treewide: use ${stdenv.shell} instead of /bin/sh where possible

92 files changed, 156 insertions, 120 deletions

diff --git a/pkgs/applications/editors/standardnotes/default.nix b/pkgs/applications/editors/standardnotes/default.nix
index d9bca530948..0787250fece 100644
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/{bin,share}
     cp $src $out/share/standardNotes.AppImage
-    echo "#!/bin/sh" > $out/bin/standardnotes
+    echo "#!${stdenv.shell}" > $out/bin/standardnotes
     echo "${appimage-run}/bin/appimage-run $out/share/standardNotes.AppImage" >> $out/bin/standardnotes
     chmod +x $out/bin/standardnotes $out/share/standardNotes.AppImage
   '';
diff --git a/pkgs/applications/editors/sublime/3/common.nix b/pkgs/applications/editors/sublime/3/common.nix
index cf6802eb9a9..71bd3544feb 100644
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@@ -115,7 +115,7 @@ in stdenv.mkDerivation (rec {
     mkdir -p $out/bin
 
     cat > $out/bin/subl <<-EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $sublime/sublime_text "\$@"
     EOF
     chmod +x $out/bin/subl
diff --git a/pkgs/applications/graphics/alchemy/default.nix b/pkgs/applications/graphics/alchemy/default.nix
index 848f132060f..30223658f53 100644
--- a/pkgs/applications/graphics/alchemy/default.nix
+++ b/pkgs/applications/graphics/alchemy/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/share
     cp -a . $out/share/alchemy
     cat >> $out/bin/alchemy << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/share/alchemy
     ${jre}/bin/java -jar Alchemy.jar "$@"
     EOF
diff --git a/pkgs/applications/graphics/swingsane/default.nix b/pkgs/applications/graphics/swingsane/default.nix
index 94666531c0c..ac3de4a4e14 100644
--- a/pkgs/applications/graphics/swingsane/default.nix
+++ b/pkgs/applications/graphics/swingsane/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   installPhase = let
 
     execWrapper = ''
-      #!/bin/sh
+      #!${stdenv.shell}
       exec ${jre}/bin/java -jar $out/share/java/swingsane/swingsane-${version}.jar "$@"
     '';
 
diff --git a/pkgs/applications/graphics/wings/default.nix b/pkgs/applications/graphics/wings/default.nix
index ed3220d2bf9..e27f074b21b 100644
--- a/pkgs/applications/graphics/wings/default.nix
+++ b/pkgs/applications/graphics/wings/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     cp ebin/* $out/lib/${name}/ebin
     cp -R textures shaders plugins $out/lib/$name
     cat << EOF > $out/bin/wings
-    #!/bin/sh
+    #!${stdenv.shell}
     ${erlang}/bin/erl \
       -pa $out/lib/${name}/ebin -run wings_start start_halt "$@"
     EOF
diff --git a/pkgs/applications/graphics/zgrviewer/default.nix b/pkgs/applications/graphics/zgrviewer/default.nix
index 03ffa8af370..c60d4b7b904 100644
--- a/pkgs/applications/graphics/zgrviewer/default.nix
+++ b/pkgs/applications/graphics/zgrviewer/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
     cp -r target/* "$out/share/java/zvtm/"
 
-    echo '#!/bin/sh' > "$out/bin/zgrviewer"
+    echo '#!${stdenv.shell}' > "$out/bin/zgrviewer"
     echo "${jre}/lib/openjdk/jre/bin/java -jar '$out/share/java/zvtm/zgrviewer-${version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
     chmod a+x "$out/bin/zgrviewer"
   '';
diff --git a/pkgs/applications/misc/curabydagoma/default.nix b/pkgs/applications/misc/curabydagoma/default.nix
index 439b0fc2568..1ea106d6a18 100644
--- a/pkgs/applications/misc/curabydagoma/default.nix
+++ b/pkgs/applications/misc/curabydagoma/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     cat > $out/bin/curabydago <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     export PYTHONPATH=$PYTHONPATH
     ${python.out}/bin/python $out/curabydago/cura.py
     EOF
diff --git a/pkgs/applications/misc/freemind/default.nix b/pkgs/applications/misc/freemind/default.nix
index eeb269e580c..5152c8aa3f7 100644
--- a/pkgs/applications/misc/freemind/default.nix
+++ b/pkgs/applications/misc/freemind/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sed -i 's/which/type -p/' $out/nix-support/dist/freemind.sh
 
     cat >$out/bin/freemind <<EOF
-    #! /bin/sh
+    #! ${stdenv.shell}
     JAVA_HOME=${jre} $out/nix-support/dist/freemind.sh
     EOF
     chmod +x $out/{bin/freemind,nix-support/dist/freemind.sh}
diff --git a/pkgs/applications/misc/hello-unfree/default.nix b/pkgs/applications/misc/hello-unfree/default.nix
index ef378b2c5ff..c055bddec69 100644
--- a/pkgs/applications/misc/hello-unfree/default.nix
+++ b/pkgs/applications/misc/hello-unfree/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cat > $out/bin/hello-unfree << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     echo "Hello, you are running an unfree system!"
     EOF
     chmod +x $out/bin/hello-unfree
diff --git a/pkgs/applications/misc/jbidwatcher/default.nix b/pkgs/applications/misc/jbidwatcher/default.nix
index ed8573b8850..2c46ea3ac9a 100644
--- a/pkgs/applications/misc/jbidwatcher/default.nix
+++ b/pkgs/applications/misc/jbidwatcher/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p "$out/bin"
-    echo > "$out/bin/${pname}" "#!/bin/sh"
+    echo > "$out/bin/${pname}" "#!${stdenv.shell}"
     echo >>"$out/bin/${pname}" "${java}/bin/java -Xmx512m -jar ${jarfile}"
     chmod +x "$out/bin/${pname}"
     install -D -m644 ${src} ${jarfile}
diff --git a/pkgs/applications/misc/multibootusb/default.nix b/pkgs/applications/misc/multibootusb/default.nix
index 02541842c36..88a7b94897d 100644
--- a/pkgs/applications/misc/multibootusb/default.nix
+++ b/pkgs/applications/misc/multibootusb/default.nix
@@ -1,4 +1,4 @@
-{ lib, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5 }:
+{ stdenv, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5 }:
 python36Packages.buildPythonApplication rec {
   pname = "multibootusb";
   name = "${pname}-${version}";
@@ -40,7 +40,7 @@ python36Packages.buildPythonApplication rec {
 
