffg921ivd3k7rylz1yfvy4zbdyd32jri";
   };
 
-  buildInputs = [ makeWrapper perl bash diffutils patch findutils diffstat ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl bash diffutils patch findutils diffstat ];
 
   postInstall = ''
     wrapProgram $out/bin/quilt --prefix PATH : \
diff --git a/pkgs/development/tools/ronn/default.nix b/pkgs/development/tools/ronn/default.nix
index 9e4ac0b58ebe..8b5166272202 100644
--- a/pkgs/development/tools/ronn/default.nix
+++ b/pkgs/development/tools/ronn/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   phases = ["installPhase"];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/scalafix/default.nix b/pkgs/development/tools/scalafix/default.nix
index 00fda8bfc368..c27d6e8a65f3 100644
--- a/pkgs/development/tools/scalafix/default.nix
+++ b/pkgs/development/tools/scalafix/default.nix
@@ -19,7 +19,8 @@ in
 stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/selenium/selendroid/default.nix b/pkgs/development/tools/selenium/selendroid/default.nix
index c25190cab74e..b029e7711a3e 100644
--- a/pkgs/development/tools/selenium/selendroid/default.nix
+++ b/pkgs/development/tools/selenium/selendroid/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  buildInputs = [ jdk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   installPhase = ''
     mkdir -p $out/share/lib/selendroid
diff --git a/pkgs/development/tools/selenium/server/default.nix b/pkgs/development/tools/selenium/server/default.nix
index 10893a9d1700..c4f8653794fe 100644
--- a/pkgs/development/tools/selenium/server/default.nix
+++ b/pkgs/development/tools/selenium/server/default.nix
@@ -18,7 +18,8 @@ in stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p $out/share/lib/${pname}-${version}
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index cdf2242bdbaa..ef04725e562f 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   postInstall = ''
     wrapProgram $out/bin/sslmate --prefix PERL5LIB : \
diff --git a/pkgs/development/tools/thrust/default.nix b/pkgs/development/tools/thrust/default.nix
index 44dfa1a4ba11..02183282ce16 100644
--- a/pkgs/development/tools/thrust/default.nix
+++ b/pkgs/development/tools/thrust/default.nix
@@ -22,7 +22,8 @@ in stdenv.mkDerivation rec {
     sha256 = "07rrnlj0gk500pvar4b1wdqm05p4n9yjwn911x93bd2qwc8r5ymc";
   };
 
-  buildInputs = [ thrustEnv makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ thrustEnv unzip ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index f45ac2f01532..12b485764a5b 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h6rv2zcp84ycmd0kv1pbpqjgwx57dw42x7878d2c2vnpi5jn8qi";
   };
 
-  buildInputs = [ makeWrapper SDL SDL_image ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ SDL SDL_image ];
 
   NIX_LDFLAGS = "-lm";
 
diff --git a/pkgs/games/chessdb/default.nix b/pkgs/games/chessdb/default.nix
index 656e4ab6add3..40f90e75ff82 100644
--- a/pkgs/games/chessdb/default.nix
+++ b/pkgs/games/chessdb/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0brc3wln3bxp979iqj2w1zxpfd0pch8zzazhdmwf7acww4hrsz62";
   };
 
-  buildInputs = [ tcl tk libX11 makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk libX11 ];
 
   makeFlags = [
     "BINDIR=$(out)/bin"
diff --git a/pkgs/games/ckan/default.nix b/pkgs/games/ckan/default.nix
index 052982bf15d6..26a0ba748ba4 100644
--- a/pkgs/games/ckan/default.nix
+++ b/pkgs/games/ckan/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper mono ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ mono ];
 
   libraries = lib.makeLibraryPath [ gtk2 curl ];
 
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index bd75a66b4879..7db79012ec65 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   paths = [ dwarf-therapist ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   passthru = { inherit dwarf-fortress dwarf-therapist; };
 
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index 356cedd3507e..879bbfa2311f 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -178,7 +178,8 @@ let
     headless = base;
     demo = base // {
 
-      buildInputs = [ makeWrapper libpulseaudio ];
+      nativeBuildInputs = [ makeWrapper ];
+      buildInputs = [ libpulseaudio ];
 
       libPath = lib.makeLibraryPath [
         alsaLib
diff --git a/pkgs/games/gcs/default.nix b/pkgs/games/gcs/default.nix
index a471b425f0c6..9d8d74921e54 100644
--- a/pkgs/games/gcs/default.nix
+++ b/pkgs/games/gcs/default.nix
@@ -42,7 +42,8 @@ in stdenv.mkDerivation rec {
     cp -r ${library} gcs_library
   '';
 
-  buildInputs = [ jdk8 jre8 ant makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk8 jre8 ant ];
   buildPhase = ''
     cd apple_stubs
     ant
diff --git a/pkgs/games/gogui/default.nix b/pkgs/games/gogui/default.nix
index 8eb989a8f474..fa901c14f819 100644
--- a/pkgs/games/gogui/default.nix
+++ b/pkgs/games/gogui/default.nix
@@ -5,7 +5,8 @@ let
 in stdenv.mkDerivation {
   pname = "gogui";
   inherit version;
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
   src = fetchurl {
     url = "mirror://sourceforge/project/gogui/gogui/${version}/gogui-${version}.zip";
     sha256 = "0qk6p1bhi1816n638bg11ljyj6zxvm75jdf02aabzdmmd9slns1j";
diff --git a/pkgs/games/gtypist/default.nix b/pkgs/games/gtypist/default.nix
index d0ddf43fe2a2..43b95bacefc8 100644
--- a/pkgs/games/gtypist/default.nix
+++ b/pkgs/games/gtypist/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xzrkkmj0b1dw3yr0m9hml2y634cc4h61im6zwcq57s7285z8fn1";
   };
 
-  buildInputs = [ makeWrapper ncurses perl fortune ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ncurses perl fortune ]
    ++ lib.optional stdenv.isDarwin libiconv;
 
   preFixup = ''
diff --git a/pkgs/games/mrrescue/default.nix b/pkgs/games/mrrescue/default.nix
index c5b2b7d20eb0..ae7519c948ba 100644
--- a/pkgs/games/mrrescue/default.nix
+++ b/pkgs/games/mrrescue/default.nix
@@ -29,8 +29,7 @@ stdenv.mkDerivation {
     sha256 = "0kzahxrgpb4vsk9yavy7f8nc34d62d1jqjrpsxslmy9ywax4yfpi";
   };
 
-  nativeBuildInputs = [ lua love ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ lua love makeWrapper ];
 
   phases = "installPhase";
 
diff --git a/pkgs/games/newtonwars/default.nix b/pkgs/games/newtonwars/default.nix
index 0da6d9352e06..0be3d9bf7a0e 100644
--- a/pkgs/games/newtonwars/default.nix
+++ b/pkgs/games/newtonwars/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0g63fwfcdxxlnqlagj1fb8ngm385gmv8f7p8b4r1z5cny2znxdvs";
   };
 
-  buildInputs = [ makeWrapper freeglut libGL libGLU ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ freeglut libGL libGLU ];
 
   patchPhase = ''
     sed -i "s;font24.raw;$out/share/font24.raw;g" display.c
diff --git a/pkgs/games/nottetris2/default.nix b/pkgs/games/nottetris2/default.nix
index 53e7dec08032..42e5a33cad79 100644
--- a/pkgs/games/nottetris2/default.nix
+++ b/pkgs/games/nottetris2/default.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation {
     sha256 = "17iabh6rr8jim70n96rbhif4xq02g2kppscm8l339yqx6mhb64hs";
   };
 
