Revert "firefox-bin: remove workaround"

This reverts commit 2893902201.

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -20,6 +20,7 @@
 , runtimeShell
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 , patchelfUnstable  # have to use patchelfUnstable to support --no-clobber-old-sections
+, makeWrapper
 }:
 
 let
@@ -57,6 +58,20 @@ let
   source = lib.findFirst (sourceMatches mozLocale) defaultSource sources;
 
   pname = "firefox-${channel}-bin-unwrapped";
+
+  # FIXME: workaround for not being able to pass flags to patchelf
+  # Remove after https://github.com/NixOS/nixpkgs/pull/256525
+  wrappedPatchelf = stdenv.mkDerivation {
+    pname = "patchelf-wrapped";
+    inherit (patchelfUnstable) version;
+
+    nativeBuildInputs = [ makeWrapper ];
+
+    buildCommand = ''
+      mkdir -p $out/bin
+      makeWrapper ${patchelfUnstable}/bin/patchelf $out/bin/patchelf --append-flags "--no-clobber-old-sections"
+    '';
+  };
 in
 
 stdenv.mkDerivation {
@@ -64,7 +79,7 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook patchelfUnstable ];
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook wrappedPatchelf ];
   buildInputs = [
     gtk3
     adwaita-icon-theme
@@ -80,8 +95,6 @@ stdenv.mkDerivation {
   appendRunpaths = [
     "${pipewire}/lib"
   ];
-  # Firefox uses "relrhack" to manually process relocations from a fixed offset
-  patchelfFlags = [ "--no-clobber-old-sections" ];
 
   installPhase =
     ''