treewide: inject xdg-open into wrappers as $PATH suffix

The xdg-open utility is only ever a runtime dependency and its
dependents only expect that it accept a URI as a command line
argument and do something with it that the user would expect.
For such as a trivial relationship it should be possible for
users to override xdg-open with something else in their PATH.

32 files changed, 72 insertions, 45 deletions

diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix
index a66a5e6c9dc..d803b09c198 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix
@@ -27,10 +27,6 @@ stdenv.mkDerivation rec {
     libxkbfile pixman xcbutil xcbutilwm zlib
   ];
 
-  binPath = lib.makeBinPath [
-    xdg-utils zenity ffmpeg
-  ];
-
   installPhase = ''
     mkdir -p $out
     cp -r opt/bitwig-studio $out/libexec
@@ -77,7 +73,8 @@ stdenv.mkDerivation rec {
       -not -path '*/resources/*' | \
     while IFS= read -r f ; do
       wrapProgram $f \
-        --prefix PATH : "${binPath}" \
+        --suffix PATH : "${lib.makeBinPath [ ffmpeg zenity ]}" \
+        --prefix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
         "''${gappsWrapperArgs[@]}" \
         --set LD_PRELOAD "${libxkbcommon.out}/lib/libxkbcommon.so" || true
     done
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
index 6b272a408ab..5eb94f8445e 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@@ -27,10 +27,6 @@ stdenv.mkDerivation rec {
     alsa-lib cairo freetype gdk-pixbuf glib gtk3 libxcb xcbutil xcbutilwm zlib libXtst libxkbcommon pulseaudio libjack2 libX11 libglvnd libXcursor stdenv.cc.cc.lib
   ];
 
-  binPath = lib.makeBinPath [
-    xdg-utils ffmpeg
-  ];
-
   ldLibraryPath = lib.strings.makeLibraryPath buildInputs;
 
   installPhase = ''
@@ -60,8 +56,9 @@ stdenv.mkDerivation rec {
       patchelf --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" $f
       wrapProgram $f \
         "''${gappsWrapperArgs[@]}" \
-        --prefix PATH : "${binPath}" \
-        --suffix LD_LIBRARY_PATH : "${ldLibraryPath}"
+        --prefix LD_LIBRARY_PATH : "${ldLibraryPath}" \
+        --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}" \
+        --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
     done
 
   '';
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 2ad0b6bf6af..b51419784d1 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -53,9 +53,11 @@ stdenv.mkDerivation rec {
       -not -path '*/resources/*' | \
     while IFS= read -r f ; do
       patchelf --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" $f
+      # make xdg-open overrideable at runtime
       wrapProgram $f \
         "''${gappsWrapperArgs[@]}" \
-        --prefix PATH : "${lib.makeBinPath [ xdg-utils ffmpeg ]}" \
+        --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}" \
+        --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
         --suffix LD_LIBRARY_PATH : "${lib.strings.makeLibraryPath buildInputs}"
     done
 
diff --git a/pkgs/applications/finance/irpf/default.nix b/pkgs/applications/finance/irpf/default.nix
index d855586c438..0e52893deda 100644
--- a/pkgs/applications/finance/irpf/default.nix
+++ b/pkgs/applications/finance/irpf/default.nix
@@ -44,11 +44,12 @@ stdenvNoCC.mkDerivation rec {
     install -Dm755 irpf.jar "$BASEDIR/${pname}.jar"
     install -Dm644 Leia-me.htm offline.png online.png pgd-updater.jar "$BASEDIR"
 
+    # make xdg-open overrideable at runtime
     makeWrapper ${jdk11}/bin/java $out/bin/${pname} \
       --add-flags "-Dawt.useSystemAAFontSettings=on" \
       --add-flags "-Dswing.aatext=true" \
       --add-flags "-jar $BASEDIR/${pname}.jar" \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
       --set _JAVA_AWT_WM_NONREPARENTING 1 \
       --set AWT_TOOLKIT MToolkit
 
diff --git a/pkgs/applications/graphics/shutter/default.nix b/pkgs/applications/graphics/shutter/default.nix
index a6430f4889b..e5659fb7fe2 100644
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@@ -94,9 +94,11 @@ stdenv.mkDerivation rec {
   '';
 