-  nativeBuildInputs = [ zip ];
-  buildInputs = [ love_0_7 makeWrapper ];
+  nativeBuildInputs = [ zip makeWrapper ];
+  buildInputs = [ love_0_7 ];
 
   phases = [ "unpackPhase" "installPhase" ];
 
diff --git a/pkgs/games/r2mod_cli/default.nix b/pkgs/games/r2mod_cli/default.nix
index b81f1814ac9b..b5b14ba2363c 100644
--- a/pkgs/games/r2mod_cli/default.nix
+++ b/pkgs/games/r2mod_cli/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g64f8ms7yz4rzm6xb93agc08kh9sbwkhvq35dpfhvi6v59j3n5m";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/games/racer/default.nix b/pkgs/games/racer/default.nix
index dfbe9bc45e1f..16507fa219e0 100644
--- a/pkgs/games/racer/default.nix
+++ b/pkgs/games/racer/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation {
   } else
     throw "System not supported";
 
-
-  buildInputs = [ allegro libjpeg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ allegro libjpeg ];
 
   prePatch = ''
     sed -i s,/usr/local,$out, Makefile src/HGFX.cpp src/STDH.cpp
diff --git a/pkgs/games/runelite/default.nix b/pkgs/games/runelite/default.nix
index df8a5c3e8dcd..e9e77e275dc7 100644
--- a/pkgs/games/runelite/default.nix
+++ b/pkgs/games/runelite/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     startupNotify = null;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # colon is bash form of no-op (do nothing)
   dontUnpack = true;
diff --git a/pkgs/games/scid/default.nix b/pkgs/games/scid/default.nix
index f0fdef8e62e5..7b1a15c0a551 100644
--- a/pkgs/games/scid/default.nix
+++ b/pkgs/games/scid/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "0zb5qp04x8w4gn2kvfdfq2p44kmzfcqn7v167dixz6nlyxg41hrw";
   };
 
-  buildInputs = [ tcl tk libX11 zlib makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk libX11 zlib ];
 
   prePatch = ''
     sed -i -e '/^ *set headerPath *{/a ${tcl}/include ${tk}/include' \
diff --git a/pkgs/games/sil/default.nix b/pkgs/games/sil/default.nix
index 3128ed5358b2..5f589ede2bc4 100644
--- a/pkgs/games/sil/default.nix
+++ b/pkgs/games/sil/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     stripRoot=false;
   };
 
-  buildInputs = [ makeWrapper ncurses libX11 libXaw libXt libXext libXmu ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ncurses libX11 libXaw libXt libXext libXmu ];
 
   sourceRoot = "source/Sil/src";
 
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index effb999e02c3..2a916094af41 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xn403fxz6ay5lv8whyfdq611kvxj5q309bj317yw5cxbb08w1yb";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/vassal $out/doc
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index b07db62aa157..6c48caf8756a 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -24,7 +24,8 @@ stdenv.mkDerivation {
     sourceRoot=`pwd`/src
   '';
 
-  buildInputs = [ unrar unzip SDL SDL_image SDL_ttf SDL_mixer libmysqlclient makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unrar unzip SDL SDL_image SDL_ttf SDL_mixer libmysqlclient ];
 
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
 
diff --git a/pkgs/misc/emulators/blastem/default.nix b/pkgs/misc/emulators/blastem/default.nix
index eba646e2f20f..a2dc86449d9e 100644
--- a/pkgs/misc/emulators/blastem/default.nix
+++ b/pkgs/misc/emulators/blastem/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation {
     url = "https://www.retrodev.com/repos/blastem/archive/3d48cb0c28be.tar.gz";
     sha256 = "07wzbmzp0y8mh59jxg81q17gqagz3psxigxh8dmzsipgg68y6a8r";
   };
-  buildInputs = [ pkg-config SDL2 glew xcftools python pillow vasm makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config SDL2 glew xcftools python pillow vasm ];
   preBuild = ''
     patchShebangs img2tiles.py
   '';
diff --git a/pkgs/misc/emulators/retroarch/wrapper.nix b/pkgs/misc/emulators/retroarch/wrapper.nix
index 08ebf8ea8544..40d9f07846b7 100644
--- a/pkgs/misc/emulators/retroarch/wrapper.nix
+++ b/pkgs/misc/emulators/retroarch/wrapper.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "retroarch";
   version = lib.getVersion retroarch;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir -p $out/lib
diff --git a/pkgs/misc/lilypond/with-fonts.nix b/pkgs/misc/lilypond/with-fonts.nix
index 2f3a95a33022..47cbb59f2f01 100644
--- a/pkgs/misc/lilypond/with-fonts.nix
+++ b/pkgs/misc/lilypond/with-fonts.nix
@@ -7,7 +7,8 @@ lib.appendToName "with-fonts" (symlinkJoin {
 
   paths = [ lilypond ] ++ openlilylib-fonts.all;
 
-  buildInputs = [ makeWrapper lndir ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ lndir ];
 
   postBuild = ''
     for p in $out/bin/*; do
diff --git a/pkgs/misc/screensavers/pipes/default.nix b/pkgs/misc/screensavers/pipes/default.nix
index 11d85e597765..be605192acce 100644
--- a/pkgs/misc/screensavers/pipes/default.nix
+++ b/pkgs/misc/screensavers/pipes/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "09m4alb3clp3rhnqga5v6070p7n1gmnwp2ssqhq87nf2ipfpcaak";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir $out -p
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index da365fb7d99a..dd747bbbf6fc 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "09m4dnn4kplawprd2bl15nwa0b4r1brab3x44ga7f1fyk7aw5zwq";
   };
 
-  nativeBuildInputs = [ gettext ];
-  buildInputs = [ makeWrapper alsaLib ncurses libsamplerate fftw ];
+  nativeBuildInputs = [ gettext makeWrapper ];
+  buildInputs = [ alsaLib ncurses libsamplerate fftw ];
 
   configureFlags = [ "--disable-xmlto" "--with-udev-rules-dir=$(out)/lib/udev/rules.d" ];
 
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index ab148af72f23..bcc86b72de04 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gC1Q+kG/oKfYvuHVKstpRWfL/thsemULrimPrV/eeaI=";
   };
 
-  nativeBuildInputs = [ pkg-config help2man autoreconfHook ];
-  buildInputs = [ fuse makeWrapper ];
+  nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
+  buildInputs = [ fuse ];
 
   preConfigure = lib.optionalString enableDebugBuild ''
     sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index f90c79661907..254105534866 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -18,8 +18,8 @@ in stdenv.mkDerivation rec {
 
   kernel = optional (_kernel != null) _kernel.dev;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper util-linux openssl libcap_ng pythonEnv
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ util-linux openssl libcap_ng pythonEnv
                   perl procps which ];
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
index ddb5eff97230..f379633e1984 100644
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -19,9 +19,8 @@ in stdenv.mkDerivation rec {
 
   kernel = optional (_kernel != null) _kernel.dev;
 
-  nativeBuildInputs = [ autoconf libtool automake pkg-config  ];
-  buildInputs = [ makeWrapper util-linux openssl libcap_ng python2
-                  perl procps which ];
+  nativeBuildInputs = [ autoconf libtool automake pkg-config makeWrapper ];
+  buildInputs = [ util-linux openssl libcap_ng python2 perl procps which ];
 
   preConfigure = "./boot.sh";
 
