diff --git a/pkgs/applications/audio/gtklick/default.nix b/pkgs/applications/audio/gtklick/default.nix
index b3b95ca057e5..6b7f4e4d7b22 100644
--- a/pkgs/applications/audio/gtklick/default.nix
+++ b/pkgs/applications/audio/gtklick/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, pythonPackages, gettext, klick}:
+{ lib, fetchurl, python2Packages, gettext, klick}:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "gtklick";
   version = "0.6.4";
 
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "7799d884126ccc818678aed79d58057f8cf3528e9f1be771c3fa5b694d9d0137";
   };
 
-  pythonPath = with pythonPackages; [
+  pythonPath = with python2Packages; [
     pyliblo
     pyGtkGlade
   ];
diff --git a/pkgs/applications/audio/ingen/default.nix b/pkgs/applications/audio/ingen/default.nix
index 55456b2fb6fd..a0defad0da0c 100644
--- a/pkgs/applications/audio/ingen/default.nix
+++ b/pkgs/applications/audio/ingen/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, boost, ganv, glibmm, gtkmm2, libjack2, lilv
-, lv2, makeWrapper, pkg-config, python, raul, rdflib, serd, sord, sratom
+, lv2, makeWrapper, pkg-config, python3, raul, serd, sord, sratom
 , wafHook
 , suil
 }:
@@ -16,24 +16,21 @@ stdenv.mkDerivation  rec {
     deepClone = true;
   };
 
-  nativeBuildInputs = [ pkg-config wafHook ];
+  nativeBuildInputs = [ pkg-config wafHook python3 python3.pkgs.wrapPython ];
   buildInputs = [
-    boost ganv glibmm gtkmm2 libjack2 lilv lv2 makeWrapper
-    python raul serd sord sratom suil
+    boost ganv glibmm gtkmm2 libjack2 lilv lv2
+    python3 raul serd sord sratom suil
   ];
 
-  preConfigure = ''
-    sed -e "s@{PYTHONDIR}/'@out/'@" -i wscript
-  '';
+  strictDeps = true;
 
-  propagatedBuildInputs = [ rdflib ];
+  pythonPath = [
+    python3
+    python3.pkgs.rdflib
+  ];
 
   postInstall = ''
-    for program in ingenams ingenish
-    do
-      wrapProgram $out/bin/$program \
-        --prefix PYTHONPATH : $out/${python.sitePackages}:$PYTHONPATH
-    done
+    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/jalv/default.nix b/pkgs/applications/audio/jalv/default.nix
index 611956089ed3..b640b55c5476 100644
--- a/pkgs/applications/audio/jalv/default.nix
+++ b/pkgs/applications/audio/jalv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gtk2, libjack2, lilv, lv2, pkg-config, python
+{ lib, stdenv, fetchurl, gtk2, libjack2, lilv, lv2, pkg-config, python3
 , serd, sord , sratom, suil, wafHook }:
 
 stdenv.mkDerivation  rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation  rec {
 
   nativeBuildInputs = [ pkg-config wafHook ];
   buildInputs = [
-    gtk2 libjack2 lilv lv2 python serd sord sratom suil
+    gtk2 libjack2 lilv lv2 python3 serd sord sratom suil
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/lastfmsubmitd/default.nix b/pkgs/applications/audio/lastfmsubmitd/default.nix
index efafc5b05b18..8a786c5c69ee 100644
--- a/pkgs/applications/audio/lastfmsubmitd/default.nix
+++ b/pkgs/applications/audio/lastfmsubmitd/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, pythonPackages }:
+{ lib, fetchurl, python2Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "lastfmsubmitd";
   version = "1.0.6";
 
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 0901c815f161..e7628715a21e 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv, callPackage, fetchurl
-, python
 , jdk, cmake, libxml2, zlib, python3, ncurses5
 , dotnet-sdk_3
 , vmopts ? null
@@ -199,7 +198,7 @@ let
         platforms = platforms.linux;
       };
     }).override {
-      propagatedUserEnvPkgs = [ python ];
+      propagatedUserEnvPkgs = [ python3 ];
     };
 
   buildRider = { name, version, src, license, description, wmClass, ... }:
diff --git a/pkgs/applications/kde/kcachegrind.nix b/pkgs/applications/kde/kcachegrind.nix
index 308ed35dc4ed..72c22c21ec54 100644
--- a/pkgs/applications/kde/kcachegrind.nix
+++ b/pkgs/applications/kde/kcachegrind.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  karchive, ki18n, kio, perl, python, php, qttools
+  karchive, ki18n, kio, perl, python3, php, qttools
   , kdbusaddons
 }:
 
@@ -12,5 +12,5 @@ mkDerivation {
     maintainers = with lib.maintainers; [ orivej ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ karchive ki18n kio perl python php qttools kdbusaddons ];
+  buildInputs = [ karchive ki18n kio perl python3 php qttools kdbusaddons ];
 }
diff --git a/pkgs/applications/kde/kdebugsettings.nix b/pkgs/applications/kde/kdebugsettings.nix
index 0287830485e4..7f24ec8e2fc0 100644
--- a/pkgs/applications/kde/kdebugsettings.nix
+++ b/pkgs/applications/kde/kdebugsettings.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   gettext,
   kcoreaddons, kconfig, kdbusaddons, kwidgetsaddons, kitemviews, kcompletion,
-  qtbase, python
+  qtbase, python3
 }:
 
 mkDerivation {
@@ -15,7 +15,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    gettext kcoreaddons kconfig kdbusaddons kwidgetsaddons kitemviews kcompletion python
+    gettext kcoreaddons kconfig kdbusaddons kwidgetsaddons kitemviews kcompletion python3
   ];
   propagatedUserEnvPkgs = [ ];
 }
diff --git a/pkgs/applications/kde/minuet.nix b/pkgs/applications/kde/minuet.nix
index ca7d6124ed59..cc7be0bf79a6 100644
--- a/pkgs/applications/kde/minuet.nix
+++ b/pkgs/applications/kde/minuet.nix
@@ -1,5 +1,5 @@
 { mkDerivation, qtbase
-, lib, extra-cmake-modules, gettext, python
+, lib, extra-cmake-modules, gettext, python3
 , drumstick, fluidsynth
 , kcoreaddons, kcrash, kdoctools
 , qtquickcontrols2, qtsvg, qttools, qtdeclarative
@@ -13,7 +13,7 @@ mkDerivation {
     broken = lib.versionOlder qtbase.version "5.14";
   };
 
-  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python qtdeclarative ];
+  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python3 qtdeclarative ];
 
   propagatedBuildInputs = [
     drumstick fluidsynth
diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index 4c5a443ba0d6..d1326848d2d6 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -1,5 +1,5 @@
 { lib, mkDerivation, fetchFromGitHub, fetchpatch
-, python, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
+, python3, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
 , which, perl, makeWrapper
 }:
 