     mkdir "$out/bin"
     cat > "$out/bin/${pname}" <<EOF
-      #!/bin/sh
+      #!${stdenv.shell}
       cd "$share"
       export PYTHONPATH="$PYTHONPATH:$share"
       export PATH="$PATH:${parted}/bin:${procps}/bin"
@@ -50,7 +50,7 @@ python36Packages.buildPythonApplication rec {
     chmod +x "$out/bin/${pname}"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Multiboot USB creator for Linux live disks";
     homepage = http://multibootusb.org/;
     license = licenses.gpl2;
diff --git a/pkgs/applications/misc/openjump/default.nix b/pkgs/applications/misc/openjump/default.nix
index fdc4cd5b6d9..09ec3433862 100644
--- a/pkgs/applications/misc/openjump/default.nix
+++ b/pkgs/applications/misc/openjump/default.nix
@@ -17,9 +17,9 @@ stdenv.mkDerivation {
     s=$out/bin/OpenJump
     dir=$(echo $out/openjump-*)
     cat >> $s << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $dir/bin
-    exec /bin/sh openjump.sh
+    exec ${stdenv.shell} openjump.sh
     EOF
     chmod +x $s
     ln -s /tmp/openjump.log $dir/bin/jump.log
diff --git a/pkgs/applications/misc/thinking-rock/default.nix b/pkgs/applications/misc/thinking-rock/default.nix
index 1229990b1ab..ab9611326ca 100644
--- a/pkgs/applications/misc/thinking-rock/default.nix
+++ b/pkgs/applications/misc/thinking-rock/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     mkdir -p $out/{nix-support/tr-files,bin}
     cp -r . $out/nix-support/tr-files
     cat >> $out/bin/thinkingrock << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $out/nix-support/tr-files/bin/tr "$@"
     EOF
     chmod +x $out/bin/thinkingrock
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-facebook/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-facebook/default.nix
index 150c47b9b50..cff1bcc56b9 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-facebook/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-facebook/default.nix
@@ -21,7 +21,7 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     # we do all patching from update.sh in preAutoreconf
-    echo "#!/bin/sh" > update.sh
+    echo "#!${stdenv.shell}" > update.sh
   '';
 
   preAutoreconf = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix
index 3e9ebf3fe93..3c9157081d3 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     cp ./bin/telegram-cli $out/bin/telegram-wo-key
     cp ./tg-server.pub $out/
     cat > $out/bin/telegram-cli <<EOF
-    #!${bash}/bin/sh
+    #!${stdenv.shell}
     $out/bin/telegram-wo-key -k $out/tg-server.pub "\$@"
     EOF
     chmod +x $out/bin/telegram-cli
diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix
index 91be7dca117..ffd25b6238b 100644
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -11,7 +11,7 @@ let
 
   start_script =
     ''
-      #!/bin/sh
+      #!${stdenv.shell}
       cd $out/lib/hol_light
       exec ${ocaml}/bin/ocaml \
         -I \`${camlp5}/bin/camlp5 -where\` \
diff --git a/pkgs/applications/science/logic/iprover/default.nix b/pkgs/applications/science/logic/iprover/default.nix
index d3950349711..46b29e3dd27 100644
--- a/pkgs/applications/science/logic/iprover/default.nix
+++ b/pkgs/applications/science/logic/iprover/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
     mkdir -p "$out/share/${name}"
     cp *.p "$out/share/${name}"
-    echo -e "#! /bin/sh\\n$out/bin/iproveropt --clausifier \"${eprover}/bin/eprover\" --clausifier_options \" --tstp-format --silent --cnf \" \"\$@\"" > "$out"/bin/iprover
+    echo -e "#! ${stdenv.shell}\\n$out/bin/iproveropt --clausifier \"${eprover}/bin/eprover\" --clausifier_options \" --tstp-format --silent --cnf \" \"\$@\"" > "$out"/bin/iprover
     chmod a+x  "$out"/bin/iprover
   '';
 
diff --git a/pkgs/applications/version-management/smartgithg/default.nix b/pkgs/applications/version-management/smartgithg/default.nix
index d6ae37c3f7f..d03353599d9 100644
--- a/pkgs/applications/version-management/smartgithg/default.nix
+++ b/pkgs/applications/version-management/smartgithg/default.nix
@@ -1,4 +1,5 @@
 { stdenv, fetchurl, lib, makeWrapper
+, substituteAll
 , jre
 , gtk2, glib
 , libXtst
@@ -21,7 +22,10 @@ stdenv.mkDerivation rec {
   buildCommand = let
     pkg_path = "$out/${name}";
     bin_path = "$out/bin";
-    install_freedesktop_items = ./install_freedesktop_items.sh;
+    install_freedesktop_items = substituteAll {
+      inherit (stdenv) shell;
+      src = ./install_freedesktop_items.sh;
+    };
     runtime_paths = lib.makeBinPath [
       jre
       #git mercurial subversion # the paths are requested in configuration
diff --git a/pkgs/applications/version-management/smartgithg/install_freedesktop_items.sh b/pkgs/applications/version-management/smartgithg/install_freedesktop_items.sh
index 66fb0cf8f95..2ff14dcf099 100755
--- a/pkgs/applications/version-management/smartgithg/install_freedesktop_items.sh
+++ b/pkgs/applications/version-management/smartgithg/install_freedesktop_items.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 inBinDir=$1
 out=$2
diff --git a/pkgs/applications/video/zdfmediathk/default.nix b/pkgs/applications/video/zdfmediathk/default.nix
index a875daf065e..befbfb2d630 100644
--- a/pkgs/applications/video/zdfmediathk/default.nix
+++ b/pkgs/applications/video/zdfmediathk/default.nix
@@ -21,7 +21,7 @@ mkDerivation rec {
     install -m644 -t $out/share/licenses Copyright/{*.*,_copyright}
     bin="$out/bin/mediathek"
     cat >> "$bin" << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec ${jre}/bin/java -cp "$out/lib/*" -Xms128M -Xmx1G -jar "$out/MediathekView.jar" "\$@"
     EOF
     chmod +x "$bin"
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index 968d998792d..93b33a1eea1 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -86,14 +86,14 @@ stdenv.mkDerivation (rec {
 
     # Fake git: just print what it wants and die
     cat > fake-bin/wget << EOF
-    #!/bin/sh -e
+    #!${stdenv.shell} -e
     echo ===== FAKE WGET: Not fetching \$*
     [ -e \$3 ]
     EOF
 
     # Fake git: just print what it wants and die
     cat > fake-bin/git << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     echo ===== FAKE GIT: Not cloning \$*
     [ -e \$3 ]
     EOF
@@ -109,7 +109,7 @@ stdenv.mkDerivation (rec {
     # (prefetched stuff has lots of files)
     find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
     find . -type f -not -path "./tools/hotplug/Linux/xendomains.in" \
-      | xargs sed -i 's@/bin/bash@/bin/sh@g'
+      | xargs sed -i 's@/bin/bash@${stdenv.shell}@g'
 
