diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index 4529639f3d4a..cff3c06b4e2e 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -182,7 +182,7 @@ When set to `0`, the [cgo](https://pkg.go.dev/cmd/cgo) command is disabled. As c
 program can't link against C libraries anymore, and the resulting binary is statically linked.
 
 When building with CGO enabled, Go will likely link some packages from the Go standard library against C libraries,
-even when the target code does not explicitly call into C dependencies. With `CGO_ENABLED = 0;`, Go
+even when the target code does not explicitly call into C dependencies. With `env.CGO_ENABLED = 0;`, Go
 will always use the Go native implementation of these internal packages. For reference see
 [net](https://pkg.go.dev/net#hdr-Name_Resolution) and [os/user](https://pkg.go.dev/os/user#pkg-overview) packages.
 Notice that the decision whether these packages should use native Go implementation or not can also be controlled
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
index a5a2f7566b46..50304cb913eb 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
     sed -e '/^hooks:/,+2 d' -i plugin.yaml
   '';
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
index 024e3b067a85..3b6fdfe3553c 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   # require network/login
   doCheck = false;
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   postInstall = ''
     install -dm755 $out/helm-dt/bin
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index a770622cc76b..958fa8446f36 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -39,7 +39,7 @@ let
         doCheck = false;
         # https://github.com/hashicorp/terraform-provider-scaffolding/blob/a8ac8375a7082befe55b71c8cbb048493dd220c2/.goreleaser.yml
         # goreleaser (used for builds distributed via terraform registry) requires that CGO is disabled
-        CGO_ENABLED = 0;
+        env.CGO_ENABLED = 0;
         ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${rev}" ];
         src = mkProviderFetcher {
           name = "source-${rev}";
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index 4871fb657bc4..8162ba9e60f1 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-UTZIx4zXIMdQBQXfzk3+j43yx7vlitw4Mwmon8oYjd8=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index 1d7bb4d71dd4..3bc1d4f8d4d3 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -120,7 +120,7 @@ buildPythonApplication rec {
     "fortify3"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   GOFLAGS = "-trimpath";
 
   configurePhase = ''
diff --git a/pkgs/by-name/ar/arkade/package.nix b/pkgs/by-name/ar/arkade/package.nix
index 95a1a5d5387d..effc035c770c 100644
--- a/pkgs/by-name/ar/arkade/package.nix
+++ b/pkgs/by-name/ar/arkade/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
     hash = "sha256-MFce+stC+OzUL0H0ahZZAfMwr9Y+EVJIMmhhRl4JYaU=";
   };
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index 21acfc9f37d6..f4aa1ef22121 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-W65lQYGrRg8LwFERj5MBOPFAn2j+FE7ep4ANuAGmfgM=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
   ldflags = [
     "-s"
     "-X github.com/gomods/athens/pkg/build.version=${version}"
diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
index 278ea195e04c..3d65ccdd8413 100644
--- a/pkgs/by-name/au/authentik/ldap.nix
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -6,7 +6,7 @@ buildGoModule {
 
   vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/ldap" ];
 
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index 4915cc4a1fbc..9dc47773f341 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -285,7 +285,7 @@ let
         --replace-fail './web' "${authentik-django}/web"
     '';
 
-    CGO_ENABLED = 0;
+    env.CGO_ENABLED = 0;
 
     vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI=";
 
diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix
index 1a26c661ef07..fa2c40eba997 100644
--- a/pkgs/by-name/au/authentik/radius.nix
+++ b/pkgs/by-name/au/authentik/radius.nix
@@ -6,7 +6,7 @@ buildGoModule {
 
   vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/radius" ];
 
diff --git a/pkgs/by-name/ba/bazel-watcher/package.nix b/pkgs/by-name/ba/bazel-watcher/package.nix
index eb875a4bb220..a53c794767a0 100644
--- a/pkgs/by-name/ba/bazel-watcher/package.nix
+++ b/pkgs/by-name/ba/bazel-watcher/package.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
   vendorHash = "sha256-0I/bvuyosN55oNSMuom4C8rVjxneUaqV19l9OMiwWhU=";
 
   # The dependency github.com/fsnotify/fsevents requires CGO
-  CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
+  env.CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
   ldflags = [
     "-s"
     "-X main.Version=${version}"
diff --git a/pkgs/by-name/be/bee/package.nix b/pkgs/by-name/be/bee/package.nix
index 5828a47f5c80..0aa08b2b6730 100644
--- a/pkgs/by-name/be/bee/package.nix
+++ b/pkgs/by-name/be/bee/package.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
     "-X github.com/ethersphere/bee/v2/pkg/postage/listener.batchFactorOverridePublic=5"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   postInstall = ''
     mkdir -p $out/lib/systemd/system
diff --git a/pkgs/by-name/be/betula/package.nix b/pkgs/by-name/be/betula/package.nix
index 7afa85661a1c..efcfff91b889 100644
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -13,7 +13,7 @@
   };
   vendorHash = "sha256-SWcQYF8LP6lw5kWlAVFt3qiwDnvpSOXenmdm6TSfJSc=";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
   # These tests use internet, so are failing in Nix build.
   # See also: https://todo.sr.ht/~bouncepaw/betula/91
   checkFlags = "-skip=TestTitles|TestHEntries";
diff --git a/pkgs/by-name/bi/bingo/package.nix b/pkgs/by-name/bi/bingo/package.nix
index 9af3b77dfbff..1a66f3d12f0b 100644
--- a/pkgs/by-name/bi/bingo/package.nix
+++ b/pkgs/by-name/bi/bingo/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
     rm get_e2e_test.go get_e2e_utils_test.go
   '';
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 4b81141e94d7..910894bdae76 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X github.com/bitrise-io/bitrise/version.Commit=${src.rev}"
     "-X github.com/bitrise-io/bitrise/version.BuildNumber=0"
   ];
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/bl/bluetuith/package.nix b/pkgs/by-name/bl/bluetuith/package.nix
index ae8106160d64..8326e7330c66 100644
--- a/pkgs/by-name/bl/bluetuith/package.nix
+++ b/pkgs/by-name/bl/bluetuith/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-tEVzuhE0Di7edGa5eJHLLqOecCuoj02h91TsZiZU1PM=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/br/brev-cli/package.nix b/pkgs/by-name/br/brev-cli/package.nix
index 4a6e1c3162b0..3f95bc2dd182 100644
--- a/pkgs/by-name/br/brev-cli/package.nix
+++ b/pkgs/by-name/br/brev-cli/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-g+LjubG1s3z47I69mEfkSaAmi1+eNSp4M5Wic6h0+Xc=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   subPackages = [ "." ];
 
