diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 1a48c2d037cb..e0e223647630 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -10,7 +10,16 @@ with (import ./update.nix {
 }).getChannel channel;
 
 let
+  transform = flags: concatStringsSep ";" (map (subst: subst + flags) [
+    "s,^[^/]+(.*)$,$main\\1,"
+    "s,$main/(build|tools)(/.*)?$,$out/\\1\\2,"
+    "s,$main/third_party(/.*)?$,$bundled\\1,"
+    "s,$main/sandbox(/.*)?$,$sandbox\\1,"
+    "s,^/,,"
+  ]);
+
   pre42 = versionOlder version "42.0.0.0";
+
 in stdenv.mkDerivation {
   name = "chromium-source-${version}";
 
@@ -18,11 +27,25 @@ in stdenv.mkDerivation {
 
   buildInputs = [ python ]; # cannot patch shebangs otherwise
 
-  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+  phases = [ "unpackPhase" "patchPhase" ];
+  outputs = [ "out" "sandbox" "bundled" "main" ];
+
+  unpackPhase = ''
+    tar xf "$src" -C / \
+      --transform="${transform "xS"}" \
+      --anchored \
+      --no-wildcards-match-slash \
+      --exclude='*/tools/gyp' \
+      --exclude='*/.*'
+  '';
 
   opensslPatches = optional useOpenSSL openssl.patches;
 
-  prePatch = "patchShebangs .";
+  prePatch = ''
+    for i in $outputs; do
+      eval patchShebangs "\$$i"
+    done
+  '';
 
   patches = if pre42 then [
     ./sandbox_userns_36.patch ./nix_plugin_paths.patch
@@ -30,48 +53,33 @@ in stdenv.mkDerivation {
     ./nix_plugin_paths_42.patch
   ];
 
+  patchPhase = let
+    diffmod = sym: "/^${sym} /{s/^${sym} //;${transform ""};s/^/${sym} /}";
+    allmods = "${diffmod "---"};${diffmod "\\+\\+\\+"}";
+    sedexpr = "/^(---|\\+\\+\\+) *\\/dev\\/null/b;${allmods}";
+  in ''
+    runHook prePatch
+    for i in $patches; do
+      header "applying patch $i" 3
+      sed -r -e "${sedexpr}" "$i" | patch -d / -p0
+      stopNest
+    done
+    runHook postPatch
+  '';
+
   postPatch = ''
     sed -i -r \
       -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
       -e 's|/bin/echo|echo|' \
       -e "/python_arch/s/: *'[^']*'/: '""'/" \
-      build/common.gypi chrome/chrome_tests.gypi
+      "$out/build/common.gypi" "$main/chrome/chrome_tests.gypi"
   '' + optionalString useOpenSSL ''
-    cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
+    cat $opensslPatches | patch -p1 -d "$bundled/openssl/openssl"
   '' + optionalString (!pre42) ''
     sed -i -e '/LOG.*no_suid_error/d' \
       "$main/content/browser/browser_main_loop.cc"
   '';
 
-  outputs = [ "out" "sandbox" "bundled" "main" ];
-  installPhase = ''
-    mkdir -p "$out" "$sandbox" "$bundled" "$main"
-
-    header "copying browser main sources to $main"
-    find . -mindepth 1 -maxdepth 1 \
-      \! -path ./sandbox \
-      \! -path ./third_party \
-      \! -path ./build \
-      \! -path ./tools \
-      \! -name '.*' \
-      -print | xargs cp -rt "$main"
-    stopNest
-
-    header "copying sandbox components to $sandbox"
-    cp -rt "$sandbox" sandbox/*
-    stopNest
-
-    header "copying third party sources to $bundled"
-    cp -rt "$bundled" third_party/*
-    stopNest
-
-    header "copying build requisites to $out"
-    cp -rt "$out" build tools
-    stopNest
-
-    rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
-  '';
-
   passthru = {
     inherit version channel;
     plugins = fetchurl binary;