     # Get prefetched stuff
     ${withXenfiles (name: x: ''
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index b3a4b774b12..6de38821baf 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -22,7 +22,8 @@
   referencesByPopularity,
   writeScript,
   writeText,
-  closureInfo
+  closureInfo,
+  substituteAll
 }:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
@@ -279,6 +280,12 @@ rec {
     # of room for extension
     maxLayers ? 24
   }:
+    let
+      storePathToLayer = substituteAll
+      { inherit (stdenv) shell;
+        src = ./store-path-to-layer.sh;
+      };
+    in
     runCommand "${name}-granular-docker-layers" {
       inherit maxLayers;
       paths = referencesByPopularity closure;
@@ -298,9 +305,9 @@ rec {
       # following head and tail call lines, double-check that your
       # code behaves properly when the number of layers equals:
       #      maxLayers-1, maxLayers, and maxLayers+1
-      head -n $((maxLayers - 1)) $paths | cat -n | xargs -P$NIX_BUILD_CORES -n2 ${./store-path-to-layer.sh}
+      head -n $((maxLayers - 1)) $paths | cat -n | xargs -P$NIX_BUILD_CORES -n2 ${storePathToLayer}
       if [ $(cat $paths | wc -l) -ge $maxLayers ]; then
-        tail -n+$maxLayers $paths | xargs ${./store-path-to-layer.sh} $maxLayers
+        tail -n+$maxLayers $paths | xargs ${storePathToLayer} $maxLayers
       fi
 
       echo "Finished building layer '$name'"
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 7880d98e6b6..bd4465e93a1 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -164,7 +164,7 @@ rec {
     # Set up automatic kernel module loading.
     export MODULE_DIR=${linux}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
-    #! /bin/sh
+    #! ${bash}/bin/sh
     export MODULE_DIR=$MODULE_DIR
     exec ${kmod}/bin/modprobe "\$@"
     EOF
diff --git a/pkgs/data/misc/geolite-legacy/builder.sh b/pkgs/data/misc/geolite-legacy/builder.sh
index c3e09e8543c..683b2e8606b 100644
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ b/pkgs/data/misc/geolite-legacy/builder.sh
@@ -1,5 +1,3 @@
-#!/bin/sh -e
-
 source "$stdenv/setup"
 
 mkdir -p $out/share/GeoIP
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 2b2ae896a6d..3d9fe3a59cf 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ln -s $out/opt/cmdstan/bin/stanc $out/bin/stanc
     ln -s $out/opt/cmdstan/bin/stansummary $out/bin/stansummary
     cat > $out/bin/stan <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     make -C $out/opt/cmdstan "\$(realpath "\$1")"
     EOF
     chmod a+x $out/bin/stan
diff --git a/pkgs/development/compilers/fsharp/default.nix b/pkgs/development/compilers/fsharp/default.nix
index f9f083f04d7..2de487cc9c8 100644
--- a/pkgs/development/compilers/fsharp/default.nix
+++ b/pkgs/development/compilers/fsharp/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     sed -i '988d' src/FSharpSource.targets
-    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "/bin/sh"
+    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "${stdenv.shell}"
     ./autogen.sh --prefix $out
   '';
 
diff --git a/pkgs/development/compilers/fsharp41/default.nix b/pkgs/development/compilers/fsharp41/default.nix
index 3ce7ae60e11..e0094c73098 100644
--- a/pkgs/development/compilers/fsharp41/default.nix
+++ b/pkgs/development/compilers/fsharp41/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   configurePhase = ''
-    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "/bin/sh"
+    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "${stdenv.shell}"
     ./autogen.sh --prefix $out
   '';
 
diff --git a/pkgs/development/compilers/ghc/8.2.2-binary.nix b/pkgs/development/compilers/ghc/8.2.2-binary.nix
index f52d8fd4a11..678245d3e43 100644
--- a/pkgs/development/compilers/ghc/8.2.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.2.2-binary.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ stdenv, substituteAll
 , fetchurl, perl, gcc, llvm_39
 , ncurses5, gmp, glibc, libiconv
 }:
@@ -110,10 +110,16 @@ stdenv.mkDerivation rec {
     '';
 
   configurePlatforms = [ ];
-  configureFlags = [
-    "--with-gmp-libraries=${stdenv.lib.getLib gmp}/lib"
+  configureFlags =
+  let
+    gcc-clang-wrapper = substituteAll {
+      inherit (stdenv) shell;
+      src = ./gcc-clang-wrapper.sh;
+    };
+  in
+  [ "--with-gmp-libraries=${stdenv.lib.getLib gmp}/lib"
     "--with-gmp-includes=${stdenv.lib.getDev gmp}/include"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"
+  ] ++ stdenv.lib.optional stdenv.isDarwin            "--with-gcc=${gcc-clang-wrapper}"
     ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-ld-override";
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
index d081be231a1..45af982c297 100755
--- a/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
+++ b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 inPreprocessorMode () {
     hasE=0
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 19b16921e32..93ab703d975 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -98,7 +98,7 @@ let
     preConfigure = ''
       chmod +x configure
       substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
-      substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "$shell"
+      substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "${stdenv.shell}"
       substituteInPlace hotspot/make/linux/makefiles/dtrace.make --replace /usr/include/sys/sdt.h "/no-such-path"
     ''
     # https://bugzilla.redhat.com/show_bug.cgi?id=1306558
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index b65dfb1d4a1..433271d9c85 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -115,6 +115,6 @@
 
 (stdenv.lib.optionalAttrs (!stdenv.isLinux) {
   # Work around <https://bugs.gnu.org/14201>.
-  SHELL = "/bin/sh";
-  CONFIG_SHELL = "/bin/sh";
+  SHELL = "${stdenv.shell}";
+  CONFIG_SHELL = "${stdenv.shell}";
 })
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 4e43ef91e79..07c0f8cb1b4 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     # build-time scripts
-    substituteInPlace run.in        --replace '#!/bin/bash' '#!/bin/sh'
-    substituteInPlace ocaml-link.sh --replace '#!/bin/bash' '#!/bin/sh'
+    substituteInPlace run.in        --replace '#!/bin/bash' '#!${stdenv.shell}'
+    substituteInPlace ocaml-link.sh --replace '#!/bin/bash' '#!${stdenv.shell}'
 