@@ -21,11 +21,11 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     which
+    python3
+    ruby
   ];
 
   buildInputs = [
-    python
-    ruby
     qtbase
     qtmultimedia
     qttools
diff --git a/pkgs/applications/science/logic/lean2/default.nix b/pkgs/applications/science/logic/lean2/default.nix
index b3c6a51d440a..24d11c3a5319 100644
--- a/pkgs/applications/science/logic/lean2/default.nix
+++ b/pkgs/applications/science/logic/lean2/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gmp, mpfr, python
+{ lib, stdenv, fetchFromGitHub, cmake, gmp, mpfr, python2
 , gperftools, ninja, makeWrapper }:
 
 stdenv.mkDerivation {
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake makeWrapper ninja ];
-  buildInputs = [ gmp mpfr python gperftools ];
+  buildInputs = [ gmp mpfr python2 gperftools ];
 
   preConfigure = ''
     patchShebangs bin/leantags
diff --git a/pkgs/applications/science/logic/poly/default.nix b/pkgs/applications/science/logic/poly/default.nix
index db124c379cad..15e89138c6b3 100644
--- a/pkgs/applications/science/logic/poly/default.nix
+++ b/pkgs/applications/science/logic/poly/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitHub, gmp, cmake, python}:
+{lib, stdenv, fetchFromGitHub, gmp, cmake, python3}:
 
 stdenv.mkDerivation rec {
   pname = "libpoly";
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ gmp python ];
+  buildInputs = [ gmp python3 ];
+
+  strictDeps = true;
 
   meta = with lib; {
     homepage = "https://github.com/SRI-CSL/libpoly";
diff --git a/pkgs/applications/science/math/ginac/default.nix b/pkgs/applications/science/math/ginac/default.nix
index 6a38670adccf..901b9a340fea 100644
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cln, pkg-config, readline, gmp, python }:
+{ lib, stdenv, fetchurl, cln, pkg-config, readline, gmp, python3 }:
 
 stdenv.mkDerivation rec {
   name = "ginac-1.8.0";
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline ] ++ lib.optional stdenv.isDarwin gmp;
 
-  nativeBuildInputs = [ pkg-config python ];
+  nativeBuildInputs = [ pkg-config python3 ];
+
+  strictDeps = true;
 
   preConfigure = "patchShebangs ginsh";
 
diff --git a/pkgs/applications/science/math/gurobi/default.nix b/pkgs/applications/science/math/gurobi/default.nix
index 6066d0325f54..2bfeaa005687 100644
--- a/pkgs/applications/science/math/gurobi/default.nix
+++ b/pkgs/applications/science/math/gurobi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoPatchelfHook, python }:
+{ stdenv, lib, fetchurl, autoPatchelfHook, python2 }:
 
 let
   majorVersion = "8.1";
@@ -14,7 +14,9 @@ in stdenv.mkDerivation rec {
   sourceRoot = "gurobi${builtins.replaceStrings ["."] [""] version}/linux64";
 
   nativeBuildInputs = [ autoPatchelfHook ];
-  buildInputs = [ (python.withPackages (ps: [ ps.gurobipy ])) ];
+  buildInputs = [ (python2.withPackages (ps: [ ps.gurobipy ])) ];
+
+  strictDeps = true;
 
   buildPhase = ''
     cd src/build
diff --git a/pkgs/applications/version-management/git-and-tools/git-bz/default.nix b/pkgs/applications/version-management/git-and-tools/git-bz/default.nix
index 20e6a993cab2..eec9b7ea1246 100644
--- a/pkgs/applications/version-management/git-and-tools/git-bz/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bz/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, makeWrapper, xmlto
-, pythonPackages }:
+, python2Packages }:
 
 stdenv.mkDerivation {
   pname = "git-bz";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     asciidoc docbook_xml_dtd_45 docbook_xsl libxslt makeWrapper xmlto
   ];
   buildInputs = []
-    ++ (with pythonPackages; [ python pysqlite ]);
+    ++ (with python2Packages; [ python pysqlite ]);
 
   postPatch = ''
     patchShebangs configure
@@ -27,8 +27,8 @@ stdenv.mkDerivation {
 
   postInstall = ''
     wrapProgram $out/bin/git-bz \
-      --prefix PYTHONPATH : "$(toPythonPath "${pythonPackages.pycrypto}")" \
-      --prefix PYTHONPATH : "$(toPythonPath "${pythonPackages.pysqlite}")"
+      --prefix PYTHONPATH : "$(toPythonPath "${python2Packages.pycrypto}")" \
+      --prefix PYTHONPATH : "$(toPythonPath "${python2Packages.pysqlite}")"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-crecord/default.nix b/pkgs/applications/version-management/git-crecord/default.nix
index 5dc75ce4d702..006809db6226 100644
--- a/pkgs/applications/version-management/git-crecord/default.nix
+++ b/pkgs/applications/version-management/git-crecord/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages }:
+{ lib, fetchFromGitHub, python2Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "git-crecord";
   version = "20161216.0";
 
@@ -11,7 +11,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "0v3y90zi43myyi4k7q3892dcrbyi9dn2q6xgk12nw9db9zil269i";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ docutils ];
+  propagatedBuildInputs = with python2Packages; [ docutils ];
 
   meta = {
     homepage = "https://github.com/andrewshadura/git-crecord";
diff --git a/pkgs/applications/version-management/gitstats/default.nix b/pkgs/applications/version-management/gitstats/default.nix
index ccd13ba818b4..b987a3f55128 100644
--- a/pkgs/applications/version-management/gitstats/default.nix
+++ b/pkgs/applications/version-management/gitstats/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, perl, python, gnuplot, coreutils, gnugrep }:
+{ lib, stdenv, fetchzip, perl, python2, gnuplot, coreutils, gnugrep }:
 
 stdenv.mkDerivation rec {
   pname = "gitstats";
@@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
     name = "${pname}-${version}" + "-src";
   };
 
-  buildInputs = [ perl python ];
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ python2 ];
+
+  strictDeps = true;
 
   postPatch = ''
     sed -e "s|gnuplot_cmd = .*|gnuplot_cmd = '${gnuplot}/bin/gnuplot'|" \
diff --git a/pkgs/desktops/plasma-5/discover.nix b/pkgs/desktops/plasma-5/discover.nix
index cf815b808243..75e0fd6917d5 100644
--- a/pkgs/desktops/plasma-5/discover.nix
+++ b/pkgs/desktops/plasma-5/discover.nix
@@ -3,7 +3,7 @@
 , extra-cmake-modules
 , gettext
 , kdoctools
-, python
+, python3
 , appstream-qt
 , discount
 , flatpak
@@ -34,7 +34,7 @@
 mkDerivation {
   name = "discover";
   meta.broken = lib.versionOlder qtbase.version "5.15.0";
-  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python ];
+  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python3 ];
   buildInputs = [
     # discount is needed for libmarkdown
     appstream-qt
diff --git a/pkgs/development/compilers/intel-graphics-compiler/default.nix b/pkgs/development/compilers/intel-graphics-compiler/default.nix
index ebba160fc95a..512865829607 100644
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@@ -7,7 +7,7 @@
 , flex
 , llvmPackages_8
 , opencl-clang
-, python
+, python3
 , spirv-llvm-translator
 
 , buildWithPatches ? true
@@ -33,9 +33,11 @@ stdenv.mkDerivation rec {
     sha256 = "1jp3c67ppl1x4pazr5nzy52615cpx0kyckaridhc0fsmrkgilyxq";
   };
 
-  nativeBuildInputs = [ clang cmake bison flex llvm python ];
+  nativeBuildInputs = [ clang cmake bison flex python3 ];
 