   preFixup = ''
+    # make xdg-open overrideable at runtime
     gappsWrapperArgs+=(
       --set PERL5LIB ${perlPackages.makePerlPath perlModules} \
-      --prefix PATH : ${lib.makeBinPath [ imagemagick xdg-utils ] }
+      --prefix PATH : ${lib.makeBinPath [ imagemagick ] }
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ] }
     )
   '';
 
diff --git a/pkgs/applications/misc/1password-gui/beta.nix b/pkgs/applications/misc/1password-gui/beta.nix
index 310df03b766..bd1b0b6e0e6 100644
--- a/pkgs/applications/misc/1password-gui/beta.nix
+++ b/pkgs/applications/misc/1password-gui/beta.nix
@@ -126,8 +126,9 @@ in stdenv.mkDerivation rec {
       # Electron is trying to open udev via dlopen()
       # and for some reason that doesn't seem to be impacted from the rpath.
       # Adding udev to LD_LIBRARY_PATH fixes that.
+      # Make xdg-open overrideable at runtime.
       makeWrapper $out/share/1password/1password $out/bin/1password \
-        --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
 
       runHook postInstall
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 9a09cb10f62..ead45054cc2 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -126,8 +126,9 @@ in stdenv.mkDerivation rec {
       # Electron is trying to open udev via dlopen()
       # and for some reason that doesn't seem to be impacted from the rpath.
       # Adding udev to LD_LIBRARY_PATH fixes that.
+      # Make xdg-open overrideable at runtime.
       makeWrapper $out/share/1password/1password $out/bin/1password \
-        --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
 
       runHook postInstall
diff --git a/pkgs/applications/misc/avrdudess/default.nix b/pkgs/applications/misc/avrdudess/default.nix
index 20c36b74589..e4047e26b84 100644
--- a/pkgs/applications/misc/avrdudess/default.nix
+++ b/pkgs/applications/misc/avrdudess/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     export LD_LIBRARY_PATH="${lib.makeLibraryPath [gtk2 mono]}"
     # We need PATH from user env for xdg-open to find its tools, which
     # typically depend on the currently running desktop environment.
-    export PATH="${lib.makeBinPath [ avrdude xdg-utils ]}:\$PATH"
+    export PATH="\$PATH:${lib.makeBinPath [ avrdude xdg-utils ]}"
 
     # avrdudess must have its resource files in its current working directory
     cd $out/avrdudess && exec ${mono}/bin/mono "$out/avrdudess/avrdudess.exe" "\$@"
diff --git a/pkgs/applications/misc/far2l/default.nix b/pkgs/applications/misc/far2l/default.nix
index f7637534de0..aafc332f6b9 100644
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@@ -61,12 +61,13 @@ stdenv.mkDerivation rec {
     PYTHON = withPython;
   };
 
-  runtimeDeps = [ unzip zip p7zip xz gzip bzip2 gnutar xdg-utils ];
+  runtimeDeps = [ unzip zip p7zip xz gzip bzip2 gnutar ];
 
   postInstall = ''
     wrapProgram $out/bin/far2l \
       --argv0 $out/bin/far2l \
-      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+      --prefix PATH : ${lib.makeBinPath runtimeDeps} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/nwg-drawer/default.nix b/pkgs/applications/misc/nwg-drawer/default.nix
index 1aa4a3660c2..f15279ff439 100644
--- a/pkgs/applications/misc/nwg-drawer/default.nix
+++ b/pkgs/applications/misc/nwg-drawer/default.nix
@@ -33,8 +33,9 @@ buildGoModule rec {
   '';
 
   preFixup = ''
+    # make xdg-open overrideable at runtime
     gappsWrapperArgs+=(
-      --prefix PATH : ${xdg-utils}/bin
+      --suffix PATH : ${xdg-utils}/bin
       --prefix XDG_DATA_DIRS : $out/share
     )
   '';
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index 7dd69aeebcd..a5bc03596d4 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -141,8 +141,9 @@ stdenv.mkDerivation rec {
         --prefix PATH : ${makeBinPath [ iproute2 networkmanager dnsmasq ]} \
         --set LD_LIBRARY_PATH $out/opt/appgate/service
 