     # $(OCAMLLIB) is read-only "${ocamlPackages.ocaml}/lib/ocaml"
     substituteInPlace ocaml/Makefile.am            --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'
diff --git a/pkgs/development/lisp-modules/define-package.nix b/pkgs/development/lisp-modules/define-package.nix
index 390e0e06112..49eb9c40344 100644
--- a/pkgs/development/lisp-modules/define-package.nix
+++ b/pkgs/development/lisp-modules/define-package.nix
@@ -41,7 +41,7 @@ let
     mkdir -p "$(dirname "$launch_script")"
     touch "$launch_script"
     chmod a+x "$launch_script"
-    echo "#! /bin/sh" >> "$launch_script"
+    echo "#! ${stdenv.shell}" >> "$launch_script"
     echo "source '$config_script'" >> "$launch_script"
     echo "test -n \"\$NIX_LISP_LD_LIBRARY_PATH\" export LD_LIBRARY_PATH=\"\$NIX_LISP_LD_LIBRARY_PATH\''${LD_LIBRARY_PATH:+:}\$LD_LIBRARY_PATH\"" >> "$launch_script"
     echo '"${clwrapper}/bin/common-lisp.sh" "$@"' >> "$launch_script"
diff --git a/pkgs/development/misc/avr8-burn-omat/default.nix b/pkgs/development/misc/avr8-burn-omat/default.nix
index 692f61cec74..4ddab380825 100644
--- a/pkgs/development/misc/avr8-burn-omat/default.nix
+++ b/pkgs/development/misc/avr8-burn-omat/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     mkdir -p $out/{nix-support,bin}
     mv *.jar license_gpl-3.0.txt lib *.xml *.png $out/nix-support
     cat >> $out/bin/avr8-burn-omat << EOF
-      #!/bin/sh
+      #!${stdenv.shell}
       cd $out/nix-support; exec java -jar AVR8_Burn_O_Mat.jar
     EOF
     chmod +x $out/bin/avr8-burn-omat
diff --git a/pkgs/development/pharo/vm/build-vm.nix b/pkgs/development/pharo/vm/build-vm.nix
index c67e5a9489b..76e52692383 100644
--- a/pkgs/development/pharo/vm/build-vm.nix
+++ b/pkgs/development/pharo/vm/build-vm.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
     # Create the script
     cat > "$out/bin/${cmd}" <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     set -f
     LD_LIBRARY_PATH="\$LD_LIBRARY_PATH:$libs" exec $out/pharo "\$@"
     EOF
diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index 019ab4e6cdd..6416b0176ed 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   postPatch = stdenv.lib.optional stdenv.isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
     mkdir bin
-    echo '#/bin/sh' > bin/pbpaste
-    echo '#/bin/sh' > bin/pbcopy
+    echo '#${stdenv.shell}' > bin/pbpaste
+    echo '#${stdenv.shell}' > bin/pbcopy
     chmod +x bin/{pbcopy,pbpaste}
     export PATH=$(realpath bin):$PATH
   '';
diff --git a/pkgs/development/python-modules/cmd2/old.nix b/pkgs/development/python-modules/cmd2/old.nix
index 7778e73f92f..c6ee1eaf8bc 100644
--- a/pkgs/development/python-modules/cmd2/old.nix
+++ b/pkgs/development/python-modules/cmd2/old.nix
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   postPatch = stdenv.lib.optional stdenv.isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
     mkdir bin
-    echo '#/bin/sh' > bin/pbpaste
-    echo '#/bin/sh' > bin/pbcopy
+    echo '#${stdenv.shell}' > bin/pbpaste
+    echo '#${stdenv.shell}' > bin/pbcopy
     chmod +x bin/{pbcopy,pbpaste}
     export PATH=$(realpath bin):$PATH
   '';
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 839e7f1e819..c489b2cd125 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -96,8 +96,8 @@ in buildPythonPackage rec {
   #       Until then we disable the tests.
   + optionalString isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
-    echo "#!/bin/sh" > pbcopy
-    echo "#!/bin/sh" > pbpaste
+    echo "#!${stdenv.shell}" > pbcopy
+    echo "#!${stdenv.shell}" > pbpaste
     chmod a+x pbcopy pbpaste
     export PATH=$(pwd):$PATH
   '' + ''
diff --git a/pkgs/development/tools/misc/ctags/wrapped.nix b/pkgs/development/tools/misc/ctags/wrapped.nix
index 75ae9f1ba8b..ed265b4489b 100644
--- a/pkgs/development/tools/misc/ctags/wrapped.nix
+++ b/pkgs/development/tools/misc/ctags/wrapped.nix
@@ -14,7 +14,7 @@ with pkgs.stdenv.lib;
 
   # the derivation. use language extensions specified by args
   ctagsWrapped = makeOverridable ( {args, name} :  pkgs.writeScriptBin name ''
-  #!/bin/sh
+  #!${stdenv.shell}
   exec ${pkgs.ctags}/bin/ctags ${concatStringsSep " " (map escapeShellArg args)} "$@"
   '') {
     args = let x = pkgs.ctagsWrapped; in concatLists [
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index cef399eb5c1..e80a37d37dd 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -53,7 +53,7 @@ let
           mkdir -p $out/bin
           if [ -x "${gcc.cc}/bin/gcc" ]; then
             cat > $out/bin/gcc << EOF
-            #!/bin/sh
+            #!${stdenv.shell}
             ${extraConfig}
             exec ${distcc}/bin/distcc gcc "\$@"
           EOF
@@ -61,7 +61,7 @@ let
           fi
           if [ -x "${gcc.cc}/bin/g++" ]; then
             cat > $out/bin/g++ << EOF
-            #!/bin/sh
+            #!${stdenv.shell}
             ${extraConfig}
             exec ${distcc}/bin/distcc g++ "\$@"
           EOF
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index c8fdf246bcf..f7b77cdc418 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out
     cp -a * $out/
     substituteInPlace $out/bin/OpenGrok --replace "/bin/uname" "${coreutils}/bin/uname"
-    substituteInPlace $out/bin/Messages --replace "#!/bin/ksh" "#!/bin/sh"
+    substituteInPlace $out/bin/Messages --replace "#!/bin/ksh" "#!${stdenv.shell}"
     wrapProgram $out/bin/OpenGrok \
       --prefix PATH : "${stdenv.lib.makeBinPath [ ctags git ]}" \
       --set JAVA_HOME "${jre}" \
diff --git a/pkgs/games/andyetitmoves/default.nix b/pkgs/games/andyetitmoves/default.nix
index 97cbe616c57..123d4296c97 100644
--- a/pkgs/games/andyetitmoves/default.nix
+++ b/pkgs/games/andyetitmoves/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
     patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
     cat > $out/bin/$binName << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/opt/andyetitmoves
     exec ./lib/$binName
     EOF
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 502a554bae2..859e503e101 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     # Make wrapper script
     cat > eduke32-wrapper <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     if [ "$EDUKE32_DATA_DIR" = "" ]; then
         EDUKE32_DATA_DIR=/var/lib/games/eduke32
diff --git a/pkgs/games/freeorion/default.nix b/pkgs/games/freeorion/default.nix
index a9ebd994bb8..5895e87e731 100644
--- a/pkgs/games/freeorion/default.nix
+++ b/pkgs/games/freeorion/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
       --subst-var-by out "$out/"
     substitute ${./fix-paths.sh} $out/fixpaths/fix-paths \
       --subst-var-by libxsltBin ${libxslt.bin} \
+      --subst-var-by shell ${stdenv.shell} \
       --subst-var out
     chmod +x $out/fixpaths/fix-paths
 