-  buildInputs = [ clang opencl-clang spirv-llvm-translator ];
+  buildInputs = [ clang opencl-clang spirv-llvm-translator llvm ];
+
+  strictDeps = true;
 
   # checkInputs = [ lit pythonPackages.nose ];
 
diff --git a/pkgs/development/libraries/audio/raul/default.nix b/pkgs/development/libraries/audio/raul/default.nix
index a0089e310441..b1a8288c5f04 100644
--- a/pkgs/development/libraries/audio/raul/default.nix
+++ b/pkgs/development/libraries/audio/raul/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python, wafHook }:
+{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "raul";
@@ -12,8 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1z37jb6ghc13b8nv8a8hcg669gl8vh4ni9djvfgga9vcz8rmcg8l";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook ];
-  buildInputs = [ boost gtk2 python ];
+  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  buildInputs = [ boost gtk2 ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "A C++ utility library primarily aimed at audio/musical applications";
diff --git a/pkgs/development/libraries/audio/suil/default.nix b/pkgs/development/libraries/audio/suil/default.nix
index 56008ae8dd6a..1c978a18f8f9 100644
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python, serd, sord, sratom
+{ stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
 , wafHook
 , withQt4 ? true, qt4 ? null
 , withQt5 ? false, qt5 ? null }:
@@ -17,13 +17,15 @@ stdenv.mkDerivation rec {
     sha256 = "0z4v01pjw4wh65x38w6icn28wdwxz13ayl8hvn4p1g9kmamp1z06";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook ];
-  buildInputs = [ gtk2 lv2 python serd sord sratom ]
+  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  buildInputs = [ gtk2 lv2 serd sord sratom ]
     ++ (lib.optionals withQt4 [ qt4 ])
     ++ (lib.optionals withQt5 (with qt5; [ qtbase qttools ]));
 
   dontWrapQtApps = true;
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "http://drobilla.net/software/suil";
     description = "A lightweight C library for loading and wrapping LV2 plugin UIs";
diff --git a/pkgs/development/libraries/gdal/2.4.nix b/pkgs/development/libraries/gdal/2.4.nix
index 76c92dd9a3b5..70ae3b2b12aa 100644
--- a/pkgs/development/libraries/gdal/2.4.nix
+++ b/pkgs/development/libraries/gdal/2.4.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, unzip, libjpeg, libtiff, zlib
-, postgresql, libmysqlclient, libgeotiff, pythonPackages, proj, geos, openssl
+, postgresql, libmysqlclient, libgeotiff, python2Packages, proj, geos, openssl
 , libpng, sqlite, libspatialite, poppler, hdf4, qhull, giflib, expat
 , libiconv, libxml2
 , netcdfSupport ? true, netcdf, hdf5, curl
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip ];
   buildInputs = [ libjpeg libtiff libgeotiff libpng proj openssl sqlite
     libspatialite poppler hdf4 qhull giflib expat libxml2 proj ]
-  ++ (with pythonPackages; [ python numpy wrapPython ])
+  ++ (with python2Packages; [ python numpy wrapPython ])
   ++ lib.optional stdenv.isDarwin libiconv
   ++ lib.optionals netcdfSupport [ netcdf hdf5 curl ];
 
diff --git a/pkgs/development/libraries/gdal/gdal-1_11.nix b/pkgs/development/libraries/gdal/gdal-1_11.nix
deleted file mode 100644
index 47be58c50511..000000000000
--- a/pkgs/development/libraries/gdal/gdal-1_11.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchurl, unzip, libjpeg, libtiff, zlib
-, postgresql, mysql57, libgeotiff, python, pythonPackages, proj, geos, openssl
-, libpng }:
-
-stdenv.mkDerivation rec {
-  pname = "gdal";
-  version = "1.11.5";
-
-  src = fetchurl {
-    url = "https://download.osgeo.org/gdal/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0hphxzvy23v3vqxx1y22hhhg4cypihrb8555y12nb4mrhzlw7zfl";
-  };
-
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [ libjpeg libtiff libgeotiff libpng python pythonPackages.numpy proj openssl ];
-
-  patches = [
-    # This ensures that the python package is installed into gdal's prefix,
-    # rather than trying to install into python's prefix.
-    ./python.patch
-  ];
-
-  hardeningDisable = [ "format" "fortify" ];
-
-  # Don't use optimization for gcc >= 4.3. That's said to be causing segfaults.
-  # Unset CC and CXX as they confuse libtool.
-  preConfigure = "export CFLAGS=-O0 CXXFLAGS=-O0; unset CC CXX";
-
-  configureFlags = [
-    "--with-jpeg=${libjpeg.dev}"
-    "--with-libtiff=${libtiff.dev}" # optional (without largetiff support)
-    "--with-libpng=${libpng.dev}"   # optional
-    "--with-libz=${zlib.dev}"       # optional
-
-    "--with-pg=${postgresql}/bin/pg_config"
-    "--with-mysql=${mysql57.connector-c}/bin/mysql_config"
-    "--with-geotiff=${libgeotiff.dev}"
-    "--with-python"               # optional
-    "--with-static-proj4=${proj}" # optional
-    "--with-geos=${geos}/bin/geos-config"# optional
-  ];
-
-  # Allow use of old proj_api.h
-  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
-
-  # Prevent this:
-  #
-  #   Checking .pth file support in /nix/store/xkrmb8xnvqxzjwsdmasqmsdh1a5y2y99-gdal-1.11.2/lib/python2.7/site-packages/
-  #   /nix/store/pbi1lgank10fy0xpjckbdpgacqw34dsz-python-2.7.9/bin/python -E -c pass
-  #   TEST FAILED: /nix/store/xkrmb8xnvqxzjwsdmasqmsdh1a5y2y99-gdal-1.11.2/lib/python2.7/site-packages/ does NOT support .pth files
-  #   error: bad install directory or PYTHONPATH
-  preBuild = ''
-    pythonInstallDir=$out/lib/${python.libPrefix}/site-packages
-    mkdir -p $pythonInstallDir
-    export PYTHONPATH=''${PYTHONPATH:+''${PYTHONPATH}:}$pythonInstallDir
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Translator library for raster geospatial data formats";
-    homepage = "https://www.gdal.org/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.marcweber ];
-    platforms = with lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/development/libraries/gdal/python.patch b/pkgs/development/libraries/gdal/python.patch
deleted file mode 100644
index 50504c62eddb..000000000000
--- a/pkgs/development/libraries/gdal/python.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/swig/python/GNUmakefile.old b/swig/python/GNUmakefile
-index b4d5e90..2160b83 100644
---- a/swig/python/GNUmakefile
-+++ b/swig/python/GNUmakefile
-@@ -67,11 +67,7 @@ egg:
- 	
- install:
- 
--ifeq ($(PY_HAVE_SETUPTOOLS),1)
--	$(PYTHON) setup.py install 
--else
- 	$(PYTHON) setup.py install --prefix=$(DESTDIR)$(prefix)
--endif
- 
- 	for f in $(SCRIPTS) ; do $(INSTALL) ./scripts/$$f $(DESTDIR)$(INST_BIN) ; done
- 
-
diff --git a/pkgs/development/libraries/grib-api/default.nix b/pkgs/development/libraries/grib-api/default.nix
index 182f05a8ca89..1f7097dc4a3f 100644
--- a/pkgs/development/libraries/grib-api/default.nix
+++ b/pkgs/development/libraries/grib-api/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, fetchpatch, lib, stdenv,
   cmake, netcdf, gfortran, libpng, openjpeg,
-  enablePython ? false, pythonPackages }:
+  enablePython ? false, pythonPackages ? null }:
 