+    # make xdg-open overrideable at runtime
     makeWrapper $out/opt/appgate/Appgate $out/bin/appgate \
-        --prefix PATH : ${makeBinPath [ xdg-utils ]} \
+        --suffix PATH : ${makeBinPath [ xdg-utils ]} \
         --set LD_LIBRARY_PATH $out/opt/appgate:${makeLibraryPath deps}
 
     wrapProgram $out/opt/appgate/linux/set_dns --set PYTHONPATH $PYTHONPATH
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 67c950f3f9a..932e33026f7 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -73,7 +73,7 @@ let
     libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
     libXext libXfixes libXi libXrandr libXrender libxshmfence
     libXtst libuuid mesa nspr nss pango pipewire udev wayland
-    xdg-utils xorg.libxcb zlib snappy
+    xorg.libxcb zlib snappy
   ]
     ++ optional pulseSupport libpulseaudio
     ++ optional libvaSupport libva;
@@ -170,6 +170,7 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : ${rpath}
       --prefix PATH : ${binpath}
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
       ${optionalString (enableFeatures != []) ''
       --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}"
       ''}
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 35a98e6c8c6..6f1de80c24b 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -271,11 +271,12 @@ let
           mv "$executablePath" "$oldExe"
         fi
 
+        # make xdg-open overrideable at runtime
         makeWrapper "$oldExe" \
           "''${executablePath}${nameSuffix}" \
             --prefix LD_LIBRARY_PATH ':' "$libs" \
             --suffix-each GTK_PATH ':' "$gtk_modules" \
-            --prefix PATH ':' "${xdg-utils}/bin" \
+            --suffix PATH ':' "${xdg-utils}/bin" \
             --suffix PATH ':' "$out/bin" \
             --set MOZ_APP_LAUNCHER "${launcherName}" \
             --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index c1c431f7300..def7c989e5b 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -63,7 +63,7 @@ let
     dbus gdk-pixbuf gcc-unwrapped.lib
     systemd
     libexif pciutils
-    liberation_ttf curl util-linux xdg-utils wget
+    liberation_ttf curl util-linux wget
     flac harfbuzz icu libpng opusWithCustomModes snappy speechd
     bzip2 libcap at-spi2-atk at-spi2-core
     libkrb5 libdrm libglvnd mesa coreutils
@@ -145,6 +145,7 @@ in stdenv.mkDerivation {
     makeWrapper "$out/share/google/$appname/google-$appname" "$exe" \
       --prefix LD_LIBRARY_PATH : "$rpath" \
       --prefix PATH            : "$binpath" \
+      --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addOpenGLRunpath.driverLink}/share" \
       --set CHROME_WRAPPER  "google-chrome-$dist" \
       --add-flags ${escapeShellArg commandLineArgs} \
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index 6f6a6e0b337..9a0766a9265 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
     # Wrap the startup command
     makeWrapper $out/opt/ArmCord/armcord $out/bin/armcord \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
       "''${gappsWrapperArgs[@]}"
 
     # Fix desktop link
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index c74bffdd5e2..3779624aaa7 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -111,10 +111,11 @@ stdenv.mkDerivation rec {
 
     cc $localtime64_stub -shared -o "${placeholder "out"}"/opt/BlueJeans/liblocaltime64_stub.so
 
+    # make xdg-open overrideable at runtime
     makeWrapper $out/opt/BlueJeans/bluejeans-v2 $out/bin/bluejeans \
       --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
       --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
 
     substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
       --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
diff --git a/pkgs/applications/networking/instant-messengers/franz/generic.nix b/pkgs/applications/networking/instant-messengers/franz/generic.nix
index 7438e5496ac..44546aabe22 100644
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@@ -85,9 +85,10 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true;
 
   postFixup = ''
+    # make xdg-open overrideable at runtime
     wrapProgram $out/opt/${name}/${pname} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDependencies}" \
-      --prefix PATH : ${xdg-utils}/bin \
+      --suffix PATH : ${xdg-utils}/bin \
       "''${gappsWrapperArgs[@]}"
   '';
 }
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 5d497546095..50693abe8ba 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -164,11 +164,12 @@ let
         patchelf --set-rpath ${rpath}:$out/lib/slack $file || true
       done
 