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 14d1eb859980..e58b97654af2 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     rev = "ae42f1b5fef82b3bc23fe93c95c345e7af65fef3";
     sha256 = "0c342m0bpq6ranr7dsxk9qi5mg3j5aw9wv85ql8gprdb2pz59qy8";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     install -D pipework $out/bin/pipework
     wrapProgram $out/bin/pipework --prefix PATH : \
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 1b2415dd8052..0f69cb13fcd9 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -63,8 +63,8 @@ stdenv.mkDerivation {
     touch gnu-efi/inc/ia32/gnu/stubs-32.h
   '';
 
-  nativeBuildInputs = [ nasm perl python3 ];
-  buildInputs = [ libuuid makeWrapper ];
+  nativeBuildInputs = [ nasm perl python3 makeWrapper ];
+  buildInputs = [ libuuid ];
 
   enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
   hardeningDisable = [ "pic" "stackprotector" "fortify" ];
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index 826e952376c7..4bd50653d52c 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
-  buildInputs = [ jre makeWrapper bash gnugrep gnused coreutils ps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre bash gnugrep gnused coreutils ps ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/confluent-platform/default.nix b/pkgs/servers/confluent-platform/default.nix
index e1cf49099324..4a5846d01160 100644
--- a/pkgs/servers/confluent-platform/default.nix
+++ b/pkgs/servers/confluent-platform/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     sha256 = "18yvp56b8l074qfkgr4afirgd43g8b023n9ija6dnk6p6dib1f4j";
   };
 
-  buildInputs = [ jre makeWrapper bash ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre bash ];
 
   installPhase = ''
     cp -R $confluentCli confluent-cli
diff --git a/pkgs/servers/exhibitor/default.nix b/pkgs/servers/exhibitor/default.nix
index 0b92aca74c75..5636f51a1699 100644
--- a/pkgs/servers/exhibitor/default.nix
+++ b/pkgs/servers/exhibitor/default.nix
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
   # (given the state of Maven support in Nix). We're not actually building any java
   # source here.
   pomFileDir = "exhibitor-standalone/src/main/resources/buildscripts/standalone/maven";
-  nativeBuildInputs = [ maven ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ maven makeWrapper ];
   buildPhase = ''
       cd ${pomFileDir}
       mvn package --offline -Dmaven.repo.local=$(cp -dpR ${fetchedMavenDeps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2
diff --git a/pkgs/servers/h2/default.nix b/pkgs/servers/h2/default.nix
index be28578bcb0f..d05232193d78 100644
--- a/pkgs/servers/h2/default.nix
+++ b/pkgs/servers/h2/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pdvbnx7nqfqs7x1zkwz2q34331l55jknpk6arf6dksvnd71hinj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase =
     let
diff --git a/pkgs/servers/hbase/default.nix b/pkgs/servers/hbase/default.nix
index 09600082633d..32d2c09de97f 100644
--- a/pkgs/servers/hbase/default.nix
+++ b/pkgs/servers/hbase/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0kz72wqsii09v9hxkw10mzyvjhji5sx3l6aijjalgbybavpcxglb";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out
     cp -R * $out
diff --git a/pkgs/servers/jetbrains/youtrack.nix b/pkgs/servers/jetbrains/youtrack.nix
index 5aab96d1bc04..c3680d76b96e 100644
--- a/pkgs/servers/jetbrains/youtrack.nix
+++ b/pkgs/servers/jetbrains/youtrack.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1fnnpyikr1x443vxy6f7vlv550sbahpps8awyn13jpg7kpgfm7lk";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/servers/jitsi-videobridge/default.nix b/pkgs/servers/jitsi-videobridge/default.nix
index 138051e13c03..35cd6906012d 100644
--- a/pkgs/servers/jitsi-videobridge/default.nix
+++ b/pkgs/servers/jitsi-videobridge/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $src debcontents";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/mail/mailman/wrapped.nix b/pkgs/servers/mail/mailman/wrapped.nix
index 2a620763d876..c244af10e783 100644
--- a/pkgs/servers/mail/mailman/wrapped.nix
+++ b/pkgs/servers/mail/mailman/wrapped.nix
@@ -8,7 +8,7 @@ in
 
 runCommand "${mailman.name}-wrapped" {
   inherit (mailman) meta;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   passthru = mailman.passthru // { unwrapped = mailman; };
 } ''
   mkdir -p "$out/bin"
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index ff96f0e7c827..71bcc3fc6878 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -9,7 +9,8 @@ perlPackages.buildPerlPackage rec {
     sha256 = "0ga5mi2nv2v91kakk9xakkg71rnxnddlzv76ca13vfyd4jgcfasf";
   };
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     HTMLParser NetCIDRLite NetDNS NetAddrIP DBFile HTTPDate MailDKIM LWP
     IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF
     NetDNSResolverProgrammable Socket6
diff --git a/pkgs/servers/monitoring/fusion-inventory/default.nix b/pkgs/servers/monitoring/fusion-inventory/default.nix
index 0034c253c774..02841c6acb96 100644
--- a/pkgs/servers/monitoring/fusion-inventory/default.nix
+++ b/pkgs/servers/monitoring/fusion-inventory/default.nix
@@ -24,7 +24,8 @@ perlPackages.buildPerlPackage rec {
   '';
 
   buildTools = [];
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     CGI
     DataStructureUtil
     FileCopyRecursive
diff --git a/pkgs/servers/monitoring/longview/default.nix b/pkgs/servers/monitoring/longview/default.nix
index 96048005cb14..5d05dfd1ebb6 100644
--- a/pkgs/servers/monitoring/longview/default.nix
+++ b/pkgs/servers/monitoring/longview/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
         --replace /etc/linode /run/longview
   '';
 
-  buildInputs = [ perl makeWrapper glibc ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl glibc ]
     ++ (with perlPackages; [
       LWP
       LWPProtocolHttps
diff --git a/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix b/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
index 0c5aa7d8a438..e6505857bf57 100644
--- a/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
+++ b/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
@@ -14,7 +14,8 @@ in stdenv.mkDerivation {
     sha256 = "1pvqphrirq48xhmx0aa6vkxz6qy1cx2q6jxsh7rin432iap7j62f";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = "installPhase";
 
diff --git a/pkgs/servers/monitoring/seyren/default.nix b/pkgs/servers/monitoring/seyren/default.nix
index 1d26afad3d8b..4dd90cacb8bf 100644
--- a/pkgs/servers/monitoring/seyren/default.nix
+++ b/pkgs/servers/monitoring/seyren/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   phases = ["installPhase"];
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p "$out"/bin
diff --git a/pkgs/servers/monitoring/uchiwa/default.nix b/pkgs/servers/monitoring/uchiwa/default.nix
index 121b31e46eb8..a871bf87db2d 100644
--- a/pkgs/servers/monitoring/uchiwa/default.nix
+++ b/pkgs/servers/monitoring/uchiwa/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
 
   inherit src;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir -p $out/bin $out/public
diff --git a/pkgs/servers/monitoring/zipkin/default.nix b/pkgs/servers/monitoring/zipkin/default.nix
index e84c422ea646..9395c3c61c19 100644
--- a/pkgs/servers/monitoring/zipkin/default.nix
+++ b/pkgs/servers/monitoring/zipkin/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
     url = "https://search.maven.org/remotecontent?filepath=io/zipkin/java/zipkin-server/${version}/zipkin-server-${version}-exec.jar";
     sha256 = "02369fkv0kbl1isq6y26fh2zj5wxv3zck522m5wypsjlcfcw2apa";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand =
   ''
diff --git a/pkgs/servers/nosql/neo4j/default.nix b/pkgs/servers/nosql/neo4j/default.nix
index 684cdbe287c5..d9c9ddf8752b 100644
--- a/pkgs/servers/nosql/neo4j/default.nix
+++ b/pkgs/servers/nosql/neo4j/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zjb6cgk2lpzx6pq1cs5fh65in6b5ccpl1cgfiglgpjc948mnhzv";
   };
 