 stdenv.mkDerivation rec {
   pname = "grib-api";
diff --git a/pkgs/development/libraries/hpx/default.nix b/pkgs/development/libraries/hpx/default.nix
index da29c0e07e7a..73d1eea988de 100644
--- a/pkgs/development/libraries/hpx/default.nix
+++ b/pkgs/development/libraries/hpx/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, cmake, hwloc, gperftools, pkg-config, python }:
+{ lib, stdenv, fetchFromGitHub, boost, cmake, hwloc, gperftools, pkg-config, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "hpx";
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ boost hwloc gperftools ];
-  nativeBuildInputs = [ cmake pkg-config python ];
+  nativeBuildInputs = [ cmake pkg-config python3 ];
+
+  strictDeps = true;
 
   meta = {
     description = "C++ standard library for concurrency and parallelism";
diff --git a/pkgs/development/libraries/kde-frameworks/kapidox.nix b/pkgs/development/libraries/kde-frameworks/kapidox.nix
index ca5e773a45b9..4395f3cd0dd7 100644
--- a/pkgs/development/libraries/kde-frameworks/kapidox.nix
+++ b/pkgs/development/libraries/kde-frameworks/kapidox.nix
@@ -1,9 +1,9 @@
-{ mkDerivation, lib, extra-cmake-modules, python }:
+{ mkDerivation, lib, extra-cmake-modules, python3 }:
 
 mkDerivation {
   name = "kapidox";
   meta = { maintainers = [ lib.maintainers.ttuegel ]; };
-  nativeBuildInputs = [ extra-cmake-modules python ];
+  nativeBuildInputs = [ extra-cmake-modules python3 python3.pkgs.setuptools ];
   postFixup = ''
     moveToOutput bin $bin
   '';
diff --git a/pkgs/development/libraries/kmsxx/default.nix b/pkgs/development/libraries/kmsxx/default.nix
index 65dce915f144..c88dde7e4450 100644
--- a/pkgs/development/libraries/kmsxx/default.nix
+++ b/pkgs/development/libraries/kmsxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, libdrm
-, withPython ? false, python }:
+, withPython ? false, python ? null }:
 
 stdenv.mkDerivation {
   pname = "kmsxx";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   cmakeFlags = lib.optional (!withPython) "-DKMSXX_ENABLE_PYTHON=OFF";
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ libdrm python ];
+  buildInputs = [ libdrm ] ++ lib.optionals withPython [ python ];
 
   meta = with lib; {
     description = "C++11 library, utilities and python bindings for Linux kernel mode setting";
@@ -24,5 +24,6 @@ stdenv.mkDerivation {
     license = licenses.mpl20;
     maintainers = with maintainers; [ gnidorah ];
     platforms = platforms.linux;
+    broken = true; # marked broken 2021-03-26
   };
 }
diff --git a/pkgs/development/libraries/libcint/default.nix b/pkgs/development/libraries/libcint/default.nix
index 99692f63d458..d0fc8c3c4a27 100644
--- a/pkgs/development/libraries/libcint/default.nix
+++ b/pkgs/development/libraries/libcint/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , blas
   # Check Inputs
-, python
+, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -26,8 +26,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_PREFIX=" # ends up double-adding /nix/store/... prefix, this avoids issue
   ];
 
+  strictDeps = true;
+
   doCheck = true;
-  checkInputs = [ python.pkgs.numpy ];
+  checkInputs = [ python3.pkgs.numpy ];
 
   meta = with lib; {
     description = "General GTO integrals for quantum chemistry";
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index a6334bf9998c..7be5f8b4000f 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, llvmPackages }:
+{ lib, stdenv, fetchFromGitHub, python3, llvmPackages }:
 
 let
   llvm = llvmPackages.llvm;
@@ -16,8 +16,9 @@ stdenv.mkDerivation {
     sha256 = "03l9frx3iw3qdsb9rrscgzdwm6872gv6mkssvn027ndf9y321xk7";
   };
 
-  nativeBuildInputs = [ python ];
-  buildInputs = [ llvm clang clang-unwrapped ];
+  nativeBuildInputs = [ python3 llvm ];
+
+  strictDeps = true;
 
   postPatch = ''
     sed -i 's,llvm_clang =.*,llvm_clang = "${clang-unwrapped}/bin/clang",' configure.py
@@ -25,7 +26,7 @@ stdenv.mkDerivation {
   '';
 
   configurePhase = ''
-    ${python.interpreter} ./configure.py --prefix=$out
+    ${python3.interpreter} ./configure.py --prefix=$out
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libinjection/default.nix b/pkgs/development/libraries/libinjection/default.nix
index f678136637ae..81a1398147ba 100644
--- a/pkgs/development/libraries/libinjection/default.nix
+++ b/pkgs/development/libraries/libinjection/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub
-, python
+, python2
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
     sha256 = "0chsgam5dqr9vjfhdcp8cgk7la6nf3lq44zs6z6si98cq743550g";
   };
 
-  nativeBuildInputs = [ python ];
+  nativeBuildInputs = [ python2 ];
+
+  strictDeps = true;
 
   patchPhase = ''
     patchShebangs src
diff --git a/pkgs/development/libraries/liblinphone/default.nix b/pkgs/development/libraries/liblinphone/default.nix
index db9db1ba3a69..3ef64823a024 100644
--- a/pkgs/development/libraries/liblinphone/default.nix
+++ b/pkgs/development/libraries/liblinphone/default.nix
@@ -111,6 +111,8 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  strictDeps = true;
+
   # Some grammar files needed to be copied too from some dependencies. I suppose
   # if one define a dependency in such a way that its share directory is found,
   # then this copying would be unnecessary. Instead of actually copying these
diff --git a/pkgs/development/libraries/libplist/default.nix b/pkgs/development/libraries/libplist/default.nix
index c8e9ddb82c5f..cac4299f2890 100644
--- a/pkgs/development/libraries/libplist/default.nix
+++ b/pkgs/development/libraries/libplist/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, fetchFromGitHub, pkg-config, enablePython ? false, python, glib }:
+{ lib, stdenv, autoreconfHook, fetchFromGitHub, pkg-config, enablePython ? false, python ? null, glib }:
 
 stdenv.mkDerivation rec {
   pname = "libplist";
diff --git a/pkgs/development/libraries/libredwg/default.nix b/pkgs/development/libraries/libredwg/default.nix
index 5fca199acb0a..e5123fa61af3 100644
--- a/pkgs/development/libraries/libredwg/default.nix
+++ b/pkgs/development/libraries/libredwg/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, texinfo, pcre2
-, enablePython ? false, python, swig, libxml2, ncurses
+, enablePython ? false, python ? null, swig, libxml2, ncurses
 }:
 let
   isPython3 = enablePython && python.pythonAtLeast "3";
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index 38a9b78b6d10..2e25399d9797 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , ninja
 , perl # Project uses Perl for scripting and testing
-, python
+, python3
 
