diff --git a/pkgs/shells/any-nix-shell/default.nix b/pkgs/shells/any-nix-shell/default.nix
index 3bd41a53844..095347a3ca9 100644
--- a/pkgs/shells/any-nix-shell/default.nix
+++ b/pkgs/shells/any-nix-shell/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, bash }:
 
 stdenv.mkDerivation rec {
   pname = "any-nix-shell";
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "0q27rhjhh7k0qgcdcfm8ly5za6wm4rckh633d0sjz87faffkp90k";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
   installPhase = ''
     mkdir -p $out/bin
     cp -r bin $out
diff --git a/pkgs/shells/bash/bash-completion/default.nix b/pkgs/shells/bash/bash-completion/default.nix
index 6571d572a42..75ded461ea6 100644
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "1b0iz7da1sgifx1a5wdyx1kxbzys53v0kyk8nhxfipllmm5qka3k";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook ];
 
   # tests are super flaky unfortunately, and regularily break.
diff --git a/pkgs/shells/bash/nix-bash-completions/default.nix b/pkgs/shells/bash/nix-bash-completions/default.nix
index 089e5dfc702..c4282ab0f64 100644
--- a/pkgs/shells/bash/nix-bash-completions/default.nix
+++ b/pkgs/shells/bash/nix-bash-completions/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n5zs6xcnv4bv1hdaypmz7fv4j7dsr4a0ifah99iyj4p5j85i1bc";
   };
 
+  strictDeps = true;
   # To enable lazy loading via. bash-completion we need a symlink to the script
   # from every command name.
   installPhase = ''
diff --git a/pkgs/shells/bash/undistract-me/default.nix b/pkgs/shells/bash/undistract-me/default.nix
index 9ed5544713d..b15903e779e 100644
--- a/pkgs/shells/bash/undistract-me/default.nix
+++ b/pkgs/shells/bash/undistract-me/default.nix
@@ -43,6 +43,8 @@ stdenvNoCC.mkDerivation rec {
     })
   ];
 
+  strictDeps = true;
+
   # Patch in dependencies. Can't use makeWrapper because the bash
   # functions will be sourced and invoked in a different environment
   # for each command invocation.
diff --git a/pkgs/shells/bash/yarn-completion/default.nix b/pkgs/shells/bash/yarn-completion/default.nix
index fabfc0a1ce2..48d1f42b5ce 100644
--- a/pkgs/shells/bash/yarn-completion/default.nix
+++ b/pkgs/shells/bash/yarn-completion/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xflbrbwskjqv3knvc8jqygpvfxh5ak66q7w22d1ng8gwrfqzcng";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ installShellFiles ];
 
   installPhase = ''
diff --git a/pkgs/shells/dash/default.nix b/pkgs/shells/dash/default.nix
index a1f789dc3a3..f33fd5520f8 100644
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  strictDeps = true;
   # configure.ac patched; remove on next release
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index fc61efc3006..f0c5611e3b3 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -17,6 +17,7 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-iuklI7XEQUgZ2ObYRROxyiccZ1JkajK5OJA7hIcpRZQ=";
 
+  strictDeps = true;
   doCheck = false;
 
   doInstallCheck = true;
diff --git a/pkgs/shells/es/default.nix b/pkgs/shells/es/default.nix
index 8cc49bd39eb..308a684e6f6 100644
--- a/pkgs/shells/es/default.nix
+++ b/pkgs/shells/es/default.nix
@@ -17,7 +17,9 @@ stdenv.mkDerivation rec {
     sourceRoot=.
   '';
 
-  buildInputs = [ readline bison ];
+  strictDeps = true;
+  nativeBuildInputs = [ bison ];
+  buildInputs = [ readline ];
 
   configureFlags = [ "--with-readline" ];
 
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 4c45fd3a75f..e9555c7f21f 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -186,6 +186,7 @@ let
       rm tests/pexpects/exit_handlers.py
     '';
 
