diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index ebd889d1a99e..0bed93d76edb 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -4,10 +4,15 @@
 , utillinux
 , writeTextFile, ubootTools
 , callPackage
+, overrideCC, gcc7
 }:
 
 { stdenv, buildPackages, perl, buildLinux
 
+, # Allow really overriding even our gcc7 default.
+  # We want gcc >= 7.3 to enable the "retpoline" mitigation of security problems.
+  stdenvNoOverride ? overrideCC stdenv gcc7
+
 , # The kernel source tarball.
   src
 
@@ -32,12 +37,14 @@
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
 , ignoreConfigErrors ? hostPlatform.platform.name != "pc" ||
-                       hostPlatform != stdenv.buildPlatform
+                       hostPlatform != stdenvNoOverride.buildPlatform
 , extraMeta ? {}
 , hostPlatform
 , ...
 } @ args:
 
+let stdenv = stdenvNoOverride; in # finish the rename
+
 assert stdenv.isLinux;
 
 let