 , enableThreading ? true # Threading can be disabled to increase security https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
 }:
@@ -20,7 +20,9 @@ stdenv.mkDerivation rec {
     sha256 = "0mz7n373b8d287crwi6kq2hb8ryyi228j38h25744lqai23qj5cf";
   };
 
-  nativeBuildInputs = [ cmake ninja perl python ];
+  nativeBuildInputs = [ cmake ninja perl python3 ];
+
+  strictDeps = true;
 
   postConfigure = lib.optionals enableThreading ''
     perl scripts/config.pl set MBEDTLS_THREADING_C    # Threading abstraction layer
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index 4a8bc710c8e5..aaa31b29e9ea 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -87,6 +87,8 @@ stdenv.mkDerivation rec {
     srtp
   ];
 
+  strictDeps = true;
+
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
diff --git a/pkgs/development/tools/analysis/kcov/default.nix b/pkgs/development/tools/analysis/kcov/default.nix
index 15891e74044a..4b294bf8adaf 100644
--- a/pkgs/development/tools/analysis/kcov/default.nix
+++ b/pkgs/development/tools/analysis/kcov/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitHub, cmake, pkg-config, zlib, curl, elfutils, python, libiberty, libopcodes}:
+{lib, stdenv, fetchFromGitHub, cmake, pkg-config, zlib, curl, elfutils, python3, libiberty, libopcodes}:
 
 stdenv.mkDerivation rec {
   pname = "kcov";
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = "patchShebangs src/bin-to-c-source.py";
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config python3 ];
 
-  buildInputs = [ zlib curl elfutils python libiberty libopcodes ];
+  buildInputs = [ curl zlib elfutils libiberty libopcodes ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Code coverage tester for compiled programs, Python scripts and shell scripts";
diff --git a/pkgs/development/tools/build-managers/gup/default.nix b/pkgs/development/tools/build-managers/gup/default.nix
index dcc0c3aef90c..dfa65736f99f 100644
--- a/pkgs/development/tools/build-managers/gup/default.nix
+++ b/pkgs/development/tools/build-managers/gup/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, nix-update-source, lib, python
+{ stdenv, fetchFromGitHub, nix-update-source, lib, python3
 , which, runtimeShell, pychecker ? null }:
 stdenv.mkDerivation rec {
   version = "0.7.0";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1pwnmlq2pgkkln9sgz4wlb9dqlqw83bkf105qljnlvggc21zm3pv";
   };
   pname = "gup";
-  buildInputs = lib.remove null [ python which pychecker ];
+  nativeBuildInputs = [ python3 which pychecker ];
+  buildInputs = [ python3 ];
+  strictDeps = true;
   SKIP_PYCHECKER = pychecker == null;
   buildPhase = "make python";
   installPhase = ''
diff --git a/pkgs/development/tools/grabserial/default.nix b/pkgs/development/tools/grabserial/default.nix
index ce336241b65d..2ce3ff49c417 100644
--- a/pkgs/development/tools/grabserial/default.nix
+++ b/pkgs/development/tools/grabserial/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages }:
+{ lib, fetchFromGitHub, python3Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "grabserial";
   version = "2.0.2";
 
@@ -11,7 +11,10 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "0ryk4w8q6zfmia71nwnk5b7xaxw0sf45dw9q50xp7k76i3k5f9f3";
   };
 
-  propagatedBuildInputs = [ pythonPackages.pyserial ];
+  propagatedBuildInputs = [ python3Packages.pyserial ];
+
+  # no usable tests
+  doCheck = false;
 
   meta = with lib; {
     description = "Python based serial dump and timing program";
diff --git a/pkgs/development/tools/hexio/default.nix b/pkgs/development/tools/hexio/default.nix
index 5b3fca815e6a..0b4e474515ab 100644
--- a/pkgs/development/tools/hexio/default.nix
+++ b/pkgs/development/tools/hexio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pcsclite, pth }:
+{ lib, stdenv, fetchFromGitHub, pcsclite, pth, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "hexio";
@@ -11,8 +11,9 @@ stdenv.mkDerivation rec {
     repo = "hexio";
   };
 
-  propagatedBuildInputs = [ python ];
-  buildInputs = [ pcsclite pth ];
+  strictDeps = true;
+
+  buildInputs = [ pcsclite pth python2 ];
 
   patchPhase = ''
     substituteInPlace Makefile \
diff --git a/pkgs/development/tools/misc/gede/default.nix b/pkgs/development/tools/misc/gede/default.nix
index 486557d9219a..00ce9958b1f9 100644
--- a/pkgs/development/tools/misc/gede/default.nix
+++ b/pkgs/development/tools/misc/gede/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchurl, makeWrapper, python, qmake, ctags, gdb }:
+{ mkDerivation, lib, fetchurl, makeWrapper, python3, qmake, ctags, gdb }:
 
 mkDerivation rec {
   pname = "gede";
@@ -9,10 +9,12 @@ mkDerivation rec {
     sha256 = "0hbsy2ymzgl8xd9mnh43gxdfncy7g6czxfvfyh7zp3ij8yiwf8x3";
   };
 
-  nativeBuildInputs = [ qmake makeWrapper python ];
+  nativeBuildInputs = [ qmake makeWrapper python3 ];
 
   buildInputs = [ ctags ];
 
+  strictDeps = true;
+
   dontUseQmakeConfigure = true;
 
   buildPhase = ":";
diff --git a/pkgs/development/tools/misc/global/default.nix b/pkgs/development/tools/misc/global/default.nix
index fb3ddfcb29b3..7ace6f857c8b 100644
--- a/pkgs/development/tools/misc/global/default.nix
+++ b/pkgs/development/tools/misc/global/default.nix
@@ -1,8 +1,10 @@
 { fetchurl, lib, stdenv, libtool, makeWrapper
-, coreutils, ctags, ncurses, pythonPackages, sqlite, universal-ctags
+, coreutils, ctags, ncurses, python3Packages, sqlite, universal-ctags
 }:
 
-stdenv.mkDerivation rec {
+let
+  pygments = python3Packages.pygments;
+in stdenv.mkDerivation rec {
   pname = "global";
   version = "6.6.5";
 
@@ -15,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  propagatedBuildInputs = [ pythonPackages.pygments ];
+  propagatedBuildInputs = [ pygments ];
 
   configureFlags = [
     "--with-ltdl-include=${libtool}/include"
@@ -34,9 +36,9 @@ stdenv.mkDerivation rec {
     cp -v *.el "$out/share/emacs/site-lisp"
 
     wrapProgram $out/bin/gtags \
-      --prefix PYTHONPATH : "$(toPythonPath ${pythonPackages.pygments})"
+      --prefix PYTHONPATH : "$(toPythonPath ${pygments})"
     wrapProgram $out/bin/global \
-      --prefix PYTHONPATH : "$(toPythonPath ${pythonPackages.pygments})"
+      --prefix PYTHONPATH : "$(toPythonPath ${pygments})"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/jscoverage/default.nix b/pkgs/development/tools/misc/jscoverage/default.nix
index 042d085c1e0c..217cbe5e0296 100644
--- a/pkgs/development/tools/misc/jscoverage/default.nix
+++ b/pkgs/development/tools/misc/jscoverage/default.nix
@@ -1,4 +1,4 @@
-{ autoconf, fetchurl, makedepend, perl, python, lib, stdenv, unzip, zip }:
+{ autoconf, fetchurl, makedepend, perl, python3, lib, stdenv, unzip, zip }:
 
 stdenv.mkDerivation rec {
   name = "jscoverage-0.5.1";
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     ./jsfalse_to_null.patch
   ];
 