   ldflags = [
diff --git a/pkgs/by-name/bu/buildkit-nix/package.nix b/pkgs/by-name/bu/buildkit-nix/package.nix
index df354c08f414..e6bc6e0ad14e 100644
--- a/pkgs/by-name/bu/buildkit-nix/package.nix
+++ b/pkgs/by-name/bu/buildkit-nix/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-SFsf2QOIuUQY5Zzshb2190pQtOBGEsELBRihOvHYVGA=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/ca/capslock/package.nix b/pkgs/by-name/ca/capslock/package.nix
index 83e599e7fe00..4460368a1123 100644
--- a/pkgs/by-name/ca/capslock/package.nix
+++ b/pkgs/by-name/ca/capslock/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/capslock" ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/ch/chamber/package.nix b/pkgs/by-name/ch/chamber/package.nix
index b44e62fa674a..3c70db5a81de 100644
--- a/pkgs/by-name/ch/chamber/package.nix
+++ b/pkgs/by-name/ch/chamber/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "sha256-1ySOlP0sFk3+IRt/zstZK6lEE2pzoVSiZz3wFxdesgc=";
   };
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   vendorHash = "sha256-KlouLjW9hVKFi9uz34XHd4CzNOiyO245QNygkB338YQ=";
 
diff --git a/pkgs/by-name/ci/civo/package.nix b/pkgs/by-name/ci/civo/package.nix
index e7b176e71db7..f26722131bcd 100644
--- a/pkgs/by-name/ci/civo/package.nix
+++ b/pkgs/by-name/ci/civo/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # Some lint checks fail
   doCheck = false;
diff --git a/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix b/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
index 85e4a0537349..2f4bd805ce6a 100644
--- a/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
+++ b/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
     "-X=main.date=1970-01-01"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   passthru.tests.version = testers.testVersion { package = cloudflare-dynamic-dns; };
 
diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index 06fedb9909da..d9b3c5681dfb 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -41,7 +41,7 @@ buildGoModule rec {
   # https://hydra.nixos.org/build/212378003/log
   excludedPackages = "gvproxy";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   preConfigure = ''
     ldflags="-s -w -X github.com/abiosoft/colima/config.appVersion=${version} \
diff --git a/pkgs/by-name/co/commitizen-go/package.nix b/pkgs/by-name/co/commitizen-go/package.nix
index e6936ed3f04a..103249165d5b 100644
--- a/pkgs/by-name/co/commitizen-go/package.nix
+++ b/pkgs/by-name/co/commitizen-go/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-X 'github.com/lintingzhen/commitizen-go/cmd.revision=${commit_revision}'"
diff --git a/pkgs/by-name/co/copacetic/package.nix b/pkgs/by-name/co/copacetic/package.nix
index 188f3341b9b3..c2820c37c532 100644
--- a/pkgs/by-name/co/copacetic/package.nix
+++ b/pkgs/by-name/co/copacetic/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/by-name/cu/cunicu/package.nix b/pkgs/by-name/cu/cunicu/package.nix
index 031a8a8ad095..0c8bdd4c0c8f 100644
--- a/pkgs/by-name/cu/cunicu/package.nix
+++ b/pkgs/by-name/cu/cunicu/package.nix
@@ -34,7 +34,7 @@ buildGoModule rec {
     versionCheckHook
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # These packages contain networking dependent tests which fail in the sandbox
   excludedPackages = [
diff --git a/pkgs/by-name/de/deck/package.nix b/pkgs/by-name/de/deck/package.nix
index 29f6bdaeeaf7..567db1610467 100644
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s -w -X github.com/kong/deck/cmd.VERSION=${version}"
diff --git a/pkgs/by-name/do/docker-credential-gcr/package.nix b/pkgs/by-name/do/docker-credential-gcr/package.nix
index 1005bb4f87f7..e59c92b42294 100644
--- a/pkgs/by-name/do/docker-credential-gcr/package.nix
+++ b/pkgs/by-name/do/docker-credential-gcr/package.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-YcBDurQjGhjds3CB63gTjsPbsvlHJnGxWbsFrx3vCy4=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ea/earthly/package.nix b/pkgs/by-name/ea/earthly/package.nix
index e36971390d4f..8630f0aee487 100644
--- a/pkgs/by-name/ea/earthly/package.nix
+++ b/pkgs/by-name/ea/earthly/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   vendorHash = "sha256-bwNuQPGjAQ9Afa2GuPWrW8ytfIvhsOYFKPt0zyfdZhU=";
   subPackages = [ "cmd/earthly" "cmd/debugger" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ea/easeprobe/package.nix b/pkgs/by-name/ea/easeprobe/package.nix
index 3691d73b0b34..502a2ff9d09c 100644
--- a/pkgs/by-name/ea/easeprobe/package.nix
+++ b/pkgs/by-name/ea/easeprobe/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/easeprobe" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/en/endlessh-go/package.nix b/pkgs/by-name/en/endlessh-go/package.nix
index caf44a0c9f9a..700a55a0517f 100644
--- a/pkgs/by-name/en/endlessh-go/package.nix
+++ b/pkgs/by-name/en/endlessh-go/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-unIyU60IrbiKDIjUf9F2pqqGNIA4gFp5XyQlvx6+xxQ=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/en/ente-cli/package.nix b/pkgs/by-name/en/ente-cli/package.nix
index 1ee112580fea..49c0eb21adaa 100644
--- a/pkgs/by-name/en/ente-cli/package.nix
+++ b/pkgs/by-name/en/ente-cli/package.nix
@@ -29,7 +29,7 @@ buildGoModule {
 
   vendorHash = "sha256-Gg1mifMVt6Ma8yQ/t0R5nf6NXbzLZBpuZrYsW48p0mw=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fa/faas-cli/package.nix b/pkgs/by-name/fa/faas-cli/package.nix
index f730b150e59f..1341e7011c26 100644
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -29,7 +29,7 @@ buildGoModule rec {
 
   vendorHash = null;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fe/ferretdb/package.nix b/pkgs/by-name/fe/ferretdb/package.nix
index 318c86db7c55..16b5646994ab 100644
--- a/pkgs/by-name/fe/ferretdb/package.nix
+++ b/pkgs/by-name/fe/ferretdb/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-GT6e9yd6LF6GFlGBWVAmcM6ysB/6cIGLbnM0hxfX5TE=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/ferretdb" ];
 
diff --git a/pkgs/by-name/fl/flclash/package.nix b/pkgs/by-name/fl/flclash/package.nix
index 6b1bbedcbab5..3a8e6ce27861 100644
--- a/pkgs/by-name/fl/flclash/package.nix
+++ b/pkgs/by-name/fl/flclash/package.nix
@@ -33,7 +33,7 @@ let
 
     vendorHash = "sha256-yam3DgY/dfwIRc7OvFltwX29x6xGlrrsK4Oj6oaGYRw=";
 