-      # Replace the broken bin/slack symlink with a startup wrapper
+      # Replace the broken bin/slack symlink with a startup wrapper.
+      # Make xdg-open overrideable at runtime.
       rm $out/bin/slack
       makeWrapper $out/lib/slack/slack $out/bin/slack \
         --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
-        --prefix PATH : ${lib.makeBinPath [xdg-utils]} \
+        --suffix PATH : ${lib.makeBinPath [xdg-utils]} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
       # Fix the desktop link
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 3f1468126fd..bc7fa4a14bc 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -173,7 +173,7 @@ env.mkDerivation rec {
     wrapProgram $out/bin/telegram-desktop \
       "''${gappsWrapperArgs[@]}" \
       "''${qtWrapperArgs[@]}" \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils]} \
       --set XDG_RUNTIME_DIR "XDG-RUNTIME-DIR"
     sed -i $out/bin/telegram-desktop \
       -e "s,'XDG-RUNTIME-DIR',\"\''${XDG_RUNTIME_DIR:-/run/user/\$(id --user)}\","
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index 26a6b43d448..cf6410def0d 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -53,8 +53,9 @@ in stdenv.mkDerivation {
   '';
 
   postFixup = ''
+    # make xdg-open overrideable at runtime
     makeWrapper $out/opt/wavebox/Wavebox $out/bin/wavebox \
-      --prefix PATH : ${xdg-utils}/bin
+      --suffix PATH : ${xdg-utils}/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index ec2d717e359..51b95a3f2a4 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -79,7 +79,8 @@ mkDerivation rec {
     "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret ]}"
     # See also: https://bugreports.qt.io/browse/QTBUG-85967
     "--set QML_DISABLE_DISK_CACHE 1"
-    "--prefix PATH : ${lib.makeBinPath [ xdg-utils ]}"
+    # make xdg-open overrideable at runtime
+    "--suffix PATH : ${lib.makeBinPath [ xdg-utils ]}"
   ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/office/jabref/default.nix b/pkgs/applications/office/jabref/default.nix
index 78fe02e944e..8d3fffb709b 100644
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
     unzip $out/lib/javafx-web-18-linux${lib.optionalString stdenv.isAarch64 "-aarch64"}.jar libjfxwebkit.so -d $out/lib/
 
     wrapProgram $out/bin/JabRef \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
       --set JAVA_HOME "${jdk}" \
       --set JAVA_OPTS "-Djava.library.path=$out/lib/ --patch-module org.jabref=$out/share/java/jabref/resources/main"
 
diff --git a/pkgs/applications/office/mytetra/default.nix b/pkgs/applications/office/mytetra/default.nix
index 5ffd178b055..166210704aa 100644
--- a/pkgs/applications/office/mytetra/default.nix
+++ b/pkgs/applications/office/mytetra/default.nix
@@ -26,8 +26,9 @@ mkDerivation rec {
   '';
 
   postFixup = ''
+    # make xdg-open overrideable at runtime
     wrapProgram $out/bin/mytetra \
-      --prefix PATH : ${xdg-utils}/bin
+      --suffix PATH : ${xdg-utils}/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git-open/default.nix b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
index 5d12c93b0b3..2c57ca1f840 100644
--- a/pkgs/applications/version-management/git-and-tools/git-open/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
     cp git-open $out/bin
     installManPage git-open.1
     wrapProgram $out/bin/git-open \
-      --prefix PATH : "${lib.makeBinPath [ git xdg-utils gnugrep ]}"
+      --prefix PATH : "${lib.makeBinPath [ git gnugrep ]}" \
+      --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
index 91346637562..754fa778fed 100644
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -22,7 +22,10 @@ buildGoModule rec {
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   postInstall = ''
-    wrapProgram $out/bin/lab --prefix PATH ":" "${lib.makeBinPath [ git xdg-utils ]}";
+    # make xdg-open overrideable at runtime
+    wrapProgram $out/bin/lab \
+      --prefix PATH ":" "${lib.makeBinPath [ git ]}" \
+      --suffix PATH ":" "${lib.makeBinPath [ xdg-utils ]}"
     installShellCompletion --cmd lab \
       --bash <($out/bin/lab completion bash) \
       --fish <($out/bin/lab completion fish) \
diff --git a/pkgs/applications/video/pipe-viewer/default.nix b/pkgs/applications/video/pipe-viewer/default.nix
index 1ef08870c86..53ffa9bcdc4 100644
--- a/pkgs/applications/video/pipe-viewer/default.nix
+++ b/pkgs/applications/video/pipe-viewer/default.nix
@@ -72,8 +72,10 @@ buildPerlModule rec {
     wrapProgram "$out/bin/pipe-viewer" \
       --prefix PATH : "${lib.makeBinPath [ ffmpeg wget youtube-dl yt-dlp ]}"
   '' + lib.optionalString withGtk3 ''
+    # make xdg-open overrideable at runtime
     wrapProgram "$out/bin/gtk-pipe-viewer" ''${gappsWrapperArgs[@]} \
-      --prefix PATH : "${lib.makeBinPath [ ffmpeg wget xdg-utils youtube-dl yt-dlp ]}"
+      --prefix PATH : "${lib.makeBinPath [ ffmpeg wget youtube-dl yt-dlp ]}" \
+      --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/enigma/default.nix b/pkgs/games/enigma/default.nix
index 247d7b9dee1..c9f16918b49 100644
--- a/pkgs/games/enigma/default.nix
+++ b/pkgs/games/enigma/default.nix
@@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     rm -r $out/include
-    wrapProgram $out/bin/enigma --prefix PATH : "${lib.makeBinPath [ xdg-utils ]}"
+    # make xdg-open overrideable at runtime
+    wrapProgram $out/bin/enigma --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/grapejuice/default.nix b/pkgs/games/grapejuice/default.nix
index 23e245149ad..24835f604ae 100644
--- a/pkgs/games/grapejuice/default.nix
+++ b/pkgs/games/grapejuice/default.nix
@@ -56,7 +56,9 @@ python3Packages.buildPythonApplication rec  {
 