-  buildInputs = [ makeWrapper jre8 which gawk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre8 which gawk ];
 
 
   installPhase = ''
diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix
index 558fdad9841f..4c5be92e765b 100644
--- a/pkgs/servers/nosql/rethinkdb/default.nix
+++ b/pkgs/servers/nosql/rethinkdb/default.nix
@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "rethinkdb" ];
 
-  buildInputs = [ protobuf boost zlib curl openssl icu makeWrapper ]
+  buildInputs = [ protobuf boost zlib curl openssl icu ]
     ++ lib.optional (!stdenv.isDarwin) jemalloc
     ++ lib.optional stdenv.isDarwin libtool;
 
-  nativeBuildInputs = [ which m4 python2Packages.python ];
+  nativeBuildInputs = [ which m4 python2Packages.python makeWrapper ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 5f1f8e6230ed..4533e3138a7a 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -30,7 +30,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0m39r2il7d014kf2p6v28lw2hzshm6bhhdchqa8wzyvvmygqmwf2";
   };
 
-  buildInputs = [ pythonEnv makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pythonEnv ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 86230e11cb98..b3ad305687af 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -35,7 +35,8 @@ stdenv.mkDerivation (rec {
       "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/*\""
   '';
 
-  buildInputs = [ makeWrapper jre_headless util-linux ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre_headless util-linux ]
              ++ optional enableUnfree zlib;
 
   installPhase = ''
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index 6a51e5ea62f8..ffe8a75412bd 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -46,7 +46,8 @@ stdenv.mkDerivation (rec {
       "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/*\""
   '';
 
-  buildInputs = [ makeWrapper jre_headless util-linux ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre_headless util-linux ]
              ++ optional enableUnfree zlib;
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index d2f87295fbba..3dd811b51fa7 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -35,12 +35,12 @@ let
     setOutputFlags = false; # $out retains configureFlags :-/
 
     buildInputs =
-      [ zlib readline openssl libxml2 makeWrapper ]
+      [ zlib readline openssl libxml2 ]
       ++ lib.optionals icuEnabled [ icu ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
 
-    nativeBuildInputs = lib.optionals icuEnabled [ pkg-config ];
+    nativeBuildInputs = [ makeWrapper ] ++ lib.optionals icuEnabled [ pkg-config ];
 
     enableParallelBuilding = !stdenv.isDarwin;
 
diff --git a/pkgs/servers/ums/default.nix b/pkgs/servers/ums/default.nix
index 61bb815892ad..3d4e4fdf51dc 100644
--- a/pkgs/servers/ums/default.nix
+++ b/pkgs/servers/ums/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     cp -a . $out/
diff --git a/pkgs/servers/xmpp/ejabberd/default.nix b/pkgs/servers/xmpp/ejabberd/default.nix
index 5336df42cbe9..69b55a6f3c29 100644
--- a/pkgs/servers/xmpp/ejabberd/default.nix
+++ b/pkgs/servers/xmpp/ejabberd/default.nix
@@ -32,9 +32,9 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-nZxdYXRyv4UejPLHNT/p6CrvW22Koo7rZSi96KRjqFQ=";
   };
 
-  nativeBuildInputs = [ fakegit ];
+  nativeBuildInputs = [ fakegit makeWrapper ];
 
-  buildInputs = [ erlang openssl expat libyaml gd makeWrapper ]
+  buildInputs = [ erlang openssl expat libyaml gd ]
     ++ lib.optional withSqlite sqlite
     ++ lib.optional withPam pam
     ++ lib.optional withZlib zlib
diff --git a/pkgs/servers/zookeeper/default.nix b/pkgs/servers/zookeeper/default.nix
index 526a8d2956b3..c2315999b3ca 100644
--- a/pkgs/servers/zookeeper/default.nix
+++ b/pkgs/servers/zookeeper/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha512 = "caff5111bb6876b7124760bc006e6fa2523efa54b99321a3c9cd8192ea0d5596abc7d70a054b1aac9b20a411407dae7611c7aba870c23bff28eb1643ba499199";
   };
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = ["unpackPhase" "installPhase"];
 
diff --git a/pkgs/tools/X11/run-scaled/default.nix b/pkgs/tools/X11/run-scaled/default.nix
index bae91bbc4649..012eedf07791 100644
--- a/pkgs/tools/X11/run-scaled/default.nix
+++ b/pkgs/tools/X11/run-scaled/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1ma4ax7ydq4xvyzrc4zapihmf7v3d9zl9mbi8bgpps7nlgz544ys";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index ec40e0b06db4..bdade93329b7 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "xbindkeys-config";
   version = "0.1.3";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ gtk ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xbindkeys-config/xbindkeys-config_${version}.orig.tar.gz";
diff --git a/pkgs/tools/X11/xdg-user-dirs/default.nix b/pkgs/tools/X11/xdg-user-dirs/default.nix
index 6d0c46e52e92..207c052686f8 100644
--- a/pkgs/tools/X11/xdg-user-dirs/default.nix
+++ b/pkgs/tools/X11/xdg-user-dirs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "13216b8rfkzak5k6bvpx6jvqv3cnbgpijnjwj8a8d3kq4cl0a1ra";
   };
 
-  buildInputs = [ libxslt docbook_xsl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libxslt docbook_xsl ];
 
   preFixup = ''
     # fallback values need to be last
diff --git a/pkgs/tools/archivers/unp/default.nix b/pkgs/tools/archivers/unp/default.nix
index 34f8cb1c40e6..c63ec008d678 100644
--- a/pkgs/tools/archivers/unp/default.nix
+++ b/pkgs/tools/archivers/unp/default.nix
@@ -10,7 +10,8 @@ let
 in stdenv.mkDerivation {
   pname = "unp";
   version = "2.0-pre7";
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   src = fetchurl {
     # url = "http://http.debian.net/debian/pool/main/u/unp/unp_2.0~pre7+nmu1.tar.bz2";
diff --git a/pkgs/tools/backup/diskrsync/default.nix b/pkgs/tools/backup/diskrsync/default.nix
index 3b5d901daf0c..97870d5dedde 100644
--- a/pkgs/tools/backup/diskrsync/default.nix
+++ b/pkgs/tools/backup/diskrsync/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
   goPackagePath = "github.com/dop251/diskrsync";
   goDeps = ./deps.nix;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   preFixup = ''
     wrapProgram "$out/bin/diskrsync" --argv0 diskrsync --prefix PATH : ${openssh}/bin
diff --git a/pkgs/tools/backup/duplicati/default.nix b/pkgs/tools/backup/duplicati/default.nix
index 5330ca60a4dc..2d9124d6f51a 100644
--- a/pkgs/tools/backup/duplicati/default.nix
+++ b/pkgs/tools/backup/duplicati/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/{bin,share/${pname}-${version}}
diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index 15ac5acbe848..82d6bd5c601f 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-I1KkblFnZVOCvcWEarGsSXnzlod2+yZ4okaTpckLFbE=";
   };
 