-    CGO_ENABLED = 0;
+    env.CGO_ENABLED = 0;
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index a8193d876dc9..a0a218db10bd 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-utHQzXjtdnshUsYDQEQY2qoQGZsnfXXPj3A9VsDj0vQ=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/by-name/ga/gat/package.nix b/pkgs/by-name/ga/gat/package.nix
index 1e3dc792117b..7ae3f45689c7 100644
--- a/pkgs/by-name/ga/gat/package.nix
+++ b/pkgs/by-name/ga/gat/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-ns1jFmBvIfclb3SBtdg05qNBy18p6VjtEKrahtxJUM4=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gl/glasskube/package.nix b/pkgs/by-name/gl/glasskube/package.nix
index a6c5f54f814e..c3ce67cbdf66 100644
--- a/pkgs/by-name/gl/glasskube/package.nix
+++ b/pkgs/by-name/gl/glasskube/package.nix
@@ -43,7 +43,7 @@ in buildGo123Module rec {
 
   vendorHash = "sha256-oly6SLgXVyvKQQuPrb76LYngoDPNLjTAs4gWCT3/kew=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gl/globalping-cli/package.nix b/pkgs/by-name/gl/globalping-cli/package.nix
index 952e4fafada6..7972a6bc96da 100644
--- a/pkgs/by-name/gl/globalping-cli/package.nix
+++ b/pkgs/by-name/gl/globalping-cli/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   preCheck = ''
diff --git a/pkgs/by-name/go/go-chromecast/package.nix b/pkgs/by-name/go/go-chromecast/package.nix
index 8dda0c17d6bb..74d9189fd1ab 100644
--- a/pkgs/by-name/go/go-chromecast/package.nix
+++ b/pkgs/by-name/go/go-chromecast/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-EI37KPdNxPXdgmxvawTiRQ516dLxt5o0iYvGcAHXdUw=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/go-graft/package.nix b/pkgs/by-name/go/go-graft/package.nix
index b2d34d9e90aa..29de38c5a38a 100644
--- a/pkgs/by-name/go/go-graft/package.nix
+++ b/pkgs/by-name/go/go-graft/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
   };
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index db8662a0c4b9..a3a2d42c9458 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
     echo v${version} > ./cmd/go-judge/version/version.txt
   '';
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = with lib; {
     description = "High performance sandbox service based on container technologies";
diff --git a/pkgs/by-name/go/go-mockery/package.nix b/pkgs/by-name/go/go-mockery/package.nix
index 3ed055e911bf..6883f089600b 100644
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
     "-X" "github.com/vektra/mockery/v2/pkg/logging.SemVer=v${version}"
   ];
 
-  CGO_ENABLED = false;
+  env.CGO_ENABLED = false;
 
   proxyVendor = true;
   vendorHash = "sha256-z1ceS+LO6d7T264pw2BLadw804aGRISyrKW/dr4fZHA=";
diff --git a/pkgs/by-name/go/go-task/package.nix b/pkgs/by-name/go/go-task/package.nix
index e4d80380bd61..3f605df660ee 100644
--- a/pkgs/by-name/go/go-task/package.nix
+++ b/pkgs/by-name/go/go-task/package.nix
@@ -32,7 +32,7 @@ buildGoModule rec {
     "-X=github.com/go-task/task/v3/internal/version.version=${version}"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   postInstall = ''
     ln -s $out/bin/task $out/bin/go-task
diff --git a/pkgs/by-name/go/go2rtc/package.nix b/pkgs/by-name/go/go2rtc/package.nix
index 6fbac66e09e1..fd7f5d685a10 100644
--- a/pkgs/by-name/go/go2rtc/package.nix
+++ b/pkgs/by-name/go/go2rtc/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-N8aJmxNQ/p2ddJG9DuIVVjcgzEC6TzD0sz992h3q0RU=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gobusybox/package.nix b/pkgs/by-name/go/gobusybox/package.nix
index 1ac398570b70..8ec543c1f593 100644
--- a/pkgs/by-name/go/gobusybox/package.nix
+++ b/pkgs/by-name/go/gobusybox/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
     "cmd/rewritepkg"
   ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   vendorHash = "sha256-s4bQLXNFhyAk+UNI1xJXQABjBXtPFXiWvmdttV/6Bm8=";
 
diff --git a/pkgs/by-name/go/gofumpt/package.nix b/pkgs/by-name/go/gofumpt/package.nix
index 697ab47010fe..12435ba1918d 100644
--- a/pkgs/by-name/go/gofumpt/package.nix
+++ b/pkgs/by-name/go/gofumpt/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-kJysyxROvB0eMAHbvNF+VXatEicn4ln2Vqkzp7GDWAQ=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/goimports-reviser/package.nix b/pkgs/by-name/go/goimports-reviser/package.nix
index 6ab48eb23fc0..35b8a56be98c 100644
--- a/pkgs/by-name/go/goimports-reviser/package.nix
+++ b/pkgs/by-name/go/goimports-reviser/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
   };
   vendorHash = "sha256-z+FeAXPXKi653im2X2WOP1R9gRl/x7UBnndoEXoxdwA=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gose/package.nix b/pkgs/by-name/go/gose/package.nix
index af03b23802c9..c52c12b0e352 100644
--- a/pkgs/by-name/go/gose/package.nix
+++ b/pkgs/by-name/go/gose/package.nix
@@ -39,7 +39,7 @@ buildGoModule {
 