diff --git a/pkgs/games/freeorion/fix-paths.sh b/pkgs/games/freeorion/fix-paths.sh
index 73a3bd6feda..3f82533dd60 100644
--- a/pkgs/games/freeorion/fix-paths.sh
+++ b/pkgs/games/freeorion/fix-paths.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 if [ -e ~/.config/freeorion/config.xml ]; then
   @libxsltBin@/bin/xsltproc -o ~/.config/freeorion/config.xml @out@/fixpaths/fix-paths.xslt ~/.config/freeorion/config.xml
diff --git a/pkgs/games/gargoyle/darwin.sh b/pkgs/games/gargoyle/darwin.sh
index 9bd45d0b1d5..ed0daec4ef1 100644
--- a/pkgs/games/gargoyle/darwin.sh
+++ b/pkgs/games/gargoyle/darwin.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 set -e
 
diff --git a/pkgs/games/gargoyle/default.nix b/pkgs/games/gargoyle/default.nix
index 5bf0ae1c814..c908a9b75a9 100644
--- a/pkgs/games/gargoyle/default.nix
+++ b/pkgs/games/gargoyle/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, jam, cctools, pkgconfig
+{ stdenv, fetchFromGitHub, substituteAll, jam, cctools, pkgconfig
 , SDL, SDL_mixer, SDL_sound, cf-private, gtk2, libvorbis, smpeg }:
 
 let
@@ -29,16 +29,19 @@ stdenv.mkDerivation {
     sha256 = "0icwgc25gp7krq6zf66hljydc6vps6bb4knywnrfgnfcmcalqqx9";
   };
 
-  nativeBuildInputs = [ jam pkgconfig ] ++ lib.optional stdenv.isDarwin cctools;
+  nativeBuildInputs = [ jam pkgconfig ] ++ stdenv.lib.optional stdenv.isDarwin cctools;
 
   buildInputs = [ SDL SDL_mixer SDL_sound gtk2 ]
-    ++ lib.optionals stdenv.isDarwin [ cf-private smpeg libvorbis ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ cf-private smpeg libvorbis ];
 
   patches = [ ./darwin.patch ];
 
   buildPhase = jamenv + "jam -j$NIX_BUILD_CORES";
 
-  installPhase = if stdenv.isDarwin then (builtins.readFile ./darwin.sh) else jamenv + ''
+  installPhase =
+  if stdenv.isDarwin then
+    (substituteAll { inherit (stdenv) shell; src = ./darwin.sh; })
+  else jamenv + ''
     jam -j$NIX_BUILD_CORES install
     mkdir -p "$out/bin"
     ln -s ../libexec/gargoyle/gargoyle "$out/bin"
@@ -52,7 +55,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     homepage = http://ccxvii.net/gargoyle/;
     license = licenses.gpl2Plus;
     description = "Interactive fiction interpreter GUI";
diff --git a/pkgs/games/mars/default.nix b/pkgs/games/mars/default.nix
index 2d2a31dd812..668605a9ae1 100644
--- a/pkgs/games/mars/default.nix
+++ b/pkgs/games/mars/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp -rv data resources credits.txt license.txt "$out/share/mars/"
     cp -v mars "$out/bin/mars.bin"
     cat << EOF > "$out/bin/mars"
-    #! /bin/sh
+    #! ${stdenv.shell}
     cd "$out/share/mars/"
     exec "$out/bin/mars.bin" "\$@"
     EOF
diff --git a/pkgs/games/minecraft-server/default.nix b/pkgs/games/minecraft-server/default.nix
index 050e0126fa7..97e0a5b81fd 100644
--- a/pkgs/games/minecraft-server/default.nix
+++ b/pkgs/games/minecraft-server/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     cp -v $src $out/lib/minecraft/server.jar
 
     cat > $out/bin/minecraft-server << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec ${jre}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
     EOF
 
diff --git a/pkgs/games/oilrush/default.nix b/pkgs/games/oilrush/default.nix
index 319cdb610ca..2d636064205 100644
--- a/pkgs/games/oilrush/default.nix
+++ b/pkgs/games/oilrush/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
     cp -r * "$out/opt/oilrush"
     mkdir -p "$out/bin"
     cat << EOF > "$out/bin/oilrush"
-    #! /bin/sh
+    #!${stdenv.shell}
     LD_LIBRARY_PATH=.:${makeLibraryPath [ openal ]}:\$LD_LIBRARY_PATH
     cd "$out/opt/oilrush"
     exec ./launcher_$arch.sh "\$@"
diff --git a/pkgs/games/openttd/default.nix b/pkgs/games/openttd/default.nix
index 78fdb32b436..e5243aef2d3 100644
--- a/pkgs/games/openttd/default.nix
+++ b/pkgs/games/openttd/default.nix
@@ -21,7 +21,7 @@ let
   };
 
   playmidi = writeScriptBin "playmidi" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     trap "${procps}/bin/pkill fluidsynth" EXIT
     ${fluidsynth}/bin/fluidsynth -a ${audioDriver} -i ${soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2 $*
   '';
diff --git a/pkgs/games/tremulous/default.nix b/pkgs/games/tremulous/default.nix
index ce30be7be0b..fd1a3e178d5 100644
--- a/pkgs/games/tremulous/default.nix
+++ b/pkgs/games/tremulous/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     for b in tremulous tremded
     do
         cat << EOF > $out/bin/$b
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/opt/tremulous
     exec ./$b.$arch "\$@"
     EOF
diff --git a/pkgs/games/trigger/default.nix b/pkgs/games/trigger/default.nix
index fc6a45ace57..85157d8df18 100644
--- a/pkgs/games/trigger/default.nix
+++ b/pkgs/games/trigger/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/bin
     cat <<EOF > $out/bin/trigger-rally
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $out/games/trigger-rally "$@"
     EOF
     chmod +x $out/bin/trigger-rally
diff --git a/pkgs/games/vessel/default.nix b/pkgs/games/vessel/default.nix
index ab6f1ca765c..83fce64ca32 100644
--- a/pkgs/games/vessel/default.nix
+++ b/pkgs/games/vessel/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     done
 
     cat > $out/bin/Vessel << EOW
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/libexec/strangeloop/vessel/
     exec ./x86/vessel.x86
     EOW
diff --git a/pkgs/games/worldofgoo/default.nix b/pkgs/games/worldofgoo/default.nix
index ad86072dd1c..97bfd9e730c 100644
--- a/pkgs/games/worldofgoo/default.nix
+++ b/pkgs/games/worldofgoo/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     #makeWrapper doesn't do cd. :(
 
     cat > $out/bin/WorldofGoo << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/libexec/2dboy/WorldOfGoo
     exec ./WorldOfGoo.bin64
     EOF
diff --git a/pkgs/games/zangband/default.nix b/pkgs/games/zangband/default.nix
index 6fab4982534..3d5da239115 100644
--- a/pkgs/games/zangband/default.nix
+++ b/pkgs/games/zangband/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     mv $out/bin/zangband $out/bin/.zangband.real
-    echo '#! /bin/sh
+    echo '#! ${stdenv.shell}
       PATH="$PATH:${coreutils}/bin"
 