   makeWrapperArgs = [
     "\${gappsWrapperArgs[@]}"
-    "--prefix PATH : ${lib.makeBinPath [ xdg-user-dirs xdg-utils wine winetricks pciutils glxinfo ]}"
+    "--prefix PATH : ${lib.makeBinPath [ xdg-user-dirs wine winetricks pciutils glxinfo ]}"
+    # make xdg-open overrideable at runtime
+    "--suffix PATH : ${lib.makeBinPath [ xdg-utils ]}"
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index 8273e810a22..a7a9b5c8fe5 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -119,8 +119,9 @@ buildGoModule rec {
 
   postInstall = ''
     install -Dm755 -t $client/bin $out/bin/tsh
-    wrapProgram $client/bin/tsh --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
-    wrapProgram $out/bin/tsh --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    # make xdg-open overrideable at runtime
+    wrapProgram $client/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    wrapProgram $out/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/admin/aws-sso-cli/default.nix b/pkgs/tools/admin/aws-sso-cli/default.nix
index e248244204e..f658597e8a7 100644
--- a/pkgs/tools/admin/aws-sso-cli/default.nix
+++ b/pkgs/tools/admin/aws-sso-cli/default.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
   postInstall = ''
     mv $out/bin/cmd $out/bin/aws-sso
     wrapProgram $out/bin/aws-sso \
-      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index f861a22d812..beaa3ccd962 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -21,7 +21,8 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   postInstall = ''
-    wrapProgram $out/bin/aws-vault --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    # make xdg-open overrideable at runtime
+    wrapProgram $out/bin/aws-vault --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
     installShellCompletion --cmd aws-vault \
       --bash $src/contrib/completions/bash/aws-vault.bash \
       --fish $src/contrib/completions/fish/aws-vault.fish \
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 45f5e5ce0b6..1aa668d86f4 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -5,7 +5,6 @@
 
 let
   pythonPackages = python3Packages;
-  binPath = lib.makeBinPath [ xdg-utils dnsmasq dhcp iproute2 ];
 
 in stdenv.mkDerivation rec {
   pname = "blueman";
@@ -41,8 +40,12 @@ in stdenv.mkDerivation rec {
     (lib.enableFeature withPulseAudio "pulseaudio")
   ];
 
+  makeWrapperArgs = [
+    "--prefix PATH ':' ${lib.makeBinPath [ dnsmasq dhcp iproute2 ]}"
+    "--suffix PATH ':' ${lib.makeBinPath [ xdg-utils ]}"
+  ];
+
   postFixup = ''
-    makeWrapperArgs="--prefix PATH ':' ${binPath}"
     # This mimics ../../../development/interpreters/python/wrap.sh
     wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
     wrapPythonProgramsIn "$out/libexec" "$out $pythonPath"