   vendorHash = "sha256-U/umJ6McCuD0HARVMj1JXHOpVxcph16z7Y7i47Nf3cg=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/gose
diff --git a/pkgs/by-name/go/goss/package.nix b/pkgs/by-name/go/goss/package.nix
index cbe9930a1059..a14fa86e14a9 100644
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-Rf6Xt54y1BN2o90rDW0WvEm4H5pPfsZ786MXFjsAFaM=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gr/grmon/package.nix b/pkgs/by-name/gr/grmon/package.nix
index d6200cc68582..18a9be4db492 100644
--- a/pkgs/by-name/gr/grmon/package.nix
+++ b/pkgs/by-name/gr/grmon/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-ySgWEGHlEJpfB/BZuRs1bELBspEaiaX/UnJai2V/hx0=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/gt/gtrash/package.nix b/pkgs/by-name/gt/gtrash/package.nix
index bb93daaaad58..87e35a8865cc 100644
--- a/pkgs/by-name/gt/gtrash/package.nix
+++ b/pkgs/by-name/gt/gtrash/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
   # disabled because it is required to run on docker.
   doCheck = false;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/by-name/gv/gvisor/package.nix b/pkgs/by-name/gv/gvisor/package.nix
index 4caecce1ea3d..5042ddbd7881 100644
--- a/pkgs/by-name/gv/gvisor/package.nix
+++ b/pkgs/by-name/gv/gvisor/package.nix
@@ -34,7 +34,7 @@ buildGoModule {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/he/hello-go/package.nix b/pkgs/by-name/he/hello-go/package.nix
index e68c0b8c98fe..f2391256e402 100644
--- a/pkgs/by-name/he/hello-go/package.nix
+++ b/pkgs/by-name/he/hello-go/package.nix
@@ -10,7 +10,7 @@ buildGoModule {
 
   vendorHash = null;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # go installs binary into $out/bin/$GOOS_$GOARCH/hello-go in cross compilation
   postInstall = ''
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index 96b96e32298b..48d4b62bf80f 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -61,7 +61,7 @@ buildGo123Module {
     nodejs
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   doCheck = false;
 
   ldflags = [
diff --git a/pkgs/by-name/hy/hyprspace/package.nix b/pkgs/by-name/hy/hyprspace/package.nix
index 0dfc28e9b476..ffb30461fdb0 100644
--- a/pkgs/by-name/hy/hyprspace/package.nix
+++ b/pkgs/by-name/hy/hyprspace/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
     hash = "sha256-zWajCfHFqPa3Z72DHcxBUq4bmcCu1lpEKUbZZewpYOE=";
   };
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   vendorHash = "sha256-LJpgGeD47Bs+Cq9Z7WWFa49F8/n3exOyxRcd6EkkL2g=";
 
diff --git a/pkgs/by-name/im/imgpkg/package.nix b/pkgs/by-name/im/imgpkg/package.nix
index f20a5e211bb8..9fc982f633a9 100644
--- a/pkgs/by-name/im/imgpkg/package.nix
+++ b/pkgs/by-name/im/imgpkg/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/imgpkg" ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
   ldflags = [ "-X=carvel.dev/imgpkg/pkg/imgpkg/cmd.Version=${version}" ];
 
   meta = {
diff --git a/pkgs/by-name/in/incus/client.nix b/pkgs/by-name/in/incus/client.nix
index b3aeff69e97c..3e03ff4025b8 100644
--- a/pkgs/by-name/in/incus/client.nix
+++ b/pkgs/by-name/in/incus/client.nix
@@ -23,7 +23,7 @@ buildGoModule {
     version
     ;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index 9c6100262d2e..923af8e4b9fb 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
     "-X main.gitCommit=${src.rev}"
   ];
 
-  CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
+  env.CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
 
   subPackages = [
     "cmd/newrelic-infra"
diff --git a/pkgs/by-name/jj/jj/package.nix b/pkgs/by-name/jj/jj/package.nix
index c94bb6d2e7e4..aec90d023d18 100644
--- a/pkgs/by-name/jj/jj/package.nix
+++ b/pkgs/by-name/jj/jj/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/jj" ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/jq/jq-lsp/package.nix b/pkgs/by-name/jq/jq-lsp/package.nix
index 43ba9ada6912..fd92650683e0 100644
--- a/pkgs/by-name/jq/jq-lsp/package.nix
+++ b/pkgs/by-name/jq/jq-lsp/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
   vendorHash = "sha256-8sZGnoP7l09ZzLJqq8TUCquTOPF0qiwZcFhojUnnEIY=";
 
   # based on https://github.com/wader/jq-lsp/blob/master/.goreleaser.yml
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/jx/jx/package.nix b/pkgs/by-name/jx/jx/package.nix
index c7dbf0f1bd89..839055db0812 100644
--- a/pkgs/by-name/jx/jx/package.nix
+++ b/pkgs/by-name/jx/jx/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/k3/k3sup/package.nix b/pkgs/by-name/k3/k3sup/package.nix
index 07d05966b28a..a8d309c1316b 100644
--- a/pkgs/by-name/k3/k3sup/package.nix
+++ b/pkgs/by-name/k3/k3sup/package.nix
@@ -27,7 +27,7 @@ buildGoModule rec {
       --replace "/bin/bash" "${bash}/bin/bash"
   '';
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/by-name/k8/k8sgpt/package.nix b/pkgs/by-name/k8/k8sgpt/package.nix
index 98a81f070d96..b2a4cc9510e0 100644
--- a/pkgs/by-name/k8/k8sgpt/package.nix
+++ b/pkgs/by-name/k8/k8sgpt/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
   vendorHash = "sha256-K9do7u13w2a/9jI7LRtbRvjKJcFU9AnDp2u+ZWSVxw0=";
 
   # https://nixos.org/manual/nixpkgs/stable/#var-go-CGO_ENABLED
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # https://nixos.org/manual/nixpkgs/stable/#ssec-skip-go-tests
   checkFlags = [
diff --git a/pkgs/by-name/ka/kapp/package.nix b/pkgs/by-name/ka/kapp/package.nix
index 2803606be6ac..ba2f31d0232c 100644
--- a/pkgs/by-name/ka/kapp/package.nix
+++ b/pkgs/by-name/ka/kapp/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/kapp" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-X carvel.dev/kapp/pkg/kapp/version.Version=${version}"
diff --git a/pkgs/by-name/kb/kbld/package.nix b/pkgs/by-name/kb/kbld/package.nix
index 6b2a7f996989..ac1fac8274d4 100644
--- a/pkgs/by-name/kb/kbld/package.nix
+++ b/pkgs/by-name/kb/kbld/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/kbld" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-X=carvel.dev/kbld/pkg/kbld/version.Version=${version}"
diff --git a/pkgs/by-name/kd/kdigger/package.nix b/pkgs/by-name/kd/kdigger/package.nix
index 8d942943d683..7b78abea4e14 100644
--- a/pkgs/by-name/kd/kdigger/package.nix
+++ b/pkgs/by-name/kd/kdigger/package.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles ];
 