       ZANGBAND_PATH="$HOME/.zangband"
diff --git a/pkgs/misc/cups/drivers/mfcj6510dwlpr/default.nix b/pkgs/misc/cups/drivers/mfcj6510dwlpr/default.nix
index ff71df5dc1b..607e3c2c57f 100644
--- a/pkgs/misc/cups/drivers/mfcj6510dwlpr/default.nix
+++ b/pkgs/misc/cups/drivers/mfcj6510dwlpr/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   unpackPhase = "true";
 
   brprintconf_mfcj6510dw_script = ''
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $(mktemp -d)
     ln -s @out@/usr/bin/brprintconf_mfcj6510dw_patched brprintconf_mfcj6510dw_patched
     ln -s @out@/opt/brother/Printers/mfcj6510dw/inf/brmfcj6510dwfunc brmfcj6510dwfunc
diff --git a/pkgs/misc/drivers/foomatic-filters/default.nix b/pkgs/misc/drivers/foomatic-filters/default.nix
index 99286d5f204..580b473b0cd 100644
--- a/pkgs/misc/drivers/foomatic-filters/default.nix
+++ b/pkgs/misc/drivers/foomatic-filters/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
-      substituteInPlace foomaticrip.c --replace /bin/bash /bin/sh
+      substituteInPlace foomaticrip.c --replace /bin/bash ${stdenv.shell}
     '';
 
   installTargets = "install-cups";
diff --git a/pkgs/misc/emulators/retrofe/default.nix b/pkgs/misc/emulators/retrofe/default.nix
index 40c1fcc6fde..fa2121f5bc1 100644
--- a/pkgs/misc/emulators/retrofe/default.nix
+++ b/pkgs/misc/emulators/retrofe/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     mv $out/share/retrofe/example/retrofe $out/bin/
 
     cat > $out/bin/retrofe-init << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo "This will install retrofe's example files into this directory"
     echo "Example files location: $out/share/retrofe/example/"
diff --git a/pkgs/misc/emulators/wine/builder-wow.sh b/pkgs/misc/emulators/wine/builder-wow.sh
index 1aad9fe20c7..c006db3116b 100644
--- a/pkgs/misc/emulators/wine/builder-wow.sh
+++ b/pkgs/misc/emulators/wine/builder-wow.sh
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 ## build described at http://wiki.winehq.org/Wine64
 
 source $stdenv/setup
diff --git a/pkgs/misc/vim-plugins/vim-utils.nix b/pkgs/misc/vim-plugins/vim-utils.nix
index cf5eeaec3e3..9216c4a4eb7 100644
--- a/pkgs/misc/vim-plugins/vim-utils.nix
+++ b/pkgs/misc/vim-plugins/vim-utils.nix
@@ -362,7 +362,7 @@ rec {
   vimWithRC = {vimExecutable, name ? null, vimrcFile ? null, gvimrcFile ? null}:
     let rcOption = o: file: stdenv.lib.optionalString (file != null) "-${o} ${file}";
     in writeScriptBin (if name == null then "vim" else name) ''
-      #!/bin/sh
+      #!${stdenv.shell}
       exec ${vimExecutable} ${rcOption "u" vimrcFile} ${rcOption "U" gvimrcFile} "$@"
       '';
 
diff --git a/pkgs/os-specific/linux/alsa-plugins/wrapper.nix b/pkgs/os-specific/linux/alsa-plugins/wrapper.nix
index 60262a14c9b..769b6ecd9bf 100644
--- a/pkgs/os-specific/linux/alsa-plugins/wrapper.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/wrapper.nix
@@ -1,5 +1,5 @@
 { writeScriptBin, stdenv, alsaPlugins }:
 writeScriptBin "ap${if stdenv.hostPlatform.system == "i686-linux" then "32" else "64"}" ''
-  #/bin/sh
+  #${stdenv.shell}
   ALSA_PLUGIN_DIRS=${alsaPlugins}/lib/alsa-lib "$@"
 ''
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index f5d3b4f5c4e..f5bc7458240 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -36,12 +36,12 @@ stdenv.mkDerivation {
 
     mkdir -p $out/bin
     tee $out/bin/discrete_vga_poweroff << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo -n OFF > /proc/acpi/bbswitch
     EOF
     tee $out/bin/discrete_vga_poweron << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo -n ON > /proc/acpi/bbswitch
     EOF
diff --git a/pkgs/os-specific/linux/ofp/default.nix b/pkgs/os-specific/linux/ofp/default.nix
index 3b2a22e452d..93cf33979f4 100644
--- a/pkgs/os-specific/linux/ofp/default.nix
+++ b/pkgs/os-specific/linux/ofp/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace configure.ac --replace m4_esyscmd m4_esyscmd_s
-    substituteInPlace scripts/git_hash.sh --replace /bin/bash /bin/sh
+    substituteInPlace scripts/git_hash.sh --replace /bin/bash ${stdenv.shell}
     echo ${version} > .scmversion
   '';
 
diff --git a/pkgs/os-specific/linux/rfkill/rfkill-hook.sh b/pkgs/os-specific/linux/rfkill/rfkill-hook.sh
index bf6e679660c..75716e40dae 100755
--- a/pkgs/os-specific/linux/rfkill/rfkill-hook.sh
+++ b/pkgs/os-specific/linux/rfkill/rfkill-hook.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 # Executes a hook in case of a change to the
 # rfkill state. The hook can be passed as
diff --git a/pkgs/os-specific/linux/rfkill/udev.nix b/pkgs/os-specific/linux/rfkill/udev.nix
index 054ed471eaa..de23071f026 100644
--- a/pkgs/os-specific/linux/rfkill/udev.nix
+++ b/pkgs/os-specific/linux/rfkill/udev.nix
@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, substituteAll }:
 
 # Provides a facility to hook into rfkill changes.
 #
@@ -10,7 +10,7 @@
 # Add a hook script in the managed etc directory, e.g.:
 #   etc = [
 #     { source = pkgs.writeScript "rtfkill.hook" ''
-#         #!/bin/sh
+#         #!${stdenv.shell}
 #
 #         if [ "$RFKILL_STATE" -eq "1" ]; then
 #           exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-on
@@ -24,7 +24,13 @@
 # Note: this package does not need the binaries
 # in the rfkill package.
 