+    strictDeps = true;
     nativeBuildInputs = [
       cmake
       gettext
diff --git a/pkgs/shells/fish/oh-my-fish/default.nix b/pkgs/shells/fish/oh-my-fish/default.nix
index 3ec4e3b12d7..252e9350eaf 100644
--- a/pkgs/shells/fish/oh-my-fish/default.nix
+++ b/pkgs/shells/fish/oh-my-fish/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , fish
+, bash
 , runtimeShell
 , writeShellScript
 }:
@@ -17,8 +18,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-lwMo4+PcYR9kYJPWK+ALiMfBdxFSgB2vjtSn8QrmmEA=";
   };
 
+  strictDeps = true;
   buildInputs = [
     fish
+    bash
   ];
 
   dontConfigure = true;
diff --git a/pkgs/shells/jush/default.nix b/pkgs/shells/jush/default.nix
index 12cd6c935c0..a09024608bb 100644
--- a/pkgs/shells/jush/default.nix
+++ b/pkgs/shells/jush/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1azvghrh31gawd798a254ml4id642qvbva64zzg30pjszh1087n8";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ editline ];
diff --git a/pkgs/shells/liquidprompt/default.nix b/pkgs/shells/liquidprompt/default.nix
index 8575f6439b9..4f06225e94f 100644
--- a/pkgs/shells/liquidprompt/default.nix
+++ b/pkgs/shells/liquidprompt/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ntCfXJUOQqL63HWoG+WJr9a+qB16AaL5zf58039t7GU=";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -D -m 0444 liquidprompt $out/bin/liquidprompt
     install -D -m 0444 liquidpromptrc-dist $out/share/doc/liquidprompt/liquidpromptrc-dist
diff --git a/pkgs/shells/loksh/default.nix b/pkgs/shells/loksh/default.nix
index b9f7d5ef7e7..5b304e45c5b 100644
--- a/pkgs/shells/loksh/default.nix
+++ b/pkgs/shells/loksh/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-q5RiY9/xEFCk+oHlxgNwDOB+TNjRWHKzU2kQH2LjCWY=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
@@ -47,4 +48,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/shells/mksh/default.nix b/pkgs/shells/mksh/default.nix
index 360380e19b3..25aec71900b 100644
--- a/pkgs/shells/mksh/default.nix
+++ b/pkgs/shells/mksh/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-d64WZaM38cSMYda5Yds+UhGbOOWIhNHIloSvMfh7xQY=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     installShellFiles
   ];
diff --git a/pkgs/shells/mrsh/default.nix b/pkgs/shells/mrsh/default.nix
index be87b97ebd7..2b9bc4e3e22 100644
--- a/pkgs/shells/mrsh/default.nix
+++ b/pkgs/shells/mrsh/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vvdwzw3fq74lwgmy6xxkk01sd68fzhsw84c750lm1dma22xhjci";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ readline ];
 
diff --git a/pkgs/shells/oil/default.nix b/pkgs/shells/oil/default.nix
index 2b82d488278..f99c285a4f0 100644
--- a/pkgs/shells/oil/default.nix
+++ b/pkgs/shells/oil/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
   '';
 
+  strictDeps = true;
   buildInputs = lib.optional withReadline readline;
   configureFlags = lib.optional withReadline "--with-readline";
 
diff --git a/pkgs/shells/oksh/default.nix b/pkgs/shells/oksh/default.nix
index 418a453d9e9..c56bd179c74 100644
--- a/pkgs/shells/oksh/default.nix
+++ b/pkgs/shells/oksh/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-076nD0aPps6n5qkR3LQJ6Kn2g3mkov+/M0qSvxNLZ6o=";
   };
 
+  strictDeps = true;
+
   postPatch = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     substituteInPlace configure --replace "./conftest" "echo"
   '';
diff --git a/pkgs/shells/pash/default.nix b/pkgs/shells/pash/default.nix
index 431091bf8d1..c9150fda18a 100644
--- a/pkgs/shells/pash/default.nix
+++ b/pkgs/shells/pash/default.nix
@@ -11,6 +11,7 @@ buildDotnetPackage {
     sha256 = "0c4wa8qi1zs01p9ck171jkw0n1rsymsrhpsb42gl7warwhpmv59f";
   };
 