   # static to be easily copied into containers since it's an in-pod pen-testing tool
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ke/keep-sorted/package.nix b/pkgs/by-name/ke/keep-sorted/package.nix
index 610cd3342948..66feb489e9ec 100644
--- a/pkgs/by-name/ke/keep-sorted/package.nix
+++ b/pkgs/by-name/ke/keep-sorted/package.nix
@@ -18,7 +18,7 @@ buildGo123Module rec {
 
   vendorHash = "sha256-HTE9vfjRmi5GpMue7lUfd0jmssPgSOljbfPbya4uGsc=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/ki/kind/package.nix b/pkgs/by-name/ki/kind/package.nix
index 75da1bbed6de..ed76d8d2ebb4 100644
--- a/pkgs/by-name/ki/kind/package.nix
+++ b/pkgs/by-name/ki/kind/package.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ku/kube-router/package.nix b/pkgs/by-name/ku/kube-router/package.nix
index 704931fcbed2..dca45e008087 100644
--- a/pkgs/by-name/ku/kube-router/package.nix
+++ b/pkgs/by-name/ku/kube-router/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-KmAMGKm+cFGRMD1Nyn9/CHv9vUvflAiLJcro08GIGtw=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ku/kubeclarity/package.nix b/pkgs/by-name/ku/kubeclarity/package.nix
index 25a6582695e7..ae27a2bc443d 100644
--- a/pkgs/by-name/ku/kubeclarity/package.nix
+++ b/pkgs/by-name/ku/kubeclarity/package.nix
@@ -33,7 +33,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/cli";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ku/kubectl-gadget/package.nix b/pkgs/by-name/ku/kubectl-gadget/package.nix
index 46def7fa9d72..1251556edeb9 100644
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-V2bgMFJGo1t1MiJyACdB9mjM2xtHwgH6bNEbEeZC2XM=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/by-name/ku/kubedock/package.nix b/pkgs/by-name/ku/kubedock/package.nix
index 286f30a843f5..b1c15a4b1ef9 100644
--- a/pkgs/by-name/ku/kubedock/package.nix
+++ b/pkgs/by-name/ku/kubedock/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/joyrex2001/kubedock/internal/config.Version=${version}"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = with lib; {
     description = "Minimal implementation of the Docker API that will orchestrate containers on a Kubernetes cluster";
diff --git a/pkgs/by-name/ku/kubemq-community/package.nix b/pkgs/by-name/ku/kubemq-community/package.nix
index 0c90536f75c5..1784c6964513 100644
--- a/pkgs/by-name/ku/kubemq-community/package.nix
+++ b/pkgs/by-name/ku/kubemq-community/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
     sha256 = "sha256-oAo/O3T3wtfCumT2kjoyXKfCFHijVzSmxhslaKaeF3Y=";
   };
 
-  CGO_ENABLED=0;
+  env.CGO_ENABLED = 0;
 
   ldflags=[ "-w" "-s" "-X main.version=${version}" ];
 
diff --git a/pkgs/by-name/ku/kubevela/package.nix b/pkgs/by-name/ku/kubevela/package.nix
index b61535492b1e..d8444e2b6676 100644
--- a/pkgs/by-name/ku/kubevela/package.nix
+++ b/pkgs/by-name/ku/kubevela/package.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   subPackages = [ "references/cmd/cli" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # Workaround for permission issue in shell completion
   HOME = "$TMPDIR";
diff --git a/pkgs/by-name/ku/kulala-fmt/package.nix b/pkgs/by-name/ku/kulala-fmt/package.nix
index 204aaa00ad32..1644e7900e98 100644
--- a/pkgs/by-name/ku/kulala-fmt/package.nix
+++ b/pkgs/by-name/ku/kulala-fmt/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-GazDEm/qv0nh8vYT+Tf0n4QDGHlcYtbMIj5rlZBvpKo=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ma/matchbox-server/package.nix b/pkgs/by-name/ma/matchbox-server/package.nix
index 4f7ca8bdc912..599145fd4db8 100644
--- a/pkgs/by-name/ma/matchbox-server/package.nix
+++ b/pkgs/by-name/ma/matchbox-server/package.nix
@@ -27,7 +27,7 @@ buildGoModule rec {
   ];
 
   # Disable cgo to produce a static binary
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # Don't run Go tests
   doCheck = false;
diff --git a/pkgs/by-name/mk/mkuimage/package.nix b/pkgs/by-name/mk/mkuimage/package.nix
index 4a65d56af0b6..30ded02c53d4 100644
--- a/pkgs/by-name/mk/mkuimage/package.nix
+++ b/pkgs/by-name/mk/mkuimage/package.nix
@@ -25,7 +25,7 @@ buildGoModule {
     "cmd/mkuimage"
   ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/mo/mockgen/package.nix b/pkgs/by-name/mo/mockgen/package.nix
index 99c4ef4429f6..3def6eaa77fb 100644
--- a/pkgs/by-name/mo/mockgen/package.nix
+++ b/pkgs/by-name/mo/mockgen/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-0OnK5/e0juEYrNJuVkr+tK66btRW/oaHpJSDakB32Bc=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "mockgen" ];
 
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 6066e4fb48da..e1c7a55bd2ac 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -32,7 +32,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   passthru.tests.version = testers.testVersion { package = myks; };
 
diff --git a/pkgs/by-name/my/mynewt-newt/package.nix b/pkgs/by-name/my/mynewt-newt/package.nix
index 7f5fda624695..524c27ad29e0 100644
--- a/pkgs/by-name/my/mynewt-newt/package.nix
+++ b/pkgs/by-name/my/mynewt-newt/package.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   # CGO_ENABLED=0 required for mac - "error: 'TARGET_OS_MAC' is not defined, evaluates to 0"
   # https://github.com/shirou/gopsutil/issues/976
-  CGO_ENABLED = if stdenv.hostPlatform.isLinux then 1 else 0;
+  env.CGO_ENABLED = if stdenv.hostPlatform.isLinux then 1 else 0;
 