-stdenv.mkDerivation {
+let
+  rfkillHook =
+    substituteAll {
+    inherit (stdenv) shell;
+    src = ./rfkill-hook.sh;
+  };
+in stdenv.mkDerivation {
   name = "rfkill-udev";
 
   unpackPhase = "true";
@@ -37,7 +43,7 @@ stdenv.mkDerivation {
     EOF
 
     mkdir -p "$out/bin/";
-    cp ${./rfkill-hook.sh} "$out/bin/rfkill-hook.sh"
+    cp ${rfkillHook} "$out/bin/rfkill-hook.sh"
     chmod +x "$out/bin/rfkill-hook.sh";
   '';
 
@@ -46,4 +52,4 @@ stdenv.mkDerivation {
     description = "Rules+hook for udev to catch rfkill state changes";
     platforms = stdenv.lib.platforms.linux;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/os-specific/linux/service-wrapper/default.nix b/pkgs/os-specific/linux/service-wrapper/default.nix
index 64e38b41a5f..6c9635b3aee 100644
--- a/pkgs/os-specific/linux/service-wrapper/default.nix
+++ b/pkgs/os-specific/linux/service-wrapper/default.nix
@@ -1,4 +1,4 @@
-{ lib, runCommand, substituteAll, coreutils }:
+{ stdenv, runCommand, substituteAll, coreutils }:
 
 let
   name = "service-wrapper-${version}";
@@ -7,10 +7,11 @@ in
 runCommand "${name}" {
   script = substituteAll {
     src = ./service-wrapper.sh;
+    inherit (stdenv) shell;
     inherit coreutils;
   };
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A convenient wrapper for the systemctl commands, borrow from Ubuntu";
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
index 373d86443f0..460bf678e6a 100755
--- a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
+++ b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 ###########################################################################
 # /usr/bin/service
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index 89c6639748d..6ad232e0b1d 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
-    "SHELL=/bin/sh"
+    "SHELL=${stdenv.shell}"
     "HDAPS=1"
   ];
 
diff --git a/pkgs/servers/mail/system-sendmail/default.nix b/pkgs/servers/mail/system-sendmail/default.nix
index 0e290f13518..fe0aeb5b3af 100644
--- a/pkgs/servers/mail/system-sendmail/default.nix
+++ b/pkgs/servers/mail/system-sendmail/default.nix
@@ -1,7 +1,7 @@
 { stdenv, writeText }:
 
 let script = writeText "script" ''
-  #!/bin/sh
+  #!${stdenv.shell}
 
   if command -v sendmail > /dev/null 2>&1 && [ "$(command -v sendmail)" != "{{MYPATH}}" ]; then
     exec sendmail "$@"
diff --git a/pkgs/servers/web-apps/codimd/default.nix b/pkgs/servers/web-apps/codimd/default.nix
index e9f5e089872..c48a9f938bd 100644
--- a/pkgs/servers/web-apps/codimd/default.nix
+++ b/pkgs/servers/web-apps/codimd/default.nix
@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cat > $out/bin/codimd <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs-6_x}/bin/node $out/app.js
     EOF
     cp -R {app.js,bin,lib,locales,package.json,public} $out/
diff --git a/pkgs/servers/x11/xquartz/default.nix b/pkgs/servers/x11/xquartz/default.nix
index 8cb96d0ae39..22f6ce45673 100644
--- a/pkgs/servers/x11/xquartz/default.nix
+++ b/pkgs/servers/x11/xquartz/default.nix
@@ -123,6 +123,7 @@ in stdenv.mkDerivation {
 
     cp ${./startx} $out/bin/startx
     substituteInPlace $out/bin/startx \
+      --replace "@shell@"             "${stdenv.shell}" \
       --replace "@PATH@"              "$out/bin:${env}" \
       --replace "@XAUTH@"             "${xorg.xauth}/bin/xauth" \
       --replace "@FONT_CACHE@"        "$out/bin/font_cache" \
@@ -153,12 +154,14 @@ in stdenv.mkDerivation {
     mkdir -p $out/lib/X11/xinit/privileged_startx.d
     cp ${./privileged} $out/lib/X11/xinit/privileged_startx.d/privileged
     substituteInPlace $out/lib/X11/xinit/privileged_startx.d/privileged \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@FONTCONFIG_FILE@" "$fontsConfPath" \
       --replace "@FONT_CACHE@"      "$out/bin/font_cache"
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@ENCODINGSDIR@"    "${xorg.encodings}/share/fonts/X11/encodings" \
       --replace "@MKFONTDIR@"       "${xorg.mkfontdir}/bin/mkfontdir" \
@@ -168,6 +171,7 @@ in stdenv.mkDerivation {
 
     cp ${./xinitrc} $out/etc/X11/xinit/xinitrc
     substituteInPlace $out/etc/X11/xinit/xinitrc \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@XSET@"            "${xorg.xset}/bin/xset" \
       --replace "@XMODMAP@"         "${xorg.xmodmap}/bin/xmodmap" \
@@ -178,6 +182,7 @@ in stdenv.mkDerivation {
 
     cp ${./X11} $out/Applications/XQuartz.app/Contents/MacOS/X11
     substituteInPlace $out/Applications/XQuartz.app/Contents/MacOS/X11 \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@DEFAULT_SHELL@"   "${shell}" \
       --replace "@DEFAULT_STARTX@"  "$defaultStartX" \
       --replace "@DEFAULT_CLIENT@"  "${xterm}/bin/xterm" \
diff --git a/pkgs/servers/x11/xquartz/privileged b/pkgs/servers/x11/xquartz/privileged
index 3eee9479411..9d9c802002b 100755
--- a/pkgs/servers/x11/xquartz/privileged
+++ b/pkgs/servers/x11/xquartz/privileged
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 export PATH=@PATH@:$PATH
 export FONTCONFIG_FILE="@FONTCONFIG_FILE@"
diff --git a/pkgs/servers/x11/xquartz/startx b/pkgs/servers/x11/xquartz/startx
index e908e1042d7..b4afebce57c 100755
--- a/pkgs/servers/x11/xquartz/startx
+++ b/pkgs/servers/x11/xquartz/startx
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 # vim :set ts=4 sw=4 sts=4 et :
 
diff --git a/pkgs/servers/x11/xquartz/xinitrc b/pkgs/servers/x11/xquartz/xinitrc
index 1a0c2ccf1c0..276aeca7c84 100755
--- a/pkgs/servers/x11/xquartz/xinitrc
+++ b/pkgs/servers/x11/xquartz/xinitrc
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 export PATH=@PATH@:$PATH
 