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [ autoconf makedepend perl python zip ];
+  nativeBuildInputs = [ unzip perl python3 zip ];
+
+  strictDeps = true;
 
   # It works without MOZ_FIX_LINK_PATHS, circumventing an impurity
   # issue.  Maybe we could kick js/ (spidermonkey) completely and
diff --git a/pkgs/development/tools/misc/kconfig-frontends/default.nix b/pkgs/development/tools/misc/kconfig-frontends/default.nix
index 3b355b6218a5..ae757f0d80d6 100644
--- a/pkgs/development/tools/misc/kconfig-frontends/default.nix
+++ b/pkgs/development/tools/misc/kconfig-frontends/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, bison, flex, gperf, ncurses, pythonPackages }:
+{ lib, stdenv, fetchurl, pkg-config, bison, flex, gperf, ncurses, python3, bash }:
 
 stdenv.mkDerivation rec {
   basename = "kconfig-frontends";
@@ -10,17 +10,15 @@ stdenv.mkDerivation rec {
     url = "http://ymorin.is-a-geek.org/download/${basename}/${name}.tar.xz";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ bison flex gperf ncurses pythonPackages.python pythonPackages.wrapPython ];
+  nativeBuildInputs = [ bison flex gperf pkg-config ];
+  buildInputs = [ bash ncurses python3 ];
+
+  strictDeps = true;
 
   configureFlags = [
     "--enable-frontends=conf,mconf,nconf"
   ];
 
-  postInstall = ''
-    wrapPythonPrograms
-  '';
-
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with lib; {
diff --git a/pkgs/games/gemrb/default.nix b/pkgs/games/gemrb/default.nix
index fb49779eb535..9c5744f7291a 100644
--- a/pkgs/games/gemrb/default.nix
+++ b/pkgs/games/gemrb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, freetype, SDL2, SDL2_mixer, openal, zlib, libpng, python, libvorbis
+, freetype, SDL2, SDL2_mixer, openal, zlib, libpng, python2, libvorbis
 , libiconv }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   # TODO: make libpng, libvorbis, sdl_mixer, freetype, vlc, glew (and other gl
   # reqs) optional
-  buildInputs = [ freetype python openal SDL2 SDL2_mixer zlib libpng libvorbis libiconv ];
+  buildInputs = [ freetype python2 openal SDL2 SDL2_mixer zlib libpng libvorbis libiconv ];
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/games/gnubg/default.nix b/pkgs/games/gnubg/default.nix
index feff18e9bb6f..7402049a9d82 100644
--- a/pkgs/games/gnubg/default.nix
+++ b/pkgs/games/gnubg/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, python, gtk2, readline }:
+{ lib, stdenv, fetchurl, pkg-config, glib, python3, gtk2, readline }:
 
 let version = "1.06.002"; in
 stdenv.mkDerivation {
@@ -9,8 +9,10 @@ stdenv.mkDerivation {
     sha256 = "11xwhcli1h12k6rnhhyq4jphzrhfik7i8ah3k32pqw803460n6yf";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ python glib gtk2 readline ];
+  nativeBuildInputs = [ pkg-config python3 glib ];
+  buildInputs = [  gtk2 readline ];
+
+  strictDeps = true;
 
   configureFlags = [ "--with-gtk" "--with--board3d" ];
 
diff --git a/pkgs/misc/gnuk/generic.nix b/pkgs/misc/gnuk/generic.nix
index 8ed186e1ed61..b614dd52a378 100644
--- a/pkgs/misc/gnuk/generic.nix
+++ b/pkgs/misc/gnuk/generic.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, gcc-arm-embedded, binutils-arm-embedded, makeWrapper
-, python, pythonPackages
+, python2Packages
 
 # Extra options
 , device ? "fsij", vid ? "234b", pid ? "0000"
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   inherit src;
 
   nativeBuildInputs = [ gcc-arm-embedded binutils-arm-embedded makeWrapper ];
-  buildInputs = [ python ] ++ (with pythonPackages; [ pyusb colorama ]);
+  buildInputs = with python2Packages; [ python pyusb colorama ];
 
   configurePhase = ''
     cd src
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index b7d08344e408..b40b3c46e77b 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,5 +1,5 @@
 { stdenv, file, lib, fetchFromGitHub, autoreconfHook, bison, flex, pkg-config
-, pythonSupport ? false, swig ? null, python}:
+, pythonSupport ? false, swig ? null, python ? null}:
 
 stdenv.mkDerivation rec {
   pname = "libnl";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   postBuild = lib.optionalString (pythonSupport) ''
       cd python
-      ${python}/bin/python setup.py install --prefix=../pythonlib
+      ${python.interpreter} setup.py install --prefix=../pythonlib
       cd -
   '';
 
diff --git a/pkgs/servers/irker/default.nix b/pkgs/servers/irker/default.nix
index 7bb0900d7d30..0aac945ad006 100644
--- a/pkgs/servers/irker/default.nix
+++ b/pkgs/servers/irker/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, python, pkg-config
+{ lib, stdenv, fetchFromGitLab, python3, pkg-config
 , xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_412 }:
 
 stdenv.mkDerivation {
@@ -15,12 +15,14 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config xmlto docbook2x docbook_xsl docbook_xml_dtd_412 ];
 
   buildInputs = [
-    python
+    python3
     # Needed for proxy support I believe, which I haven't tested.
     # Probably needs to be propagated and some wrapPython magic
     # python.pkgs.pysocks
   ];
 