-  buildInputs = [ txt2man makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ txt2man ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index d0ca5324cabd..026a3141fede 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
diff --git a/pkgs/tools/filesystems/fuse-7z-ng/default.nix b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
index aaffc70e10dd..8a0671957c35 100644
--- a/pkgs/tools/filesystems/fuse-7z-ng/default.nix
+++ b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fuse autoconf automake makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ fuse autoconf automake ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/filesystems/rmount/default.nix b/pkgs/tools/filesystems/rmount/default.nix
index 96d950e74ff1..1d8ced17aae0 100644
--- a/pkgs/tools/filesystems/rmount/default.nix
+++ b/pkgs/tools/filesystems/rmount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0j1ayncw1nnmgna7vyx44vwinh4ah1b0l5y8agc7i4s8clbvy3h0";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -D ${src}/rmount.man  $out/share/man/man1/rmount.1
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index d8d414500793..9c49c4677d2a 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
   pname = "XtreemFS";
   version = "1.5.1.81";
 
-  buildInputs = [ which attr makeWrapper python ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which attr python ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/tools/graphics/diagrams-builder/default.nix b/pkgs/tools/graphics/diagrams-builder/default.nix
index 3422b9a53bdc..9337d5cca23b 100644
--- a/pkgs/tools/graphics/diagrams-builder/default.nix
+++ b/pkgs/tools/graphics/diagrams-builder/default.nix
@@ -33,7 +33,7 @@ in
 stdenv.mkDerivation {
   name = "diagrams-builder";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = with lib;
     concatStrings (intersperse "\n" (map exeWrapper backends));
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index 40308ffa1a9a..865e0f141ff0 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "18wlvqbxcng8pawimbc8f2422s8fnk840hfr6946lzsxr0ijakvf";
   };
 
-  buildInputs = [ unzip makeWrapper ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index 704c3a2db526..9fe41d91db21 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1q66cksms4l62y0wizb8vfavhmf7kyfgcfkynil3n99s0hny1aqp";
   };
 
-  buildInputs = [ makeWrapper libpng perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libpng perl ];
   propagatedBuildInputs = [ perlPackages.LWP ];
 
   patchPhase = ''
diff --git a/pkgs/tools/graphics/pdfread/default.nix b/pkgs/tools/graphics/pdfread/default.nix
index abe560c81feb..6201b2d5888e 100644
--- a/pkgs/tools/graphics/pdfread/default.nix
+++ b/pkgs/tools/graphics/pdfread/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0mzxpnk97f0ww5ds7h4wsval3g4lnrhv6rhspjs7cy4i41gmk8an";
   };
 
-  buildInputs = [ unzip python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip python ];
 
   broken = true; # Not found.
 
diff --git a/pkgs/tools/graphics/structure-synth/default.nix b/pkgs/tools/graphics/structure-synth/default.nix
index ec2cb359a5e0..a4772cad3c49 100644
--- a/pkgs/tools/graphics/structure-synth/default.nix
+++ b/pkgs/tools/graphics/structure-synth/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1kiammx46719az6jzrav8yrwz82nk4m72ybj0kpbnvp9wfl3swbb";
   };
 
-  buildInputs = [ qt4 unzip libGLU makeWrapper ];
-  nativeBuildInputs = [ qmake4Hook ];
+  buildInputs = [ qt4 unzip libGLU ];
+  nativeBuildInputs = [ qmake4Hook makeWrapper ];
 
   # Thanks to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672000#15:
   patches = [ ./gcc47.patch ];
diff --git a/pkgs/tools/graphics/welkin/default.nix b/pkgs/tools/graphics/welkin/default.nix
index 53e7378bd3be..2f9c43373bbe 100644
--- a/pkgs/tools/graphics/welkin/default.nix
+++ b/pkgs/tools/graphics/welkin/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "welkin-r9638/tags/${version}";
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p $out/{bin,share}
diff --git a/pkgs/tools/inputmethods/fcitx5/with-addons.nix b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
index 17501d5f3622..020e829f0987 100644
--- a/pkgs/tools/inputmethods/fcitx5/with-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ fcitx5 fcitx5-configtool fcitx5-lua fcitx5-qt fcitx5-gtk ] ++ addons;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/fcitx5 \
diff --git a/pkgs/tools/misc/0x0/default.nix b/pkgs/tools/misc/0x0/default.nix
index e0f84329b897..39cfcefaee8a 100644
--- a/pkgs/tools/misc/0x0/default.nix
+++ b/pkgs/tools/misc/0x0/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1qpylyxrisy3p2lyirfarfj5yzrdjgsgxwf8gqwljpcjn207hr72";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -Dm755 0x0 $out/bin/0x0
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index e25543b5145a..720b0a875a80 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
     URI
   ];
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ perlPackages.perl libpcap makeWrapper ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper ];
+  buildInputs = [ perlPackages.perl libpcap ];
 
   postInstall = ''
     for name in get-{oui,iab}; do
diff --git a/pkgs/tools/misc/byobu/default.nix b/pkgs/tools/misc/byobu/default.nix
index c647d3b39028..ffe3fd0fe162 100644
--- a/pkgs/tools/misc/byobu/default.nix
+++ b/pkgs/tools/misc/byobu/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [ perl makeWrapper gettext ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl gettext ];
   propagatedBuildInputs = [ textual-window-manager screen ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/capture/default.nix b/pkgs/tools/misc/capture/default.nix
index d0e6c1673497..d858e0fbc461 100644
--- a/pkgs/tools/misc/capture/default.nix
+++ b/pkgs/tools/misc/capture/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0zyyg4mvrny7cc2xgvfip97b6yc75ka5ni39rwls93971jbk83d6";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -Dm755 src/capture.sh $out/bin/capture
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index f518c1b8e3f2..3e18d3f4b54e 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -15,9 +15,8 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */Unix)
   '';
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
-    perl AlgorithmDiff ParallelForkManager RegexpCommon
-  ]);
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [ perl AlgorithmDiff ParallelForkManager RegexpCommon ]);
 
   makeFlags = [ "prefix=" "DESTDIR=$(out)" "INSTALL=install" ];
 
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index 8de7cc99336d..cbeede0cc305 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -16,7 +16,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xy1nvqrnifx46g8ch69pk31by0va6hn10wpi1fkrsrgncanjjh1";
   };
 
-  buildInputs = [ unzip xz dpkg libxslt python setuptools makeWrapper curl gnupg diffutils ] ++
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip xz dpkg libxslt python setuptools curl gnupg diffutils ] ++
     (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps ]);
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 5be309be582f..8ebb2924b036 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   dontBuild = true;
   dontStrip = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   makeWrapperArgs = [ "--prefix" "PATH" ":" "${jre_headless}/bin" ];
 
   passthru.tests = { inherit (nixosTests) graylog; };
diff --git a/pkgs/tools/misc/ix/default.nix b/pkgs/tools/misc/ix/default.nix
index ed47e477854c..83d8a7704192 100644
--- a/pkgs/tools/misc/ix/default.nix
+++ b/pkgs/tools/misc/ix/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 =  "0xc2s4s1aq143zz8lgkq5k25dpf049dw253qxiav5k7d7qvzzy57";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/misc/keychain/default.nix b/pkgs/tools/misc/keychain/default.nix
index 49b3ffbb7dde..61abb3eee105 100644
--- a/pkgs/tools/misc/keychain/default.nix
+++ b/pkgs/tools/misc/keychain/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bkjlg0a2bbdjhwp37ci1rwikvrl4s3xlbf2jq2z4azc96dr83mj";
   };
 