   meta = with lib; {
     homepage = "https://mynewt.apache.org/";
diff --git a/pkgs/by-name/na/nali/package.nix b/pkgs/by-name/na/nali/package.nix
index 55c23d865a45..0defddf12a40 100644
--- a/pkgs/by-name/na/nali/package.nix
+++ b/pkgs/by-name/na/nali/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   ldflags = [ "-s" "-w" "-X github.com/zu1k/nali/internal/constant.Version=${version}" ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index 0fc7167c9b55..2e214e010a80 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -35,7 +35,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-qDzd+aq08PN9kl1YkvNLGvWaFVh7xFXJhGdx/ELwYGY=";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   buildInputs = [
     libusb1
diff --git a/pkgs/by-name/no/nodeinfo/package.nix b/pkgs/by-name/no/nodeinfo/package.nix
index 1d86aaa00226..a21a324d92e8 100644
--- a/pkgs/by-name/no/nodeinfo/package.nix
+++ b/pkgs/by-name/no/nodeinfo/package.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = {
     mainProgram = "nodeinfo";
diff --git a/pkgs/by-name/no/nomad-driver-containerd/package.nix b/pkgs/by-name/no/nomad-driver-containerd/package.nix
index bf50bd1aeb62..e6717bfd1201 100644
--- a/pkgs/by-name/no/nomad-driver-containerd/package.nix
+++ b/pkgs/by-name/no/nomad-driver-containerd/package.nix
@@ -34,7 +34,7 @@ buildGoModule rec {
     substituteInPlace containerd/driver.go --replace-warn 'PluginVersion = "v0.9.3"' 'PluginVersion = "v${version}"'
   '';
 
-  CGO_ENABLED = "1";
+  env.CGO_ENABLED = "1";
 
   vendorHash = "sha256-OO+a5AqhB0tf6lyodhYl9HUSaWvtXWwevRHYy1Q6VoU=";
   subPackages = [ "." ];
diff --git a/pkgs/by-name/nw/nwg-look/package.nix b/pkgs/by-name/nw/nwg-look/package.nix
index b4f272454591..72f038209541 100644
--- a/pkgs/by-name/nw/nwg-look/package.nix
+++ b/pkgs/by-name/nw/nwg-look/package.nix
@@ -40,7 +40,7 @@ buildGoModule rec {
     gtk3
   ];
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   postInstall = ''
     mkdir -p $out/share
diff --git a/pkgs/by-name/op/opengfw/package.nix b/pkgs/by-name/op/opengfw/package.nix
index 0d09f94cc875..a78075f16a39 100644
--- a/pkgs/by-name/op/opengfw/package.nix
+++ b/pkgs/by-name/op/opengfw/package.nix
@@ -9,7 +9,7 @@ let
 in
 buildGoModule {
   inherit pname version;
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   vendorHash = "sha256-F8jTvgxOhOGVtl6B8u0xAIvjNwVjBtvAhApzjIgykpY=";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/or/ory/package.nix b/pkgs/by-name/or/ory/package.nix
index 01c6424513af..96c775deb93f 100644
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   tags = [
     "sqlite"
diff --git a/pkgs/by-name/pa/pathvector/package.nix b/pkgs/by-name/pa/pathvector/package.nix
index e9ca6f90e5a5..ba16adc71ae4 100644
--- a/pkgs/by-name/pa/pathvector/package.nix
+++ b/pkgs/by-name/pa/pathvector/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-hgUuntT6jMWI14qDE3Yjm5W8UqQ6CcvoILmSDaVEZac=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" "-X main.date=unknown" ];
 
diff --git a/pkgs/by-name/pi/picocrypt-cli/package.nix b/pkgs/by-name/pi/picocrypt-cli/package.nix
index 3df9ad465633..8018611f5064 100644
--- a/pkgs/by-name/pi/picocrypt-cli/package.nix
+++ b/pkgs/by-name/pi/picocrypt-cli/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   meta = {
     description = "Command-line interface for Picocrypt";
diff --git a/pkgs/by-name/pi/picocrypt/package.nix b/pkgs/by-name/pi/picocrypt/package.nix
index 543321df0b9c..5033bcaa53d5 100644
--- a/pkgs/by-name/pi/picocrypt/package.nix
+++ b/pkgs/by-name/pi/picocrypt/package.nix
@@ -48,7 +48,7 @@ buildGoModule rec {
     wrapGAppsHook3
   ];
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   postInstall = ''
     mv $out/bin/Picocrypt $out/bin/picocrypt-gui
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 2c9e4a7849b6..1c886fc1113b 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # Upstream build instructions
   ldflags = [
diff --git a/pkgs/by-name/po/podman-tui/package.nix b/pkgs/by-name/po/podman-tui/package.nix
index e903ac37253f..1725bc29dd46 100644
--- a/pkgs/by-name/po/podman-tui/package.nix
+++ b/pkgs/by-name/po/podman-tui/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   vendorHash = null;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   tags = [ "containers_image_openpgp" "remote" ]
     ++ lib.optional stdenv.hostPlatform.isDarwin "darwin";
diff --git a/pkgs/by-name/pu/pushup/package.nix b/pkgs/by-name/pu/pushup/package.nix
index 65fa4f0b27fe..249507e81946 100644
--- a/pkgs/by-name/pu/pushup/package.nix
+++ b/pkgs/by-name/pu/pushup/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   vendorHash = null;
   subPackages = ".";
   # Pushup doesn't need CGO so disable it.
-  CGO_ENABLED=0;
+  env.CGO_ENABLED = 0;
   ldflags = [ "-s" "-w" ];
   nativeBuildInputs = [ makeWrapper ];
   # The Go compiler is a runtime dependency of Pushup.
diff --git a/pkgs/by-name/ra/ran/package.nix b/pkgs/by-name/ra/ran/package.nix
index d22750fce3a0..570d980c18c0 100644
--- a/pkgs/by-name/ra/ran/package.nix
+++ b/pkgs/by-name/ra/ran/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-ObroruWWNilHIclqNvbEaa7vwk+1zMzDKbjlVs7Fito=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-X" "main._version_=v${version}"
diff --git a/pkgs/by-name/sc/scripthaus/package.nix b/pkgs/by-name/sc/scripthaus/package.nix
index be6b1e5f9b14..b7d8b5855fd1 100644
--- a/pkgs/by-name/sc/scripthaus/package.nix
+++ b/pkgs/by-name/sc/scripthaus/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-GUZNPLBgqN1zBzCcPl7TB9/4/Yk4e7K6I20nVaM6ank=";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/sc/scrutiny-collector/package.nix b/pkgs/by-name/sc/scrutiny-collector/package.nix
index 905ade381218..a86a7ac687da 100644
--- a/pkgs/by-name/sc/scrutiny-collector/package.nix
+++ b/pkgs/by-name/sc/scrutiny-collector/package.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-extldflags=-static" ];
 
