diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index f0da0a855169..fedb5c19021a 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -13,7 +13,7 @@ done
 # array expansion also prevents undefined variables from causing trouble with
 # `set -u`.
 for flag in ${NIX_HARDENING_ENABLE+}; do
-  if [[ -n "${hardeningDisableMap[$flag]}" ]]; then
+  if [[ -z "${hardeningDisableMap[$flag]}" ]]; then
     hardeningEnableMap[$flag]=1
   fi
 done