-  buildInputs = [ makeWrapper perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/{bin,share/man/man1}
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index d33cdbacb15e..fd8b805743ac 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
     sha256 = "1gr5l2fr9qbdccga8bhsrpvz6jxigvfkdxrln9wyf2xpps5cdjxh";
   };
 
-  buildInputs = [ goobook makeWrapper perl ConvertASN1 perlldap AuthenSASL ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ goobook perl ConvertASN1 perlldap AuthenSASL ]
     ++ optional (!stdenv.isDarwin) finger_bsd
     ++ optional   (abook != null) abook
     ++ optional   (gnupg != null) gnupg
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index ad2d0127ab05..7a066428687a 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /usr/share/xml/docbook/stylesheet/docbook-xsl ${docbook-xsl}/xml/xsl/docbook
   '';
 
-  buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 ]
     ++ optional stdenv.isDarwin darwin.cctools;
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
diff --git a/pkgs/tools/misc/ocz-ssd-guru/default.nix b/pkgs/tools/misc/ocz-ssd-guru/default.nix
index c5ac32af3be4..0c021591e5e5 100644
--- a/pkgs/tools/misc/ocz-ssd-guru/default.nix
+++ b/pkgs/tools/misc/ocz-ssd-guru/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ri7qmpc1xpy12lpzl6k298c641wcibcwrzz8jn75wdg4rr176r5";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   libPath = lib.makeLibraryPath [
       xorg.libX11
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index 168eda1cf3d5..678c2607b614 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0b0hilqmgz6n1q7irp17h48v8fjpxhjapgw1py8kyav1d51s7mm2";
   };
 
-  buildInputs = [ autoconf automake curl jdk makeWrapper nettools python git ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ autoconf automake curl jdk nettools python git ];
 
   preConfigure = ''
     patchShebangs ./build-aux/
diff --git a/pkgs/tools/misc/os-prober/default.nix b/pkgs/tools/misc/os-prober/default.nix
index 07279400fc4d..bc5dbe4672e8 100644
--- a/pkgs/tools/misc/os-prober/default.nix
+++ b/pkgs/tools/misc/os-prober/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mfv1b40n/opXdyj6IXWVf/32sWlS+/DbXIRwE1zX4KM=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     # executables
     install -Dt $out/bin os-prober linux-boot-prober
diff --git a/pkgs/tools/misc/pb_cli/default.nix b/pkgs/tools/misc/pb_cli/default.nix
index eacbc0d6bd2d..48b819d5bfdd 100644
--- a/pkgs/tools/misc/pb_cli/default.nix
+++ b/pkgs/tools/misc/pb_cli/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "0w6a789zffvz4ixsb92q45n5s4xyx7s2l2f07972i3dajaaai8z7";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   liveDeps = [ jq curl ] ++ lib.optional screenshots maim
                          ++ lib.optional video capture
diff --git a/pkgs/tools/misc/pk2cmd/default.nix b/pkgs/tools/misc/pk2cmd/default.nix
index 7ffbd8ded1ca..009d841bf557 100644
--- a/pkgs/tools/misc/pk2cmd/default.nix
+++ b/pkgs/tools/misc/pk2cmd/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/pk2cmd --prefix PATH : $out/share/pk2
   '';
 
-  buildInputs = [ libusb-compat-0_1 makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libusb-compat-0_1 ];
 
   meta = {
     homepage = "https://www.microchip.com/pickit2";
diff --git a/pkgs/tools/misc/plowshare/default.nix b/pkgs/tools/misc/plowshare/default.nix
index d9c208510fc6..0b5005b9c82a 100644
--- a/pkgs/tools/misc/plowshare/default.nix
+++ b/pkgs/tools/misc/plowshare/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1p8s60dlzaldp006yj710s371aan915asyjhd99188vrj4jj1x79";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/misc/ponysay/default.nix b/pkgs/tools/misc/ponysay/default.nix
index b94ca6cfea34..113c2b05ff59 100644
--- a/pkgs/tools/misc/ponysay/default.nix
+++ b/pkgs/tools/misc/ponysay/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "12mjabf5cpp5dgg63s19rlyq3dhhpzzy2sa439yncqzsk7rdg0n3";
   };
 
-  buildInputs = [ python3 texinfo makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 texinfo  ];
 
   inherit python3;
 
diff --git a/pkgs/tools/misc/profile-cleaner/default.nix b/pkgs/tools/misc/profile-cleaner/default.nix
index c8a2b338817d..77f865a6a168 100644
--- a/pkgs/tools/misc/profile-cleaner/default.nix
+++ b/pkgs/tools/misc/profile-cleaner/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "11sjf4j9dr6ih9jkg6vqq6gkfg6wly4182bi1008bsm1zdmm5iz7";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     PREFIX=\"\" DESTDIR=$out make install
diff --git a/pkgs/tools/misc/pws/default.nix b/pkgs/tools/misc/pws/default.nix
index 0edec63c8c92..e98323b75eea 100644
--- a/pkgs/tools/misc/pws/default.nix
+++ b/pkgs/tools/misc/pws/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   name = "pws-${(import ./gemset.nix).pws.version}";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index 423135d53fd1..1cfc039273ec 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -18,8 +18,8 @@ in stdenv.mkDerivation rec {
   };
 
   pythonPaths = [ pycrypto pyyaml requests ];
-  buildInputs = [ python perl nose mock makeWrapper python-dateutil setuptools ] ++ pythonPaths;
-  nativeBuildInputs = [ gitMinimal zip ];
+  buildInputs = [ python perl nose mock python-dateutil setuptools ] ++ pythonPaths;
+  nativeBuildInputs = [ gitMinimal zip makeWrapper ];
 
   postPatch = ''
     substituteInPlace scripts/run-tests.sh \
diff --git a/pkgs/tools/misc/tmux-cssh/default.nix b/pkgs/tools/misc/tmux-cssh/default.nix
index f3f536279566..830c365fa403 100644
--- a/pkgs/tools/misc/tmux-cssh/default.nix
+++ b/pkgs/tools/misc/tmux-cssh/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "473e27f3b69864b905d1340d97917cd202705c761611eb3aec4c24521f69b52c";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index a0392bf4754c..05750b962f00 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -10,7 +10,7 @@ let
 in
 stdenv.mkDerivation {
   name = "xvfb-run";
-  buildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     mkdir -p $out/bin
     cp ${xvfb_run} $out/bin/xvfb-run
diff --git a/pkgs/tools/networking/airfield/default.nix b/pkgs/tools/networking/airfield/default.nix
index 0976a764a6f2..374a76871cb0 100644
--- a/pkgs/tools/networking/airfield/default.nix
+++ b/pkgs/tools/networking/airfield/default.nix
@@ -42,7 +42,8 @@ let
 in stdenv.mkDerivation {
   inherit name version src;
 
-  buildInputs = [ makeWrapper nodejs ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ nodejs ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/networking/atftp/default.nix b/pkgs/tools/networking/atftp/default.nix
index 0038a5e2e7f8..0e76cb94346b 100644
--- a/pkgs/tools/networking/atftp/default.nix
+++ b/pkgs/tools/networking/atftp/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-08nNDZcd/Hhtel9AVcNdTmaq/IECrANHPvIlvfftsmo=";
   };
 
-  buildInputs = [ readline tcp_wrappers pcre makeWrapper gcc ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ readline tcp_wrappers pcre gcc ];
 