+  strictDeps = true;
   preConfigure = "rm -rvf $src/Source/PashConsole/bin/*";
 
   outputFiles = [ "Source/PashConsole/bin/Release/*" ];
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 19ca69ecb94..1bd19817268 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
+  strictDeps = true;
   buildInputs = [ less ] ++ libraries;
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optional stdenv.isLinux autoPatchelfHook;
diff --git a/pkgs/shells/rc/default.nix b/pkgs/shells/rc/default.nix
index af43c42dd4b..7b4d58b0cbd 100644
--- a/pkgs/shells/rc/default.nix
+++ b/pkgs/shells/rc/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n5zz6d6z4z6s3fwa0pscqqawy561k4xfnmi91i626hcvls67ljy";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ncurses ]
     ++ lib.optionals (readline != null) [ readline ];
diff --git a/pkgs/shells/rush/default.nix b/pkgs/shells/rush/default.nix
index d840c3b77a5..c9560c86f24 100644
--- a/pkgs/shells/rush/default.nix
+++ b/pkgs/shells/rush/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv }:
+{ fetchurl, lib, stdenv, bash, perl }:
 
 stdenv.mkDerivation rec {
   pname = "rush";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ld5TdpF7siprQCbhE4oxYhH40x3QZ5NCQlD3zRaNmM0=";
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
+
+  postInstall = ''
+    substituteInPlace $out/bin/rush-po \
+      --replace "exec perl" "exec ${lib.getExe perl}"
+  '';
+
   doCheck = true;
 
   meta = {
diff --git a/pkgs/shells/scponly/default.nix b/pkgs/shells/scponly/default.nix
index c0c39d8e316..f15f04cfe22 100644
--- a/pkgs/shells/scponly/default.nix
+++ b/pkgs/shells/scponly/default.nix
@@ -13,14 +13,15 @@ stdenv.mkDerivation {
 
   patches = [ ./scponly-fix-make.patch ];
 
-  buildInputs = [ openssh ];
-
-  # Add path to sftp-server so configure finds it
-  preConfigure = "export PATH=$PATH:${openssh}/libexec";
+  strictDeps = true;
 
   # chroot doesn't seem to work, so not enabling
   # rsync could also be optionally enabled
-  configureFlags = [ "--enable-winscp-compat" ];
+  configureFlags = [
+    "--enable-winscp-compat"
+    "scponly_PROG_SFTP_SERVER=${lib.getBin openssh}/libexec/sftp-server"
+    "scponly_PROG_SCP=${lib.getBin openssh}/bin/scp"
+  ];
 
   postInstall = lib.optionalString (debugLevel > 0) ''
     mkdir -p $out/etc/scponly && echo ${
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index 4357ca605b1..4fac6eb13d6 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-YL4sUEvY8fpuQksZVkldfnztUqKslNtf0n9La/yPdPA=";
   };
 
+  strictDeps = true;
   buildInputs = [
     ncurses
   ];
diff --git a/pkgs/shells/yash/default.nix b/pkgs/shells/yash/default.nix
index 44faf5c4e02..01340df5e9a 100644
--- a/pkgs/shells/yash/default.nix
+++ b/pkgs/shells/yash/default.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256:1jdmj4cyzwxxyyqf20y1zi578h7md860ryffp02qi143zpppn4sm";
   };
 
+  strictDeps = true;
   buildInputs = [ gettext ncurses ];
 
   meta = with lib; {
diff --git a/pkgs/shells/zsh/agkozak-zsh-prompt/default.nix b/pkgs/shells/zsh/agkozak-zsh-prompt/default.nix
index 91d1bd3022b..5f9573b71aa 100644
--- a/pkgs/shells/zsh/agkozak-zsh-prompt/default.nix
+++ b/pkgs/shells/zsh/agkozak-zsh-prompt/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-TOfAWxw1uIV0hKV9o4EJjOlp+jmGWCONDex86ipegOY=";
   };
 
