diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 74f815fc1d79..0435362306ba 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -2754,9 +2754,9 @@ addEnvHooks "$hostOffset" myBashFunction
      <listitem>
       <para>
        Overrides the configure, build, and install phases. This will run the
-       "waf" script used by many projects. If waf doesn’t exist, it will copy
-       the version of waf available in Nixpkgs wafFlags can be used to pass
-       flags to the waf script.
+       "waf" script used by many projects. If wafPath (default ./waf) doesn’t
+       exist, it will copy the version of waf available in Nixpkgs. wafFlags can
+       be used to pass flags to the waf script.
       </para>
      </listitem>
     </varlistentry>
diff --git a/pkgs/applications/audio/ardour/default.nix b/pkgs/applications/audio/ardour/default.nix
index 1bb1e404b5c4..30a4e052d77c 100644
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     patchShebangs ./tools/
   '';
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--optimize"
     "--docs"
     "--with-backends=jack,alsa,dummy"
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index bc4c18aab085..465544e7c6ac 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     zita-resampler curl
   ];
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--shared-lib"
     "--no-desktop-update"
     "--enable-nls"
diff --git a/pkgs/applications/misc/xiphos/default.nix b/pkgs/applications/misc/xiphos/default.nix
index 7148caf35d34..88ab52313b06 100644
--- a/pkgs/applications/misc/xiphos/default.nix
+++ b/pkgs/applications/misc/xiphos/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     export SWORD_HOME=${sword};
   '';
 
-  configureFlags= [ "--enable-webkit2" ];
+  wafConfigureFlags = [ "--enable-webkit2" ];
 
   meta = with stdenv.lib; {
     description = "A GTK Bible study tool";
diff --git a/pkgs/development/libraries/audio/lvtk/default.nix b/pkgs/development/libraries/audio/lvtk/default.nix
index b6203a159e6c..78763ca29e2a 100644
--- a/pkgs/development/libraries/audio/lvtk/default.nix
+++ b/pkgs/development/libraries/audio/lvtk/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sed -i '/target[ ]*= "ttl2c"/ ilib=["boost_system"],' tools/wscript_build
   '';
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--boost-includes=${boost.dev}/include"
     "--boost-libs=${boost.out}/lib"
   ];
diff --git a/pkgs/development/libraries/ndn-cxx/default.nix b/pkgs/development/libraries/ndn-cxx/default.nix
index 923bc61f67da..cbe1f9840593 100644
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
   nativeBuildInputs = [ pkgconfig wafHook ];
   buildInputs = [ openssl doxygen boost sqlite python pythonPackages.sphinx];
-  configureFlags = [
+  wafConfigureFlags = [
     "--with-openssl=${openssl.dev}"
     "--boost-includes=${boost.dev}/include"
     "--boost-libs=${boost.out}/lib"
diff --git a/pkgs/development/libraries/science/networking/ns3/default.nix b/pkgs/development/libraries/science/networking/ns3/default.nix
index d5c3ca2457aa..5218de075093 100644
--- a/pkgs/development/libraries/science/networking/ns3/default.nix
+++ b/pkgs/development/libraries/science/networking/ns3/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     patchShebangs doc/ns3_html_theme/get_version.sh
   '';
 
-  configureFlags = with stdenv.lib; [
+  wafConfigureFlags = with stdenv.lib; [
       "--enable-modules=${stdenv.lib.concatStringsSep "," modules}"
       "--with-python=${pythonEnv.interpreter}"
   ]
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index 1fbbecf71a6b..5a8ebe84ba69 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, python, pkgconfig, readline, libxslt
 , docbook_xsl, docbook_xml_dtd_42, fixDarwinDylibNames
-, buildPackages
+, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -11,23 +11,22 @@ stdenv.mkDerivation rec {
     sha256 = "1kk76dyav41ip7ddbbf04yfydb4jvywzi2ps0z2vla56aqkn11di";
   };
 
-  nativeBuildInputs = [ pkgconfig fixDarwinDylibNames python
+  nativeBuildInputs = [ pkgconfig fixDarwinDylibNames python wafHook
                         docbook_xsl docbook_xml_dtd_42 ];
   buildInputs = [ readline libxslt ];
 
-  prePatch = ''
-    patchShebangs buildtools/bin/waf
-  '';
+  wafPath = "buildtools/bin/waf";
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--enable-talloc-compat1"
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
-  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-compile"
-    "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
-  configurePlatforms = [];
+
+  # this must not be exported before the ConfigurePhase otherwise waf whines
+  preBuild = stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+    export NIX_CFLAGS_LINK="-no-pie -shared";
+  '';
 
   postInstall = ''
     ${stdenv.cc.targetPrefix}ar q $out/lib/libtalloc.a bin/default/talloc_[0-9]*.o
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index 21f062998b40..4df80140aa5d 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, python2, pkgconfig, readline, libxslt
-, docbook_xsl, docbook_xml_dtd_42, buildPackages
+{ stdenv, fetchurl, wafHook, pkgconfig, readline, libxslt
+, docbook_xsl, docbook_xml_dtd_42
 }:
 
 stdenv.mkDerivation rec {
@@ -10,23 +10,17 @@ stdenv.mkDerivation rec {
     sha256 = "1ibcz466xwk1x6xvzlgzd5va4lyrjzm3rnjak29kkwk7cmhw4gva";
   };
 