   # Expects pre-GCC5 inline semantics
   NIX_CFLAGS_COMPILE = "-std=gnu89";
diff --git a/pkgs/tools/networking/carddav-util/default.nix b/pkgs/tools/networking/carddav-util/default.nix
index 39728f7e9a07..112a95eccc6e 100644
--- a/pkgs/tools/networking/carddav-util/default.nix
+++ b/pkgs/tools/networking/carddav-util/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0f0raffdy032wlnxfck6ky60r163nhqfbr311y4ry55l60s4497n";
   };
 
-  buildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
 
   propagatedBuildInputs = with pythonPackages; [ requests vobject lxml ];
 
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index c56ba5a4a661..751dd2c8c1f9 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
       ./set-hostname.patch
     ];
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ perl makeWrapper ];
 
-  buildInputs = [ makeWrapper openldap ];
+  buildInputs = [ openldap ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 5ddbf24bb6a9..92c241967ae0 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ protobuf ncurses zlib makeWrapper openssl bash-completion ]
+  nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper ];
+  buildInputs = [ protobuf ncurses zlib openssl bash-completion ]
     ++ (with perlPackages; [ perl IOTty ])
     ++ lib.optional withUtempter libutempter;
 
diff --git a/pkgs/tools/networking/openresolv/default.nix b/pkgs/tools/networking/openresolv/default.nix
index bc7db4fc6f36..f486c903c5d6 100644
--- a/pkgs/tools/networking/openresolv/default.nix
+++ b/pkgs/tools/networking/openresolv/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QrMFCOhXoihTXGMeqsk2hi2G7KaMFLXAvzh7oXa5G5c=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   configurePhase =
     ''
diff --git a/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix b/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
index 16e97bab2146..2120679fef3e 100644
--- a/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
+++ b/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "16pcyvyhwsx34i0cjkkx906lmrwdd9gvznvqdwlad4ha8l8f8z42";
   };
 
-  buildInputs = [ makeWrapper coreutils gawk util-linux ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ coreutils gawk util-linux ];
 
   installPhase = ''
     install -Dm555 ovpn-learnaddress $out/libexec/openvpn/openvpn-learnaddress
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index f65f97ed91d0..9ee014396530 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1sas9d9kk92mc2wrwgmm0xxz7ycmh388dwvyxf1hy183yvin1nac";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
 
diff --git a/pkgs/tools/networking/swaks/default.nix b/pkgs/tools/networking/swaks/default.nix
index fb822177725a..49ef0afc0603 100644
--- a/pkgs/tools/networking/swaks/default.nix
+++ b/pkgs/tools/networking/swaks/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0c2sx4nrh4whsqzj6m5ay8d7yqan3aqgg436p8jb25bs91ykn2pv";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/swec/default.nix b/pkgs/tools/networking/swec/default.nix
index 71fea1c2e830..c98a3417d1c4 100644
--- a/pkgs/tools/networking/swec/default.nix
+++ b/pkgs/tools/networking/swec/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1m3971z4z1wr0paggprfz0n8ng8vsnkc9m6s3bdplgyz7qjk6jwx";
   };
 
-  buildInputs = [ makeWrapper perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
   checkInputs = [ perlPackages.HTTPServerSimple perlPackages.Parent ];
 
   configurePhase = ''
diff --git a/pkgs/tools/networking/telepresence/default.nix b/pkgs/tools/networking/telepresence/default.nix
index a077ddb3de46..5d1966114b78 100644
--- a/pkgs/tools/networking/telepresence/default.nix
+++ b/pkgs/tools/networking/telepresence/default.nix
@@ -31,7 +31,7 @@ in pythonPackages.buildPythonPackage rec {
     sha256 = "6V0sM0Z+2xNDgL0wIzJOdaUp2Ol4ejNTk9K/pllVa7g=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/telepresence \
diff --git a/pkgs/tools/networking/vpnc/default.nix b/pkgs/tools/networking/vpnc/default.nix
index a754e7e9937c..edb50559fc0f 100644
--- a/pkgs/tools/networking/vpnc/default.nix
+++ b/pkgs/tools/networking/vpnc/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
   # `ifconfig' as found in net-tools (not GNU Inetutils).
   propagatedBuildInputs = [ nettools ];
 
-  buildInputs = [libgcrypt perl makeWrapper openssl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [libgcrypt perl openssl ];
 
   preConfigure = ''
     sed -i 's|^#OPENSSL|OPENSSL|g' Makefile
diff --git a/pkgs/tools/package-management/nix-bundle/default.nix b/pkgs/tools/package-management/nix-bundle/default.nix
index 41ce0967b2e3..7b52f2585f35 100644
--- a/pkgs/tools/package-management/nix-bundle/default.nix
+++ b/pkgs/tools/package-management/nix-bundle/default.nix
@@ -11,8 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "0hdvdjm467w37clkhbifn54hbdmnxlbk66cj88lwaz26j4s2ik5g";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   # coreutils, gnutar is actually needed by nix for bootstrap
-  buildInputs = [ nix coreutils makeWrapper gnutar gzip bzip2 ];
+  buildInputs = [ nix coreutils gnutar gzip bzip2 ];
 
   binPath = lib.makeBinPath [ nix coreutils gnutar gzip bzip2 ];
 
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index 0e4005022ff9..4dc0098316c6 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -9,7 +9,8 @@ let self = stdenv.mkDerivation rec {
     rev = "version-${version}";
     sha256 = "1pccvc0iqapms7kidrh09g5fdx44x622r5l9k7bkmssp3v4c68vy";
   };
-  buildInputs = [ python3 mypy makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 mypy ];
   checkPhase = ''
     mypy bin/*
   '';
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index 569b83feb9ae..cd90342738ed 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config makeWrapper ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
   ++ lib.optionals (enablePython) [ python2 ]
   ;
-  buildInputs = [ perl nss nspr pam intltool makeWrapper ]
+  buildInputs = [ perl nss nspr pam intltool ]
   ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
diff --git a/pkgs/tools/security/ecryptfs/helper.nix b/pkgs/tools/security/ecryptfs/helper.nix
index ecd12a2738d8..bd558b7ab66d 100644
--- a/pkgs/tools/security/ecryptfs/helper.nix
+++ b/pkgs/tools/security/ecryptfs/helper.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers/bin
   installPhase = ''
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 7e2c0fcdb338..107bf56cf828 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -59,7 +59,8 @@ let
       maintainers = with maintainers; [ ewok ];
     };
 
-    buildInputs = [makeWrapper dpkg];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [dpkg];
     phases = [ "unpackPhase" "installPhase" ];
 
     unpackPhase = "dpkg -X $src .";
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index 20ee69eeaea2..19e5f16924a5 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1914z0jgj7lni0nf3hslkjgkv87mhxdr92cmhmbzhpjgjgr23ydp";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/security/ipscan/default.nix b/pkgs/tools/security/ipscan/default.nix
index a5b0fe8d9289..d1c56beb0816 100644
--- a/pkgs/tools/security/ipscan/default.nix
+++ b/pkgs/tools/security/ipscan/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
   sourceRoot = ".";
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $src .";
 
-  buildInputs = [ makeWrapper jdk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   installPhase = ''
     mkdir -p $out/share
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index d0e260bb6775..37af42e33ccf 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1srd6vrqgjlf906zdyxp4bg6gihkxn62cpzyfv0zzpsqsj13iwh1";
   };
 