+  strictDeps = true;
+
   postPatch = ''
     substituteInPlace Makefile \
       --replace '-o 0 -g 0' ""
diff --git a/pkgs/servers/kippo/default.nix b/pkgs/servers/kippo/default.nix
deleted file mode 100644
index a3c6d683a1ba..000000000000
--- a/pkgs/servers/kippo/default.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-# This is the installation portion of kippo.
-# This is somewhat jumbled together. There is no "easy_install" for kippo,
-# and there isn't a way to regenerate the twistd plugin cache.
-#
-# Use the services.kippo options to properly configure if on NixOS.
-# On other platforms there is a problem with hardcoded paths.
-# Your best bet is to change kippo source to customise
-# or manually copy the proper filesystems.
-# At a minimum the following are required in  /var/lib/kippo:
-#     honeyfs/
-#     fs.pickle
-#     data/
-#     txtcmds/
-#
-# There is also benefit in preparing /var/log/kippo
-#     tty/
-#     dl/
-#
-# Most of these files need read/write permissions.
-#
-# Read only files: kippo.tac and kippo.cfg
-#
-# Execution may look like this:
-# twistd -y kippo.tac --syslog --pidfile=kippo.pid
-#
-# Use this package at your own risk.
-
-{lib, stdenv, fetchurl, pythonPackages }:
-
-let
-
-  twisted_13 = pythonPackages.buildPythonPackage rec {
-    # NOTE: When updating please check if new versions still cause issues
-    # to packages like carbon (http://stackoverflow.com/questions/19894708/cant-start-carbon-12-04-python-error-importerror-cannot-import-name-daem)
-    disabled = pythonPackages.isPy3k;
-
-    name = "Twisted-13.2.0";
-    src = fetchurl {
-      url = "mirror://pypi/T/Twisted/${name}.tar.bz2";
-      sha256 = "1wrcqv5lvgwk2aq83qb2s2ng2vx14hbjjk2gc30cg6h1iiipal89";
-    };
-
-    propagatedBuildInputs = with pythonPackages; [ zope_interface ];
-
-    # Generate Twisted's plug-in cache.  Twited users must do it as well.  See
-    # http://twistedmatrix.com/documents/current/core/howto/plugin.html#auto3
-    # and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477103 for
-    # details.
-    postInstall = "$out/bin/twistd --help > /dev/null";
-
-    meta = with lib; {
-      homepage = "https://twistedmatrix.com/";
-      description = "Twisted, an event-driven networking engine written in Python";
-      longDescription = ''
-        Twisted is an event-driven networking engine written in Python
-        and licensed under the MIT license.
-      '';
-      license = licenses.mit;
-    };
-  };
-
-in stdenv.mkDerivation rec {
-    pname = "kippo";
-    version = "0.8";
-    src = fetchurl {
-      url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/kippo/${pname}-${version}.tar.gz";
-      sha256 = "0rd2mk36d02qd24z8s4xyy64fy54rzpar4379iq4dcjwg7l7f63d";
-    };
-    buildInputs = with pythonPackages; [ pycrypto pyasn1 twisted_13 ];
-    installPhase = ''
-        substituteInPlace ./kippo.tac --replace "kippo.cfg" "$out/src/kippo.cfg"
-        substituteInPlace ./kippo.cfg --replace "log_path = log" "log_path = /var/log/kippo" \
-            --replace "download_path = dl" "download_path = /var/log/kippo/dl" \
-            --replace "contents_path = honeyfs" "filesystem_file = /var/lib/kippo/honeyfs" \
-            --replace "filesystem_file = fs.pickle" "filesystem_file = /var/lib/kippo/fs.pickle" \
-            --replace "data_path = data" "data_path = /var/lib/kippo/data" \
-            --replace "txtcmds_path = txtcmds" "txtcmds_path = /var/lib/kippo/txtcmds" \
-            --replace "public_key = public.key" "public_key = /var/lib/kippo/keys/public.key" \
-            --replace "private_key = private.key" "private_key = /var/lib/kippo/keys/private.key"
-        mkdir -p $out/bin
-        mkdir -p $out/src
-        mv ./* $out/src
-        mv $out/src/utils/* $out/bin
-        '';
-
-    passthru.twisted = twisted_13;
-
-    meta = with lib; {
-      homepage = "https://github.com/desaster/kippo";
-      description = "SSH Honeypot";
-      longDescription = ''
-        Default port is 2222. Recommend using something like this for port redirection to default SSH port:
-        networking.firewall.extraCommands = '''
-        iptables -t nat -A PREROUTING -i IN_IFACE -p tcp --dport 22 -j REDIRECT --to-port 2222''' '';
-      license = licenses.bsd3;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ tomberek ];
-      broken = true; # 2018-09-12, failed on hydra since 2017-12-11
-    };
-}
diff --git a/pkgs/shells/ksh/default.nix b/pkgs/shells/ksh/default.nix
index 822f1dc3491b..cfd278aaca65 100644
--- a/pkgs/shells/ksh/default.nix
+++ b/pkgs/shells/ksh/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, meson, ninja, fetchFromGitHub, which, python, fetchpatch
+{ lib, stdenv, meson, ninja, fetchFromGitHub, which, python3, fetchpatch
 , libiconv }:
 
 stdenv.mkDerivation rec {
@@ -19,10 +19,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ meson ninja which python ];
+  nativeBuildInputs = [ meson ninja which python3 ];
 
   buildInputs = [ libiconv ];
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "KornShell Command And Programming Language";
     longDescription = ''
diff --git a/pkgs/tools/archivers/innoextract/default.nix b/pkgs/tools/archivers/innoextract/default.nix
index 701c7429d636..d1cb93093d3a 100644
--- a/pkgs/tools/archivers/innoextract/default.nix
+++ b/pkgs/tools/archivers/innoextract/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, makeWrapper, python
+{ lib, stdenv, fetchurl, cmake, makeWrapper
 , boost, lzma
 , withGog ? false, unar ? null }:
 
@@ -10,10 +10,15 @@ stdenv.mkDerivation rec {
     sha256 = "09l1z1nbl6ijqqwszdwch9mqr54qb7df0wp2sd77v17dq6gsci33";
   };
 
-  buildInputs = [ python lzma boost ];
+  buildInputs = [ lzma boost ];
+
+  # Python is reported as missing during the build, however
+  # including Python does not change the output.
 
   nativeBuildInputs = [ cmake makeWrapper ];
 
+  strictDeps = true;
+
   # we need unar to for multi-archive extraction
   postFixup = lib.optionalString withGog ''
     wrapProgram $out/bin/innoextract \
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
index 1949f3f0da0f..ea82ccaf96b7 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, which, ninja, python, pkg-config, protobuf
+{ lib, stdenv, fetchFromGitHub, which, ninja, pkg-config, protobuf
 , ibus, gtk2, zinnia, qt5, libxcb, tegaki-zinnia-japanese, python3Packages }:
 
 let
diff --git a/pkgs/tools/misc/i3minator/default.nix b/pkgs/tools/misc/i3minator/default.nix
index 6e207ce69166..4db029ef8fa2 100644
--- a/pkgs/tools/misc/i3minator/default.nix
+++ b/pkgs/tools/misc/i3minator/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, glibcLocales }:
+{ lib, fetchFromGitHub, python3Packages, glibcLocales }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "i3minator";
   version = "0.0.4";
 
@@ -13,7 +13,7 @@ pythonPackages.buildPythonApplication rec {
 
   LC_ALL = "en_US.UTF-8";
   buildInputs = [ glibcLocales ];
-  propagatedBuildInputs = [ pythonPackages.pyyaml pythonPackages.i3-py ];
+  propagatedBuildInputs = [ python3Packages.pyyaml python3Packages.i3-py ];
 
   # No tests
   doCheck = false;
diff --git a/pkgs/tools/networking/httpstat/default.nix b/pkgs/tools/networking/httpstat/default.nix
index 27c2a145a659..be4a8f2a168d 100644
--- a/pkgs/tools/networking/httpstat/default.nix
+++ b/pkgs/tools/networking/httpstat/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, curl, pythonPackages, glibcLocales }:
+{ lib, fetchFromGitHub, curl, python3Packages, glibcLocales }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "httpstat";
   version = "1.3.1";
   src = fetchFromGitHub {
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 3546e1aa1196..93d423a7283e 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper,
   pkg-config, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
-  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python,
+  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python3,
   docs ? false, xmlto, libselinux, ldns
   }:
 
 let
   binPath = lib.makeBinPath [
-    bash iproute iptables procps coreutils gnused gawk nss.tools which python
+    bash iproute iptables procps coreutils gnused gawk nss.tools which python3
   ];
 in
 