+  strictDeps = true;
   dontConfigure = true;
   dontBuild = true;
 
diff --git a/pkgs/shells/zsh/antigen/default.nix b/pkgs/shells/zsh/antigen/default.nix
index 9a69f90dca3..ca5fbee6e36 100644
--- a/pkgs/shells/zsh/antigen/default.nix
+++ b/pkgs/shells/zsh/antigen/default.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1bmp3qf14509swpxin4j9f98n05pdilzapjm0jdzbv0dy3hn20ix";
   };
 
+  strictDeps = true;
   dontUnpack = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 5a2c0d050ce..f09a0672f19 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -30,7 +30,8 @@ stdenv.mkDerivation {
     ./tz_completion.patch
   ];
 
-  nativeBuildInputs = [ autoreconfHook perl groff texinfo ]
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook perl groff texinfo pcre]
                       ++ lib.optionals stdenv.isLinux [ util-linux yodl ];
 
   buildInputs = [ ncurses pcre ];
diff --git a/pkgs/shells/zsh/fzf-zsh/default.nix b/pkgs/shells/zsh/fzf-zsh/default.nix
index ac5cab94d4c..aa5af013e43 100644
--- a/pkgs/shells/zsh/fzf-zsh/default.nix
+++ b/pkgs/shells/zsh/fzf-zsh/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1irjmxhcg1fm4g8p3psjqk7sz5qhj5kw73pyhv91njvpdhn9l26z";
   };
 
+  strictDeps = true;
   postPatch = ''
     substituteInPlace fzf-zsh.plugin.zsh \
       --replace \
diff --git a/pkgs/shells/zsh/gradle-completion/default.nix b/pkgs/shells/zsh/gradle-completion/default.nix
index bf5969d1300..fa40db3603b 100644
--- a/pkgs/shells/zsh/gradle-completion/default.nix
+++ b/pkgs/shells/zsh/gradle-completion/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "15b0692i3h8h7b95465b2aw9qf5qjmjag5n62347l8yl7zbhv3l2";
   };
 
+  strictDeps = true;
+
   # we just move two files into $out,
   # this shouldn't bother Hydra.
   preferLocalBuild = true;
diff --git a/pkgs/shells/zsh/grml-zsh-config/default.nix b/pkgs/shells/zsh/grml-zsh-config/default.nix
index 538fbc0a522..feb55d9ccde 100644
--- a/pkgs/shells/zsh/grml-zsh-config/default.nix
+++ b/pkgs/shells/zsh/grml-zsh-config/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-GEuBYN6HVAjiAbusVuEA7zBG9fIVZHLV628Jt6Cv5cM=";
   };
 
-  buildInputs = [ zsh coreutils txt2tags procps ]
+  strictDeps = true;
+  nativeBuildInputs = [ txt2tags ];
+  buildInputs = [ zsh coreutils procps ]
     ++ optional stdenv.isLinux inetutils;
 
   buildPhase = ''
diff --git a/pkgs/shells/zsh/lambda-mod-zsh-theme/default.nix b/pkgs/shells/zsh/lambda-mod-zsh-theme/default.nix
index e8d00d73d1a..eae5f77904b 100644
--- a/pkgs/shells/zsh/lambda-mod-zsh-theme/default.nix
+++ b/pkgs/shells/zsh/lambda-mod-zsh-theme/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0fvxnvgbcvwii7ghvpj5l43frllq71wwjvfg7cqfmic727z001dh";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -Dm0644 lambda-mod.zsh-theme $out/share/zsh/themes/lambda-mod.zsh-theme
   '';
diff --git a/pkgs/shells/zsh/nix-zsh-completions/default.nix b/pkgs/shells/zsh/nix-zsh-completions/default.nix
index 472cc47459c..dab73419ab5 100644
--- a/pkgs/shells/zsh/nix-zsh-completions/default.nix
+++ b/pkgs/shells/zsh/nix-zsh-completions/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n9whlys95k4wc57cnz3n07p7zpkv796qkmn68a50ygkx6h3afqf";
   };
 