-  buildInputs = [ makeWrapper perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 619cc9c3192c..f2358d1f80d6 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-DD/nFbSNs3nVNe+W+5zAmDlvMCseYuWWpKX9Dp+9Etc=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontPatchELF = true; # stay away from exploit executables
 
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index c46d5b65cd8e..5c07add90563 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
 
   phases = "installPhase";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   desktopItem = makeDesktopItem {
     name = appName;
diff --git a/pkgs/tools/security/pass/rofi-pass.nix b/pkgs/tools/security/pass/rofi-pass.nix
index b6547deb560a..3b5aedf81a80 100644
--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "131jpcwyyzgzjn9lx4k1zn95pd68pjw4i41jfzcp9z9fnazyln5n";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/system/bpytop/default.nix b/pkgs/tools/system/bpytop/default.nix
index 6c0143a34b64..9a0101539600 100644
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ds+N0z7Vfw7xv+nE8RIfFjel81mJgIo1u1KspOHLxKc=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = with python3Packages; [ python psutil ];
 
   dontBuild = true;
diff --git a/pkgs/tools/system/inxi/default.nix b/pkgs/tools/system/inxi/default.nix
index b941c5f7275b..1cceb5b009cc 100644
--- a/pkgs/tools/system/inxi/default.nix
+++ b/pkgs/tools/system/inxi/default.nix
@@ -31,7 +31,8 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-wY9wsxBByxqy9qk/7UoKiUSpFGS1rFpdyTs3ig6OJRs=";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/system/rofi-systemd/default.nix b/pkgs/tools/system/rofi-systemd/default.nix
index 4a2e14edc91f..f64a84c55095 100644
--- a/pkgs/tools/system/rofi-systemd/default.nix
+++ b/pkgs/tools/system/rofi-systemd/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0lgffb6rk1kf91j4j303lzpx8w2g9zy2gk99p8g8pk62a30c5asm";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/text/jsawk/default.nix b/pkgs/tools/text/jsawk/default.nix
index e700d7c486e5..951f236d04a5 100644
--- a/pkgs/tools/text/jsawk/default.nix
+++ b/pkgs/tools/text/jsawk/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0z3vdr3c8nvdrrxkjv9b4xg47mdb2hsknxpimw6shgwbigihapyr";
   };
   dontBuild = true;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out/bin
     cp $src/jsawk $out/bin/
diff --git a/pkgs/tools/text/popfile/default.nix b/pkgs/tools/text/popfile/default.nix
index ef945235a904..e2f5952077f3 100644
--- a/pkgs/tools/text/popfile/default.nix
+++ b/pkgs/tools/text/popfile/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     ## These are all taken from the popfile documentation as applicable to Linux
     ## http://getpopfile.org/docs/howtos:allplatformsrequireperl
     perl
diff --git a/pkgs/tools/text/reckon/default.nix b/pkgs/tools/text/reckon/default.nix
index bbefa94637db..b37928fc7c5b 100644
--- a/pkgs/tools/text/reckon/default.nix
+++ b/pkgs/tools/text/reckon/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = let
     env = bundlerEnv {
diff --git a/pkgs/tools/text/unoconv/default.nix b/pkgs/tools/text/unoconv/default.nix
index 97a3b4d725ee..9f3375c7e41c 100644
--- a/pkgs/tools/text/unoconv/default.nix
+++ b/pkgs/tools/text/unoconv/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "1akx64686in8j8arl6vsgp2n3bv770q48pfv283c6fz6wf9p8fvr";
   };
 
-  buildInputs = [ asciidoc makeWrapper ];
+  nativeBuildInputs = [ asciidoc makeWrapper ];
 
   preBuild = ''
     makeFlags=prefix="$out"
diff --git a/pkgs/tools/typesetting/docbook2odf/default.nix b/pkgs/tools/typesetting/docbook2odf/default.nix
index 91d8f6f8d32f..affa12c40190 100644
--- a/pkgs/tools/typesetting/docbook2odf/default.nix
+++ b/pkgs/tools/typesetting/docbook2odf/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "10k44g0qqa37k30pfj8vz95j6zdzz0nmnqjq1lyahfs2h4glzgwb";
   };
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   installPhase = ''
     mkdir -p "$out/bin/"
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index fdfa05f20c1f..4b9e571c0ad3 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  buildInputs = [ texinfo groff libxml2 libxslt makeWrapper opensp libiconv ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ texinfo groff libxml2 libxslt opensp libiconv ]
     ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
diff --git a/pkgs/tools/typesetting/pdfsandwich/default.nix b/pkgs/tools/typesetting/pdfsandwich/default.nix
index 10f8525da084..755ac6bb32a3 100644
--- a/pkgs/tools/typesetting/pdfsandwich/default.nix
+++ b/pkgs/tools/typesetting/pdfsandwich/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1420c33divch087xrr61lvyf975bapqkgjqaighl581i69nlzsm6";
   };
 
-  buildInputs = [ ocaml perl makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml perl ];
   installPhase = ''
     mkdir -p $out/bin
     cp -p pdfsandwich $out/bin
diff --git a/pkgs/tools/typesetting/sshlatex/default.nix b/pkgs/tools/typesetting/sshlatex/default.nix
index 07c972420ab5..8a5b4811d770 100644
--- a/pkgs/tools/typesetting/sshlatex/default.nix
+++ b/pkgs/tools/typesetting/sshlatex/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0kaah8is74zba9373xccmsxmnnn6kh0isr4qpg21x3qhdzhlxl7q";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = let
     binPath = lib.makeBinPath [ openssh perl gnutar bash inotify-tools ];
diff --git a/pkgs/tools/typesetting/ted/default.nix b/pkgs/tools/typesetting/ted/default.nix
index 937e3ffd7d71..07e89f9f8edd 100644
--- a/pkgs/tools/typesetting/ted/default.nix
+++ b/pkgs/tools/typesetting/ted/default.nix
@@ -58,7 +58,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  buildInputs = [ pkg-config zlib pcre xorg.xlibsWrapper xorg.libXpm libjpeg libtiff libpng gtk2 libpaper makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config zlib pcre xorg.xlibsWrapper xorg.libXpm libjpeg libtiff libpng gtk2 libpaper ];
 
   meta = with lib; {
     description = "An easy rich text processor";
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index fd1815efa945..d2858a90885e 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -270,8 +270,8 @@ dvipng = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  nativeBuildInputs = [ perl pkg-config ];
-  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
+  nativeBuildInputs = [ perl pkg-config makeWrapper ];
+  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript ];
 
   preConfigure = ''
     cd texk/dvipng
diff --git a/pkgs/tools/virtualization/ec2-ami-tools/default.nix b/pkgs/tools/virtualization/ec2-ami-tools/default.nix
index eafd740b0650..00df6bd97e11 100644
--- a/pkgs/tools/virtualization/ec2-ami-tools/default.nix
+++ b/pkgs/tools/virtualization/ec2-ami-tools/default.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation rec {
 
   version = "1.5.7";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/ec2-downloads/${pname}-${version}.zip";
diff --git a/pkgs/tools/virtualization/ec2-api-tools/default.nix b/pkgs/tools/virtualization/ec2-api-tools/default.nix
index 8e3ab0d9f28a..0c3aec2aadf9 100644
--- a/pkgs/tools/virtualization/ec2-api-tools/default.nix
+++ b/pkgs/tools/virtualization/ec2-api-tools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0figmvcm82ghmpz3018ihysz8zpxpysgbpdx7rmciq9y80qbw6l5";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase =
     ''