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "0bj3g6qwd3ir3gk6hdl9npy3k44shf56vcgjahn30qpmx3z5fsr3";
   };
 
+  strictDeps = true;
+
   # These flags were added to compile v3.18. Try to lift them when updating.
   NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
@@ -35,9 +37,15 @@ stdenv.mkDerivation rec {
     "-DNSS_PKCS11_2_0_COMPAT=1"
   ];
 
-  nativeBuildInputs = [ makeWrapper pkg-config ];
-  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
-                  libcap_ng curl nspr nss python ldns ]
+  nativeBuildInputs = [
+    bison
+    flex
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound pam libevent
+                  libcap_ng curl nspr nss python3 ldns ]
                 ++ lib.optional docs xmlto
                 ++ lib.optional stdenv.isLinux libselinux;
 
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index 19e5f16924a5..bb607c1fbd32 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -1,4 +1,4 @@
-{ coreutils, fetchFromGitHub, file, libcaca, makeWrapper, python, openssl, qrencode, lib, stdenv, yubikey-manager }:
+{ coreutils, fetchFromGitHub, file, libcaca, makeWrapper, python3, openssl, qrencode, lib, stdenv, yubikey-manager }:
 
 stdenv.mkDerivation rec {
   pname = "gen-oath-safe";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
         file
         libcaca.bin
         openssl.bin
-        python
+        python3
         qrencode
         yubikey-manager
       ];
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
index b8759d3571b5..ee06c112481b 100644
--- a/pkgs/tools/security/hash-slinger/default.nix
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, pythonPackages, unbound, libreswan }:
+{ lib, stdenv, fetchFromGitHub, python2Packages, unbound, libreswan }:
 
 let
-  inherit (pythonPackages) python;
+  pythonPackages = python2Packages;
 in stdenv.mkDerivation rec {
   pname    = "hash-slinger";
   version = "2.7";
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/man $out/${python.sitePackages}/
+    mkdir -p $out/bin $out/man $out/${pythonPackages.python.sitePackages}/
     make install
     wrapPythonPrograms
    '';
diff --git a/pkgs/tools/system/honcho/default.nix b/pkgs/tools/system/honcho/default.nix
index b653f2407244..17fa94893336 100644
--- a/pkgs/tools/system/honcho/default.nix
+++ b/pkgs/tools/system/honcho/default.nix
@@ -1,15 +1,14 @@
-{ lib, fetchFromGitHub, pythonPackages }:
+{ lib, fetchFromGitHub, python3Packages }:
 
 let
-  inherit (pythonPackages) python;
+  inherit (python3Packages) python;
   pname = "honcho";
 
 in
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   name = "${pname}-${version}";
   version = "1.0.1";
-  namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "nickstenning";
@@ -18,7 +17,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "11bd87474qpif20xdcn0ra1idj5k16ka51i658wfpxwc6nzsn92b";
   };
 
-  checkInputs = with pythonPackages; [ jinja2 pytest mock coverage ];
+  checkInputs = with python3Packages; [ jinja2 pytest mock coverage ];
 
   buildPhase = ''
     ${python.interpreter} setup.py build
diff --git a/pkgs/tools/text/icdiff/default.nix b/pkgs/tools/text/icdiff/default.nix
index 3ead56298cf6..c051560151a9 100644
--- a/pkgs/tools/text/icdiff/default.nix
+++ b/pkgs/tools/text/icdiff/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages }:
+{ lib, fetchFromGitHub, python3Packages, bash, git, less }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "icdiff";
   version = "1.9.5";
 
@@ -11,6 +11,20 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "080v8h09pv8qwplin4kwfm0kmqjwdqjfxbpcdrv16sv4hwfwl5qd";
   };
 
+  checkInputs = [
+    bash
+    git
+    less
+  ];
+
+  # error: could not lock config file /homeless-shelter/.gitconfig: No such file or directory
+  doCheck = false;
+
+  checkPhase = ''
+    patchShebangs test.sh
+    ./test.sh ${python3Packages.python.interpreter}
+  '';
+
   meta = with lib; {
     homepage = "https://www.jefftk.com/icdiff";
     description = "Side-by-side highlighted command line diffs";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2e22497a8a0a..f91dcbac1327 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -225,6 +225,7 @@ mapAliases ({
   fwupdate = throw "fwupdate was merged into fwupd"; # added 2020-05-19
   g4py = python3Packages.geant4; # added 2020-06-06
   gccApple = throw "gccApple is no longer supported"; # added 2018-04-25
+  gdal_1_11 = throw "gdal_1_11 was removed. Use gdal instead."; # added 2021-04-03
   gdb-multitarget = gdb; # added 2017-11-13
   gdk_pixbuf = gdk-pixbuf; # added 2019-05-22
   gettextWithExpat = gettext; # 2016-02-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b77e6df6f0e9..7f8e8c013f25 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5945,8 +5945,6 @@ in
 
   kdbg = libsForQt5.callPackage ../development/tools/misc/kdbg { };
 
-  kippo = callPackage ../servers/kippo { };
-
   kristall = libsForQt5.callPackage ../applications/networking/browsers/kristall { };
 
   lagrange = callPackage ../applications/networking/browsers/lagrange {
@@ -14266,8 +14264,6 @@ in
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  gdal_1_11 = callPackage ../development/libraries/gdal/gdal-1_11.nix { };
-
   gdal_2 = callPackage ../development/libraries/gdal/2.4.nix { };
 
   gdcm = callPackage ../development/libraries/gdcm { };
@@ -15362,7 +15358,9 @@ in
 
   libgxps = callPackage ../development/libraries/libgxps { };
 
-  libiio = callPackage ../development/libraries/libiio { };
+  libiio = callPackage ../development/libraries/libiio {
+    python = python3;
+  };
 
   libinjection = callPackage ../development/libraries/libinjection { };
 
@@ -22783,7 +22781,7 @@ in
 
   gthumb = callPackage ../applications/graphics/gthumb { };
 
-  gtimelog = pythonPackages.gtimelog;
+  gtimelog = with python3Packages; toPythonApplication gtimelog;
 
   inherit (gnome3) gucharmap;
 
@@ -27454,9 +27452,7 @@ in
 
   icbm3d = callPackage ../games/icbm3d { };
 
-  ingen = callPackage ../applications/audio/ingen {
-    inherit (pythonPackages) rdflib;
-  };
+  ingen = callPackage ../applications/audio/ingen { };
 
   ideogram = callPackage ../applications/graphics/ideogram { };
 
diff --git a/pkgs/top-level/gnuradio-packages.nix b/pkgs/top-level/gnuradio-packages.nix
index e5c2c8be3131..eaffce4c6e2c 100644
--- a/pkgs/top-level/gnuradio-packages.nix
+++ b/pkgs/top-level/gnuradio-packages.nix
@@ -31,6 +31,7 @@ in {
   ### Packages
 
   inherit gnuradio;
+  inherit (gnuradio) python;
 
   osmosdr = callPackage ../development/gnuradio-modules/osmosdr/default.nix { };