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index 7b7d5d1aeed..a84f101cdf7 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patchPhase =
     '' for i in `find cnee/test -name \*.sh`
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g ; s|/usr/bin/env bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g ; s|/usr/bin/env bash|${stdenv.shell}|g'
        done
     '';
 
diff --git a/pkgs/tools/archivers/rpmextract/default.nix b/pkgs/tools/archivers/rpmextract/default.nix
index 8d4d5fd8ddd..6d5041c52d0 100644
--- a/pkgs/tools/archivers/rpmextract/default.nix
+++ b/pkgs/tools/archivers/rpmextract/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   script = substituteAll {
     src = ./rpmextract.sh;
     inherit rpm cpio;
+    inherit (stdenv) shell;
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/archivers/rpmextract/rpmextract.sh b/pkgs/tools/archivers/rpmextract/rpmextract.sh
index 04f57f6e604..6ebfa251955 100644
--- a/pkgs/tools/archivers/rpmextract/rpmextract.sh
+++ b/pkgs/tools/archivers/rpmextract/rpmextract.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!@shell@ -e
 
 if [ "$1" = "" ]; then
   echo "usage: rpmextract package_name..." 1>&2
diff --git a/pkgs/tools/backup/flockit/default.nix b/pkgs/tools/backup/flockit/default.nix
index e569d9b6d59..e6284aa42d7 100644
--- a/pkgs/tools/backup/flockit/default.nix
+++ b/pkgs/tools/backup/flockit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp ./libflockit.so $out/lib
 
     (cat <<EOI
-    #!/bin/sh
+    #!${stdenv.shell}
     env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
     EOI
     ) > $out/bin/flockit
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 5f44e19fdf2..7324f75d95f 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -9,7 +9,7 @@
 
 # known impurity: test cases seem to bu using /tmp/storeBackup.lock ..
 
-let dummyMount = writeScriptBin "mount" "#!/bin/sh";
+let dummyMount = writeScriptBin "mount" "#!${stdenv.shell}";
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/graphics/briss/default.nix b/pkgs/tools/graphics/briss/default.nix
index a5045f97b45..fb9b7cae488 100644
--- a/pkgs/tools/graphics/briss/default.nix
+++ b/pkgs/tools/graphics/briss/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin";
     mkdir -p "$out/share";
     install -D -m444 -t "$out/share" *.jar
-    echo "#!/bin/sh" > "$out/bin/briss"
+    echo "#!${stdenv.shell}" > "$out/bin/briss"
     echo "${jre}/bin/java -Xms128m -Xmx1024m -cp \"$out/share/\" -jar \"$out/share/briss-${version}.jar\"" >> "$out/bin/briss"
     chmod +x "$out/bin/briss"
   '';
diff --git a/pkgs/tools/graphics/povray/default.nix b/pkgs/tools/graphics/povray/default.nix
index 76829b6b727..dc9d9630ae5 100644
--- a/pkgs/tools/graphics/povray/default.nix
+++ b/pkgs/tools/graphics/povray/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir "$TMP/bin"
     for i in chown chgrp; do
-      echo '#!/bin/sh' >> "$TMP/bin/$i"
+      echo '#!${stdenv.shell}' >> "$TMP/bin/$i"
       chmod +x "$TMP/bin/$i"
       PATH="$TMP/bin:$PATH"
     done
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index a882fe9a9ba..08efe3e6e18 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -47,7 +47,7 @@ buildGoPackage rec {
 
     cp -R $src/shell $bin/share/fzf
     cat <<SCRIPT > $bin/bin/fzf-share
-    #!/bin/sh
+    #!${stdenv.shell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $bin/share/fzf
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index d5079750859..2a8734822ac 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 94beff8dfe3..ca4e477adce 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 4d91c184b0a..4428bf1e625 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = [ "-lX11" ];
   patchPhase = ''
     cd src
-    substituteInPlace config --replace /bin/bash /bin/sh
+    substituteInPlace config --replace /bin/bash ${stdenv.shell}
     mkdir -p $out
     export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
   '';
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index e03f84355ca..7305013eb8b 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
   # wants to write temporary files there. So create a temporary
   # to run from and symlink the runtime files to it.
   wrapperScript = writeScript "xfstests-check" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     set -e
     export RESULT_BASE="$(pwd)/results"
 
diff --git a/pkgs/tools/networking/airfield/default.nix b/pkgs/tools/networking/airfield/default.nix
index 70005038f99..94a606f9c78 100644
--- a/pkgs/tools/networking/airfield/default.nix
+++ b/pkgs/tools/networking/airfield/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     cat >$out/bin/airfield <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs}/bin/node ${src}/airfield.js
     EOF
   '';
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index 7dc0e07f945..56b54fed61b 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share"
     tar xvf  "ZAP_${version}_Linux.tar.gz" -C "$out/share/"
     mkdir -p "$out/bin"
-    echo "#!/bin/sh" > "$out/bin/zap"
+    echo "#!${stdenv.shell}" > "$out/bin/zap"
     echo \"$out/share/ZAP_${version}/zap.sh\" >> "$out/bin/zap"
     chmod +x "$out/bin/zap"
   '';
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 6bdc8570982..9ac62dc334f 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -3,7 +3,8 @@
 , gtk3, nssTools, pcsclite
 , libxml2, libproxy 
 , openssl, curl
-, makeWrapper }:
+, makeWrapper
+, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
@@ -32,8 +33,15 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-dialogs=yes" ];
 
-  postInstall = ''
-    install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
+  postInstall =
+  let
+    eid-nssdb-in = substituteAll {
+      inherit (stdenv) shell;
+      src = ./eid-nssdb.in;
+    };
+  in
+  ''
+    install -D ${eid-nssdb-in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
 
diff --git a/pkgs/tools/typesetting/lout/builder.sh b/pkgs/tools/typesetting/lout/builder.sh
index cd3b9c67e3c..61459e48b7f 100755
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Prepare a makefile specifying the appropriate output directories.
 #
 # Written by Ludovic Courtès <ludo@gnu.org>.
diff --git a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
index 5096c7f9468..012090ba079 100644
--- a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # change sudoers dir from /var/google-sudoers.d to /run/google-sudoers.d (managed through systemd-tmpfiles)
     substituteInPlace pam_module/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
     # fix "User foo not allowed because shell /bin/bash does not exist"
-    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash /bin/sh
+    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash ${stdenv.shell}
   '';
 
   buildInputs = [ curl.dev pam ];