-  nativeBuildInputs = [ pkgconfig python2 ];
+  nativeBuildInputs = [ pkgconfig wafHook ];
   buildInputs = [
     readline libxslt docbook_xsl docbook_xml_dtd_42
   ];
 
-  preConfigure = ''
-    patchShebangs buildtools/bin/waf
-  '';
+  wafPath = "buildtools/bin/waf";
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
-  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-compile"
-    "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
-  configurePlatforms = [ ];
 
   meta = with stdenv.lib; {
     description = "The trivial database";
diff --git a/pkgs/development/tools/build-managers/waf/setup-hook.sh b/pkgs/development/tools/build-managers/waf/setup-hook.sh
index b8a448df8ef8..3da86d3201f5 100644
--- a/pkgs/development/tools/build-managers/waf/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/waf/setup-hook.sh
@@ -1,20 +1,23 @@
 wafConfigurePhase() {
     runHook preConfigure
 
-    if ! [ -f ./waf ]; then
-        cp @waf@ waf
+    if ! [ -f "${wafPath:=./waf}" ]; then
+        echo "copying waf to $wafPath..."
+        cp @waf@ "$wafPath"
     fi
 
-    if [[ -z "${dontAddPrefix:-}" && -n "$prefix" ]]; then
-        configureFlags="${prefixKey:---prefix=}$prefix $configureFlags"
+    if [ -z "${dontAddPrefix:-}" ] && [ -n "$prefix" ]; then
+        wafConfigureFlags="${prefixKey:---prefix=}$prefix $wafConfigureFlags"
     fi
 
     local flagsArray=(
-        $configureFlags ${configureFlagsArray[@]}
+        @crossFlags@
+        "${flagsArray[@]}"
+        $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
         ${configureTargets:-configure}
     )
     echoCmd 'configure flags' "${flagsArray[@]}"
-    python waf "${flagsArray[@]}"
+    python "$wafPath" "${flagsArray[@]}"
 
     runHook postConfigure
 }
@@ -33,7 +36,7 @@ wafBuildPhase () {
     )
 
     echoCmd 'build flags' "${flagsArray[@]}"
-    python waf "${flagsArray[@]}"
+    python "$wafPath" "${flagsArray[@]}"
 
     runHook postBuild
 }
@@ -52,7 +55,7 @@ wafInstallPhase() {
     )
 
     echoCmd 'install flags' "${flagsArray[@]}"
-    python waf "${flagsArray[@]}"
+    python "$wafPath" "${flagsArray[@]}"
 
     runHook postInstall
 }
diff --git a/pkgs/misc/emulators/wxmupen64plus/default.nix b/pkgs/misc/emulators/wxmupen64plus/default.nix
index e63d27ec4039..1199f987bb6a 100644
--- a/pkgs/misc/emulators/wxmupen64plus/default.nix
+++ b/pkgs/misc/emulators/wxmupen64plus/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     export CXXFLAGS="-I${libX11.dev}/include/X11 -DLIBDIR=\\\"${mupen64plus}/lib/\\\""
     export LDFLAGS="-lwx_gtk2u_adv-2.9"
 
-    configureFlagsArray+=("--mupenapi=$APIDIR" "--wxconfig=`type -P wx-config`")
+    wafConfigureFlagsArray+=("--mupenapi=$APIDIR" "--wxconfig=`type -P wx-config`")
   '';
 
   NIX_CFLAGS_COMPILE = "-fpermissive";
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index a47c20184442..556b66befe63 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     export NIX_CFLAGS_COMPILE="-F${CoreFoundation}/Library/Frameworks $NIX_CFLAGS_COMPILE"
   '';
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--classic"
     "--autostart=${if (optDbus != null) then "dbus" else "classic"}"
   ] ++ optional (optDbus != null) "--dbus"
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index 70821468992b..566d6f48e1cc 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     libjpeg libpng xorg.libxcb libX11 libGL libdrm python27 wayland udev mesa_noglu
   ];
 
-  configureFlags = ["--with-flavors=x11-gl,x11-glesv2,drm-gl,drm-glesv2,wayland-gl,wayland-glesv2"];
+  wafConfigureFlags = ["--with-flavors=x11-gl,x11-glesv2,drm-gl,drm-glesv2,wayland-gl,wayland-glesv2"];
 
   meta = with stdenv.lib; {
     description = "OpenGL (ES) 2.0 benchmark";
diff --git a/pkgs/tools/system/proot/default.nix b/pkgs/tools/system/proot/default.nix
index 2381ce6c0db1..c8028ed74a7c 100644
--- a/pkgs/tools/system/proot/default.nix
+++ b/pkgs/tools/system/proot/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/GNUmakefile \
       --replace /bin/echo ${coreutils}/bin/echo
+    # our cross machinery defines $CC and co just right
+    sed -i /CROSS_COMPILE/d src/GNUmakefile
   '';
 
   buildInputs = [ talloc ] ++ stdenv.lib.optional enablePython python;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 909b5e727190..c048f4431612 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6463,7 +6463,11 @@ in
   waf = callPackage ../development/tools/build-managers/waf { python = python3; };
   wafHook = makeSetupHook {
     deps = [ python ];
-    substitutions = { inherit waf; };
+    substitutions = {
+      inherit waf;
+      crossFlags = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform)
+        ''--cross-compile "--cross-execute=${stdenv.targetPlatform.emulator pkgs}"'';
+    };
   } ../development/tools/build-managers/waf/setup-hook.sh;
 
   wakelan = callPackage ../tools/networking/wakelan { };