+  strictDeps = true;
   installPhase = ''
     mkdir -p $out/share/zsh/{site-functions,plugins/nix}
     cp _* $out/share/zsh/site-functions
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 447dc5da78a..84c3a1abf28 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -2,7 +2,7 @@
 #
 #   https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=oh-my-zsh-git
 { lib, stdenv, fetchFromGitHub, nixosTests, writeScript, common-updater-scripts
-, git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
+, git, nix, nixfmt, jq, coreutils, gnused, curl, cacert, bash }:
 
 stdenv.mkDerivation rec {
   version = "2022-04-24";
@@ -16,6 +16,9 @@ stdenv.mkDerivation rec {
     sha256 = "yxuvVDjNCH7r/g6ZoF8kEzwirBB0s+CRQizBwRR4Sp4=";
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/shells/zsh/pure-prompt/default.nix b/pkgs/shells/zsh/pure-prompt/default.nix
index 09be79d6fbc..994f223b58d 100644
--- a/pkgs/shells/zsh/pure-prompt/default.nix
+++ b/pkgs/shells/zsh/pure-prompt/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-iuLi0o++e0PqK81AKWfIbCV0CTIxq2Oki6U2oEYsr68=";
   };
 
+  strictDeps = true;
   installPhase = ''
     OUTDIR="$out/share/zsh/site-functions"
     mkdir -p "$OUTDIR"
diff --git a/pkgs/shells/zsh/spaceship-prompt/default.nix b/pkgs/shells/zsh/spaceship-prompt/default.nix
index 5bdcb21f8dd..7dfbb14eec6 100644
--- a/pkgs/shells/zsh/spaceship-prompt/default.nix
+++ b/pkgs/shells/zsh/spaceship-prompt/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-4G1+K6ENLwChtivR7Ura0vl6Ph9Wae3SOXCW1pNbgHI=";
   };
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zinit/default.nix b/pkgs/shells/zsh/zinit/default.nix
index 9946d7d0c3a..ca8b7ea2e46 100644
--- a/pkgs/shells/zsh/zinit/default.nix
+++ b/pkgs/shells/zsh/zinit/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
   };
   # adapted from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=zsh-zplugin-git
   dontBuild = true;
+  strictDeps = true;
   nativeBuildInputs = [ installShellFiles ];
   installPhase = ''
     outdir="$out/share/$pname"
diff --git a/pkgs/shells/zsh/zplug/default.nix b/pkgs/shells/zsh/zplug/default.nix
index d35eb345dda..b31b14ec77a 100644
--- a/pkgs/shells/zsh/zplug/default.nix
+++ b/pkgs/shells/zsh/zplug/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0hci1pbs3k5icwfyfw5pzcgigbh9vavprxxvakg1xm19n8zb61b3";
   };
 
+  strictDeps = true;
   dontConfigure = true;
   dontBuild = true;
   dontPatch = true;
diff --git a/pkgs/shells/zsh/zsh-autocomplete/default.nix b/pkgs/shells/zsh/zsh-autocomplete/default.nix
index 14ea0ec8f63..a5683c43227 100644
--- a/pkgs/shells/zsh/zsh-autocomplete/default.nix
+++ b/pkgs/shells/zsh/zsh-autocomplete/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-+UziTYsjgpiumSulrLojuqHtDrgvuG91+XNiaMD7wIs=";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -D zsh-autocomplete.plugin.zsh $out/share/zsh-autocomplete/zsh-autocomplete.plugin.zsh
     cp -R scripts $out/share/zsh-autocomplete/scripts
diff --git a/pkgs/shells/zsh/zsh-autopair/default.nix b/pkgs/shells/zsh/zsh-autopair/default.nix
index 0cc1535e53a..73b70c00405 100644
--- a/pkgs/shells/zsh/zsh-autopair/default.nix
+++ b/pkgs/shells/zsh/zsh-autopair/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h0vm2dgrmb8i2pvsgis3lshc5b0ad846836m62y8h3rdb3zmpy1";
   };
 