diff --git a/pkgs/by-name/sc/scrutiny/package.nix b/pkgs/by-name/sc/scrutiny/package.nix
index 98a1f0be8083..336492a162f0 100644
--- a/pkgs/by-name/sc/scrutiny/package.nix
+++ b/pkgs/by-name/sc/scrutiny/package.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-SiQw6pq0Fyy8Ia39S/Vgp9Mlfog2drtVn43g+GXiQuI=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-extldflags=-static" ];
 
diff --git a/pkgs/by-name/sk/skeema/package.nix b/pkgs/by-name/sk/skeema/package.nix
index ba4ea7ba6088..82886cf923ab 100644
--- a/pkgs/by-name/sk/skeema/package.nix
+++ b/pkgs/by-name/sk/skeema/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   vendorHash = null;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sl/slsa-verifier/package.nix b/pkgs/by-name/sl/slsa-verifier/package.nix
index 558d1c74b594..4aadc0fe52b9 100644
--- a/pkgs/by-name/sl/slsa-verifier/package.nix
+++ b/pkgs/by-name/sl/slsa-verifier/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-HJ3/RY0Co86y1t2Mas5C+rjwRRG4ZJgxjkz9iWcKf5E=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "cli/slsa-verifier" ];
 
diff --git a/pkgs/by-name/sm/smtprelay/package.nix b/pkgs/by-name/sm/smtprelay/package.nix
index d71d9c5135dd..430bf5a65f7f 100644
--- a/pkgs/by-name/sm/smtprelay/package.nix
+++ b/pkgs/by-name/sm/smtprelay/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
     "."
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   # We do not supply the build time as the build wouldn't be reproducible otherwise.
   ldflags = [
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index ae04e8724f78..5b987702f8f8 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/st/steampipe/package.nix b/pkgs/by-name/st/steampipe/package.nix
index 3209f0b815dc..799c45e6176f 100644
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
   pname = "steampipe";
   version = "1.0.1";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   src = fetchFromGitHub {
     owner = "turbot";
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index e160f23c3911..5a5f8e354447 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -9,7 +9,7 @@ buildGo123Module {
   pname = "tailscale-nginx-auth";
   inherit (tailscale) version src vendorHash;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/nginx-auth" ];
 
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index e93eecbfcfcb..c9d688a99566 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -49,7 +49,7 @@ buildGo123Module {
     installShellFiles
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [
     "cmd/derper"
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index faa97c8a31a5..eb5265268b1a 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/templ" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/temporal/package.nix b/pkgs/by-name/te/temporal/package.nix
index ee435aaffd46..8f80f2360b43 100644
--- a/pkgs/by-name/te/temporal/package.nix
+++ b/pkgs/by-name/te/temporal/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   excludedPackages = [ "./build" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/te/terraform-plugin-docs/package.nix b/pkgs/by-name/te/terraform-plugin-docs/package.nix
index 38780239d54b..357042bec43e 100644
--- a/pkgs/by-name/te/terraform-plugin-docs/package.nix
+++ b/pkgs/by-name/te/terraform-plugin-docs/package.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   allowGoReference = true;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/trdl-client/package.nix b/pkgs/by-name/tr/trdl-client/package.nix
index c64ac876a92a..4dc321795a2d 100644
--- a/pkgs/by-name/tr/trdl-client/package.nix
+++ b/pkgs/by-name/tr/trdl-client/package.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/trdl" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/treefmt2/package.nix b/pkgs/by-name/tr/treefmt2/package.nix
index 5e7e568a94ac..0aca91e20c5c 100644
--- a/pkgs/by-name/tr/treefmt2/package.nix
+++ b/pkgs/by-name/tr/treefmt2/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ty/tygo/package.nix b/pkgs/by-name/ty/tygo/package.nix
index 10a8ae2c9333..af5f690fcfe1 100644
--- a/pkgs/by-name/ty/tygo/package.nix
+++ b/pkgs/by-name/ty/tygo/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-E73yqGhPzZA/1xTYGvTBy0/b4SE9hzx+gdhjX3ClE/Y=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/u-/u-root/package.nix b/pkgs/by-name/u-/u-root/package.nix
index f027050d8e21..4275bc704f5c 100644
--- a/pkgs/by-name/u-/u-root/package.nix
+++ b/pkgs/by-name/u-/u-root/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 9a1b2e0bd6c2..40a866f3921d 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
   # tests require network access
   doCheck = false;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index 5053809e57e9..14da37539a1f 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-2lJmPNLpI1ksFb0EtcjPjyTy7eX1DKeX0F80k9FtGno=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
   ldflags = [
     "-s"
     "-X main.version=${version}"
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index dd6cf1f4357e..87861b665d6d 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-M9+AKgZwqnOtejIHdBF8MAWg2sJLX2cJtNdMZylp1UE=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/by-name/we/webmesh/package.nix b/pkgs/by-name/we/webmesh/package.nix
index 85ca63bd8509..053669528c11 100644
--- a/pkgs/by-name/we/webmesh/package.nix
+++ b/pkgs/by-name/we/webmesh/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-xoc7NSdg5bn3aXgcrolJwv8jyrv2HEXFmiCtRXBVwVg=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   subPackages = [
     "cmd/webmesh-node"
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 8eaeedf58c1c..d0a5f79a1da2 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -32,7 +32,7 @@ buildGoModule rec {
     lib.optionals stdenv.hostPlatform.isLinux [ btrfs-progs ]
     ++ lib.optionals stdenv.hostPlatform.isGnu [ stdenv.cc.libc.static ];
 
-  CGO_ENABLED = if stdenv.hostPlatform.isLinux then 1 else 0;
+  env.CGO_ENABLED = if stdenv.hostPlatform.isLinux then 1 else 0;
 
   ldflags =
     [
@@ -40,7 +40,7 @@ buildGoModule rec {
       "-w"
       "-X github.com/werf/werf/v2/pkg/werf.Version=v${version}"
     ]
-    ++ lib.optionals (CGO_ENABLED == 1) [
+    ++ lib.optionals (env.CGO_ENABLED == 1) [
       "-extldflags=-static"
       "-linkmode external"
     ];
@@ -53,7 +53,7 @@ buildGoModule rec {
       "dfrunsecurity"
       "dfssh"
     ]
-    ++ lib.optionals (CGO_ENABLED == 1) [
+    ++ lib.optionals (env.CGO_ENABLED == 1) [
       "cni"
       "exclude_graphdriver_devicemapper"
       "netgo"
@@ -73,7 +73,7 @@ buildGoModule rec {
         pkg/true_git/*test.go \
         test/e2e
     ''
-    + lib.optionalString (CGO_ENABLED == 0) ''
+    + lib.optionalString (env.CGO_ENABLED == 0) ''
       # A workaround for osusergo.
       export USER=nixbld
     '';
diff --git a/pkgs/by-name/wg/wg-access-server/package.nix b/pkgs/by-name/wg/wg-access-server/package.nix
index a8eceabe9a6d..b77bc0acab69 100644
--- a/pkgs/by-name/wg/wg-access-server/package.nix
+++ b/pkgs/by-name/wg/wg-access-server/package.nix
@@ -22,7 +22,7 @@ buildGoModule rec {
   proxyVendor = true; # darwin/linux hash mismatch
   vendorHash = "sha256-YwFq0KxUctU3ElZBo/b68pyp4lJnFGL9ClKIwUzdngM=";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/wh/whoami/package.nix b/pkgs/by-name/wh/whoami/package.nix
index d47aaed3ed46..7046436f8d53 100644
--- a/pkgs/by-name/wh/whoami/package.nix
+++ b/pkgs/by-name/wh/whoami/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   ldflags = [ "-s" ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   doCheck = false;
 
