diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index 3c74b6e9175..158ffe5fc8d 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -49,11 +49,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-amedKK9nplLVJTldeabN3/c+g/QesrdH+qx+rba2/4s=";
   };
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
+  env.NIX_CFLAGS_COMPILE = lib.optionals true [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
-  ]);
+  ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 3d60934557c..fc36edf9ee4 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -537,8 +537,8 @@ else let
     assert lib.assertMsg (overlappingNames == [ ])
       "The ‘env’ attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping: ${lib.concatStringsSep ", " overlappingNames}";
     lib.mapAttrs
-      (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v || lib.isDerivation v)
-        "The ‘env’ attribute set can only contain derivation, string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; v)
+      (n: v: assert lib.assertMsg (lib.isString v || lib.isBool v || lib.isInt v || lib.isDerivation v || lib.isList v)
+        "The ‘env’ attribute set can only contain derivation, list, string, boolean or integer attributes. The ‘${n}’ attribute is of type ${builtins.typeOf v}."; (if lib.isList v then toString v else v))
       env;
 
 in

[nix-shell:~]$ which hello
/nix/store/nfzcdd26n8qs7dyh6kwz2hmp9rkppdcg-hello-2.12.1/bin/hello

[nix-shell:~]$ patchelf --print-needed /nix/store/nfzcdd26n8qs7dyh6kwz2hmp9rkppdcg-hello-2.12.1/bin/hello
libc.so.6
ld-linux-aarch64.so.1

anyone know why we add ldso to needed for (as far as I can tell) just aarch64? i can't get the same result on x86_64-linux, and I don't see any extra flags added via ld-wrapper that would cause this.

[nix-shell:~]$ which hello
/nix/store/nfzcdd26n8qs7dyh6kwz2hmp9rkppdcg-hello-2.12.1/bin/hello

[nix-shell:~]$ patchelf --print-needed /nix/store/nfzcdd26n8qs7dyh6kwz2hmp9rkppdcg-hello-2.12.1/bin/hello
libc.so.6
ld-linux-aarch64.so.1

anyone know why/where we add ldso to needed for (as far as I can tell) just aarch64? i can't get the same result on x86_64-linux, and I don't see any extra flags added via ld-wrapper that would cause this.

In reply to @trofi:matrix.org
patchelf --set-interpreter

In reply to @trofi:matrix.org
Looks like it's intentional after all: It's added by ...-glibc-2.35-224/lib/libc.so: GROUP ( ...-glibc-2.35-224/lib/libc.so.6 ...-glibc-2.35-224/lib/libc_ nonshared.a AS_NEEDED ( ...-glibc-2.35-224/lib/ld-linux-aarch64.so.1 ) ) and provides __stack_chk_guard@@GLIBC_2.17 symbol.