+  strictDeps = true;
+
   installPhase = ''
     install -D autopair.zsh $out/share/zsh/${pname}/autopair.zsh
   '';
diff --git a/pkgs/shells/zsh/zsh-autosuggestions/default.nix b/pkgs/shells/zsh/zsh-autosuggestions/default.nix
index e261cdedc74..b1df50a9c68 100644
--- a/pkgs/shells/zsh/zsh-autosuggestions/default.nix
+++ b/pkgs/shells/zsh/zsh-autosuggestions/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g3pij5qn2j7v7jjac2a63lxd97mcsgw6xq6k5p7835q9fjiid98";
   };
 
+  strictDeps = true;
   buildInputs = [ zsh ];
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-bd/default.nix b/pkgs/shells/zsh/zsh-bd/default.nix
index f2c2dc90fb4..ebfa55ecd22 100644
--- a/pkgs/shells/zsh/zsh-bd/default.nix
+++ b/pkgs/shells/zsh/zsh-bd/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "020f8nq86g96cps64hwrskppbh2dapfw2m9np1qbs5pgh16z4fcb";
   };
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-better-npm-completion/default.nix b/pkgs/shells/zsh/zsh-better-npm-completion/default.nix
index 372d49eaeb7..d9a813bbbfd 100644
--- a/pkgs/shells/zsh/zsh-better-npm-completion/default.nix
+++ b/pkgs/shells/zsh/zsh-better-npm-completion/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "16z7k5n1rcl9i61lrm7i5dsqsmhvdp1y4y5ii6hv2xpp470addgy";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -Dm 0644 zsh-better-npm-completion.plugin.zsh $out/share/zsh-better-npm-completion
   '';
diff --git a/pkgs/shells/zsh/zsh-clipboard/default.nix b/pkgs/shells/zsh/zsh-clipboard/default.nix
index 114e0bfd7dc..eb395d74472 100644
--- a/pkgs/shells/zsh/zsh-clipboard/default.nix
+++ b/pkgs/shells/zsh/zsh-clipboard/default.nix
@@ -6,6 +6,7 @@ stdenv.mkDerivation rec {
 
   src = ./.;
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-command-time/default.nix b/pkgs/shells/zsh/zsh-command-time/default.nix
index b92ced6be71..c10b67c2b3d 100644
--- a/pkgs/shells/zsh/zsh-command-time/default.nix
+++ b/pkgs/shells/zsh/zsh-command-time/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
     sha256 = "1bvyjgz6bhgg1nwr56r50p6fblgah6yiql55pgm5abnn2h876fjq";
   };
 
+  strictDeps = true;
   dontUnpack = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-completions/default.nix b/pkgs/shells/zsh/zsh-completions/default.nix
index 249826a2a25..937114e982e 100644
--- a/pkgs/shells/zsh/zsh-completions/default.nix
+++ b/pkgs/shells/zsh/zsh-completions/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vs14n29wvkai84fvz3dz2kqznwsq2i5fzbwpv8nsfk1126ql13i";
   };
 
+  strictDeps = true;
   installPhase= ''
     install -D --target-directory=$out/share/zsh/site-functions src/*
   '';
diff --git a/pkgs/shells/zsh/zsh-deer/default.nix b/pkgs/shells/zsh/zsh-deer/default.nix
index ab544d7c314..0d3a6bc9ee6 100644
--- a/pkgs/shells/zsh/zsh-deer/default.nix
+++ b/pkgs/shells/zsh/zsh-deer/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xnbnbi0zk2xsyn8dqsmyxqlfnl36pb1wwibnlp0dxixw6sfymyl";
   };
 
+  strictDeps = true;
+
   prePatch = ''
     substituteInPlace deer \
       --replace " perl " " ${perl}/bin/perl "
diff --git a/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix b/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
index 5b77978c022..68f09828b45 100644
--- a/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
+++ b/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "0h7f27gz586xxw7cc0wyiv3bx0x3qih2wwh05ad85bh2h834ar8d";
   };
 
