As a quick and dirty way to get started, I just did this:

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 692474d48c42..262594e6dd15 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -845,6 +845,10 @@ stdenvNoCC.mkDerivation {
       substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
     ''

+    + ''
+      echo "-Werror=write-strings" >> $out/nix-support/cc-cflags
+    ''
+
     ##
     ## Extra custom steps
     ##

In reply to @emilazy:matrix.org
I wish we had the resources to have an "experimental" jobset always running that we could throw stuff like this on

Randy Eckenrode in #staging:nixos.org (https://matrix.to/#/!UNVBThoJtlIiVwiDjU:nixos.org/$GOAB-0pj06IwTEidSgN3biXYZn_r9yZTViHoL6Y2Yns?via=nixos.org&via=matrix.org&via=tchncs.de)

You can’t compile the stage 1 LLVM with GCC then rebuild it again in a later stage with the stage 1 LLVM? (Are there complications with switching C++ ABIs?)

This is where my idea of splitting out the bootstrap tarballs would be useful. We could compile stage 1 LLVM from GCC but I feel like it may be a better solution to use LLVM prebuilt to build LLVM. Plus it'll likely be better on the eval since we wouldn't likely be needing odd exceptions or overrides.