diff --git a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
index ef9538e05dd3..1643f4b15ca1 100644
--- a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
+++ b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-wB1Uv7ZSIEHzR8z96hwXScoGA31uhoql/wwAH3Olj2E=";
 
-  CGO_ENABLED = "0";
+  env.CGO_ENABLED = "0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/wu/wush/package.nix b/pkgs/by-name/wu/wush/package.nix
index 52f9be9ddd46..a37ffe249571 100644
--- a/pkgs/by-name/wu/wush/package.nix
+++ b/pkgs/by-name/wu/wush/package.nix
@@ -23,7 +23,7 @@ buildGoModule {
     "-s -w -X main.version=${version}"
   ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = with lib; {
     homepage = "https://github.com/coder/wush";
diff --git a/pkgs/by-name/zk/zk/package.nix b/pkgs/by-name/zk/zk/package.nix
index b04c67630846..ed3381218a5a 100644
--- a/pkgs/by-name/zk/zk/package.nix
+++ b/pkgs/by-name/zk/zk/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/agent.nix b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
index 6b03083597be..693772f82b98 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
@@ -14,7 +14,7 @@ buildGoModule {
 
   subPackages = "cmd/agent";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = common.meta // {
     description = "Woodpecker Continuous Integration agent";
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
index b6eb1cc68849..a67b628aa084 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@@ -14,7 +14,7 @@ buildGoModule {
 
   subPackages = "cmd/cli";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = common.meta // {
     description = "Command line client for the Woodpecker Continuous Integration server";
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/server.nix b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
index 2e4eb98bae8f..fce029e63388 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/server.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
@@ -14,7 +14,7 @@ buildGoModule {
 
   subPackages = "cmd/server";
 
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 
   passthru = {
     updateScript = ./update.sh;
diff --git a/pkgs/development/tools/devpod/default.nix b/pkgs/development/tools/devpod/default.nix
index 4d4efc7b3608..43af00e5814d 100644
--- a/pkgs/development/tools/devpod/default.nix
+++ b/pkgs/development/tools/devpod/default.nix
@@ -46,7 +46,7 @@ rec {
 
     vendorHash = null;
 
-    CGO_ENABLED = 0;
+    env.CGO_ENABLED = 0;
 
     ldflags = [
       "-X github.com/loft-sh/devpod/pkg/version.version=v${version}"
diff --git a/pkgs/servers/etcd/3.5/default.nix b/pkgs/servers/etcd/3.5/default.nix
index 6ee0b49c888c..8b1ce476014d 100644
--- a/pkgs/servers/etcd/3.5/default.nix
+++ b/pkgs/servers/etcd/3.5/default.nix
@@ -21,7 +21,7 @@ let
     hash = etcdSrcHash;
   };
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   meta = with lib; {
     description = "Distributed reliable key-value store for the most critical data of a distributed system";
diff --git a/pkgs/servers/mail/mailpit/default.nix b/pkgs/servers/mail/mailpit/default.nix
index a7c327f9d2c5..2ef2f2aa8cab 100644
--- a/pkgs/servers/mail/mailpit/default.nix
+++ b/pkgs/servers/mail/mailpit/default.nix
@@ -68,7 +68,7 @@ buildGoModule {
   pname = "mailpit";
   inherit src version vendorHash;
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 1437c2e42536..3086eaaa4630 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -45,7 +45,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   tags = [ "kqueue" ];
 
diff --git a/pkgs/servers/minio/legacy_fs.nix b/pkgs/servers/minio/legacy_fs.nix
index 20998bfd2207..c528ec192590 100644
--- a/pkgs/servers/minio/legacy_fs.nix
+++ b/pkgs/servers/minio/legacy_fs.nix
@@ -39,7 +39,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   tags = [ "kqueue" ];
 
diff --git a/pkgs/servers/monitoring/loki/promtail.nix b/pkgs/servers/monitoring/loki/promtail.nix
index 2e2df636c26f..fb149cdd45be 100644
--- a/pkgs/servers/monitoring/loki/promtail.nix
+++ b/pkgs/servers/monitoring/loki/promtail.nix
@@ -3,5 +3,5 @@
 grafana-loki.overrideAttrs (o: {
   pname = "promtail";
   subPackages = [ "clients/cmd/promtail" ];
-  CGO_ENABLED = 1;
+  env.CGO_ENABLED = 1;
 })
diff --git a/pkgs/tools/misc/opentelemetry-collector/builder.nix b/pkgs/tools/misc/opentelemetry-collector/builder.nix
index 53b9cf658a38..a41fd2f3be9b 100644
--- a/pkgs/tools/misc/opentelemetry-collector/builder.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/builder.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
   sourceRoot = "${src.name}/cmd/builder";
   vendorHash = "sha256-8g/92NOCj/mH1szrKR04R+Yy9GBYNnQFMi9KhqGKelU=";
 
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/tools/misc/opentelemetry-collector/releases.nix b/pkgs/tools/misc/opentelemetry-collector/releases.nix
index 3f816f2ebd05..8c8c2cde5bb0 100644
--- a/pkgs/tools/misc/opentelemetry-collector/releases.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/releases.nix
@@ -100,7 +100,7 @@ let
         # upstream strongly recommends disabling CGO
         # additionally dependencies have had issues when GCO was enabled that weren't caught upstream
         # https://github.com/open-telemetry/opentelemetry-collector/blob/main/CONTRIBUTING.md#using-cgo
-        CGO_ENABLED = 0;
+        env.CGO_ENABLED = 0;
 
         ldflags = [
           "-s"