+  strictDeps = true;
   dontConfigure = true;
   dontBuild = true;
 
diff --git a/pkgs/shells/zsh/zsh-fzf-tab/default.nix b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
index 6d8ea1a9de9..2915682ec96 100644
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@@ -13,6 +13,7 @@ in stdenv.mkDerivation rec {
     sha256 = "h/3XP/BiNnUgQI29gEBl6RFee77WDhFyvsnTi1eRbKg=";
   };
 
+  strictDeps = true;
   buildInputs = [ ncurses ];
 
   patches = lib.optionals stdenv.isDarwin [ ./darwin.patch ];
diff --git a/pkgs/shells/zsh/zsh-history-search-multi-word/default.nix b/pkgs/shells/zsh/zsh-history-search-multi-word/default.nix
index 09d2136ea26..30d26c96766 100644
--- a/pkgs/shells/zsh/zsh-history-search-multi-word/default.nix
+++ b/pkgs/shells/zsh/zsh-history-search-multi-word/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "11r2mmy6bg3b6pf6qc0ml3idh333cj8yz754hrvd1sc4ipfkkqh7";
   };
 
+  strictDeps = true;
   dontConfigure = true;
   dontBuild = true;
 
diff --git a/pkgs/shells/zsh/zsh-history-substring-search/default.nix b/pkgs/shells/zsh/zsh-history-substring-search/default.nix
index 9890993eed6..63e5fe8281e 100644
--- a/pkgs/shells/zsh/zsh-history-substring-search/default.nix
+++ b/pkgs/shells/zsh/zsh-history-substring-search/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0y8va5kc2ram38hbk2cibkk64ffrabfv1sh4xm7pjspsba9n5p1y";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -D zsh-history-substring-search.zsh \
       "$out/share/zsh-history-substring-search/zsh-history-substring-search.zsh"
diff --git a/pkgs/shells/zsh/zsh-nix-shell/default.nix b/pkgs/shells/zsh/zsh-nix-shell/default.nix
index 8b463eda573..e46a5cf727c 100644
--- a/pkgs/shells/zsh/zsh-nix-shell/default.nix
+++ b/pkgs/shells/zsh/zsh-nix-shell/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkgs }:
+{ lib, stdenv, fetchFromGitHub, bash }:
 
 # To make use of this derivation, use
 # `programs.zsh.interactiveShellInit = "source ${pkgs.zsh-nix-shell}/share/zsh-nix-shell/nix-shell.plugin.zsh";`
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-719lVo6p55G1tt3+6nMhZ904nyvlq0Q5exb0il36/Aw=";
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
   installPhase = ''
     install -D nix-shell.plugin.zsh --target-directory=$out/share/zsh-nix-shell
     install -D scripts/* --target-directory=$out/share/zsh-nix-shell/scripts
diff --git a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
index 19d3e70c0a3..cdda7d81f41 100644
--- a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
+++ b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, pkgs }:
+{ lib, stdenv, fetchFromGitHub, substituteAll, pkgs, bash }:
 
 # To make use of this derivation, use
 # `programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme";`
@@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
     sha256 = "0fkfh8j7rd8mkpgz6nsx4v7665d375266shl1aasdad8blgqmf0c";
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
+
   patches = [
     (substituteAll {
       src = ./gitstatusd.patch;
diff --git a/pkgs/shells/zsh/zsh-powerlevel9k/default.nix b/pkgs/shells/zsh/zsh-powerlevel9k/default.nix
index b681dc2d3a3..27e3a648e2b 100644
--- a/pkgs/shells/zsh/zsh-powerlevel9k/default.nix
+++ b/pkgs/shells/zsh/zsh-powerlevel9k/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation {
     sha256 = "0v1dqg9hvycdkcvklg2njff97xwr8rah0nyldv4xm39r77f4yfvq";
   };
 
+  strictDeps = true;
   installPhase= ''
     install -D powerlevel9k.zsh-theme --target-directory=$out/share/zsh-powerlevel9k
     install -D functions/* --target-directory=$out/share/zsh-powerlevel9k/functions
diff --git a/pkgs/shells/zsh/zsh-prezto/default.nix b/pkgs/shells/zsh/zsh-prezto/default.nix
index e4bbd7a8b64..6201e42c0c0 100644
--- a/pkgs/shells/zsh/zsh-prezto/default.nix
+++ b/pkgs/shells/zsh/zsh-prezto/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, unstableGitUpdater }:
+{ lib, stdenv, fetchFromGitHub, unstableGitUpdater, bash }:
 
 stdenv.mkDerivation rec {
   pname = "zsh-prezto";
@@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
+
   postPatch = ''
     # make zshrc aware of where zsh-prezto is installed
     sed -i -e "s|\''${ZDOTDIR:\-\$HOME}/.zprezto/|$out/share/zsh-prezto/|g" runcoms/zshrc
diff --git a/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix b/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
index 09d6eb3cf96..ef76798ccf4 100644
--- a/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
+++ b/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "03r6hpb5fy4yaakqm3lbf4xcvd408r44jgpv4lnzl9asp4sb9qc0";
   };
 
+  strictDeps = true;
   buildInputs = [ zsh ];
 
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/shells/zsh/zsh-system-clipboard/default.nix b/pkgs/shells/zsh/zsh-system-clipboard/default.nix
index b4d407a70bc..6e875b6ee08 100644
--- a/pkgs/shells/zsh/zsh-system-clipboard/default.nix
+++ b/pkgs/shells/zsh/zsh-system-clipboard/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "09lqav1mz5zajklr3xa0iaivhpykv3azkjb7yj9wyp0hq3vymp8i";
   };
 
+  strictDeps = true;
   installPhase = ''
     install -D zsh-system-clipboard.zsh $out/share/zsh/${pname}/zsh-system-clipboard.zsh
   '';
diff --git a/pkgs/shells/zsh/zsh-vi-mode/default.nix b/pkgs/shells/zsh/zsh-vi-mode/default.nix
index 32f1e9c024a..73eae88b71d 100644
--- a/pkgs/shells/zsh/zsh-vi-mode/default.nix
+++ b/pkgs/shells/zsh/zsh-vi-mode/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "EOYqHh0rcgoi26eopm6FTl81ehak5kXMmzNcnJDH8/E=";
   };
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-you-should-use/default.nix b/pkgs/shells/zsh/zsh-you-should-use/default.nix
index 8019e75a859..95cdb3273c5 100644
--- a/pkgs/shells/zsh/zsh-you-should-use/default.nix
+++ b/pkgs/shells/zsh/zsh-you-should-use/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1dz48rd66priqhxx7byndqhbmlwxi1nfw8ik25k0z5k7k754brgy";
   };
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/shells/zsh/zsh-z/default.nix b/pkgs/shells/zsh/zsh-z/default.nix
index 9623ff6648c..a03b81cb6bf 100644
--- a/pkgs/shells/zsh/zsh-z/default.nix
+++ b/pkgs/shells/zsh/zsh-z/default.nix
@@ -11,6 +11,7 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-HnwUWqzwavh/Qox+siOe5lwTp7PBdiYx+9M0NMNFx00=";
   };
 
+  strictDeps = true;
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/tools/misc/shellspec/default.nix b/pkgs/tools/misc/shellspec/default.nix
index 27eead6e1c3..480ada8d571 100644
--- a/pkgs/tools/misc/shellspec/default.nix
+++ b/pkgs/tools/misc/shellspec/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, bash }:
 
 stdenv.mkDerivation rec {
   pname = "shellspec";
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ib5qp29f2fmivwnv6hq35qhvdxz42xgjlkvy0i3qn758riyqf46";
   };
 
+  strictDeps = true;
+  buildInputs = [ bash ];
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   checkPhase = ''