diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 1a32f365bab2..b2545d0ad0e5 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -35,7 +35,7 @@
 
 # Note: the hardening flags are part of the bintools-wrapper, rather than
 # the cc-wrapper, because a few of them are handled by the linker.
-, defaultHardeningFlags ? with stdenvNoCC; [
+, defaultHardeningFlags ? [
     "bindnow"
     "format"
     "fortify"
@@ -44,7 +44,7 @@
     "relro"
     "stackprotector"
     "strictoverflow"
-  ] ++ lib.optional (
+  ] ++ lib.optional (with stdenvNoCC;
     # Musl-based platforms will keep "pie", other platforms will not.
     # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
     # in the nixpkgs manual to inform users about the defaults.
@@ -59,15 +59,30 @@
 , postLinkSignHook ? null, signingUtils ? null
 }:
 
-with lib;
-
 assert nativeTools -> !propagateDoc && nativePrefix != "";
-assert !nativeTools ->
-  bintools != null && coreutils != null && gnugrep != null;
+assert !nativeTools -> bintools != null && coreutils != null && gnugrep != null;
 assert !(nativeLibc && noLibc);
 assert (noLibc || nativeLibc) == (libc == null);
 
 let
+  inherit (lib)
+    attrByPath
+    concatStringsSep
+    getBin
+    getDev
+    getLib
+    getName
+    getVersion
+    hasSuffix
+    optional
+    optionalAttrs
+    optionals
+    optionalString
+    platforms
+    removePrefix
+    replaceStrings
+    ;
+
   stdenv = stdenvNoCC;
   inherit (stdenv) hostPlatform targetPlatform;
 
@@ -75,18 +90,18 @@ let
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
   # default.
-  targetPrefix = lib.optionalString (targetPlatform != hostPlatform)
+  targetPrefix = optionalString (targetPlatform != hostPlatform)
                                         (targetPlatform.config + "-");
 
-  bintoolsVersion = lib.getVersion bintools;
-  bintoolsName = lib.removePrefix targetPrefix (lib.getName bintools);
+  bintoolsVersion = getVersion bintools;
+  bintoolsName = removePrefix targetPrefix (getName bintools);
 
-  libc_bin = lib.optionalString (libc != null) (getBin libc);
-  libc_dev = lib.optionalString (libc != null) (getDev libc);
-  libc_lib = lib.optionalString (libc != null) (getLib libc);
-  bintools_bin = lib.optionalString (!nativeTools) (getBin bintools);
+  libc_bin = optionalString (libc != null) (getBin libc);
+  libc_dev = optionalString (libc != null) (getDev libc);
+  libc_lib = optionalString (libc != null) (getLib libc);
+  bintools_bin = optionalString (!nativeTools) (getBin bintools);
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
-  coreutils_bin = lib.optionalString (!nativeTools) (getBin coreutils);
+  coreutils_bin = optionalString (!nativeTools) (getBin coreutils);
 
   # See description in cc-wrapper.
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
@@ -114,11 +129,11 @@ let
     else if targetPlatform.isLoongArch64              then "${sharedLibraryLoader}/lib/ld-linux-loongarch*.so.1"
     else if targetPlatform.isDarwin                   then "/usr/lib/dyld"
     else if targetPlatform.isFreeBSD                  then "/libexec/ld-elf.so.1"
-    else if lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
+    else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
     else "";
 
   expand-response-params =
-    lib.optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
+    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
     (import ../expand-response-params { inherit (buildPackages) stdenv; });
 
 in
@@ -126,7 +141,7 @@ in
 stdenv.mkDerivation {
   pname = targetPrefix
     + (if name != "" then name else "${bintoolsName}-wrapper");
-  version = lib.optionalString (bintools != null) bintoolsVersion;
+  version = optionalString (bintools != null) bintoolsVersion;
 
   preferLocalBuild = true;
 
@@ -196,7 +211,7 @@ stdenv.mkDerivation {
     # as it must have both the GNU assembler from cctools (installed as `gas`)
     # and the Clang integrated assembler (installed as `as`).
     # See pkgs/os-specific/darwin/binutils/default.nix for details.
-    + lib.optionalString wrapGas ''
+    + optionalString wrapGas ''
       if [ -e $ldPath/${targetPrefix}gas ]; then
         ln -s $ldPath/${targetPrefix}gas $out/bin/${targetPrefix}gas
       fi
@@ -273,7 +288,7 @@ stdenv.mkDerivation {
 
         ${if targetPlatform.isDarwin then ''
           printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
-        '' else lib.optionalString (sharedLibraryLoader != null) ''
+        '' else optionalString (sharedLibraryLoader != null) ''
           if [ -e ${sharedLibraryLoader}/lib/32/ld-linux.so.2 ]; then
             echo ${sharedLibraryLoader}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
           fi
@@ -290,7 +305,7 @@ stdenv.mkDerivation {
     # install the wrapper, you get tools like objdump (same for any
     # binaries of libc).
     + optionalString (!nativeTools) ''
-      printWords ${bintools_bin} ${lib.optionalString (libc != null) libc_bin} > $out/nix-support/propagated-user-env-packages
+      printWords ${bintools_bin} ${optionalString (libc != null) libc_bin} > $out/nix-support/propagated-user-env-packages
     ''
 
     ##
@@ -406,7 +421,7 @@ stdenv.mkDerivation {
     # for substitution in utils.bash
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
     shell = getBin shell + shell.shellPath or "";
-    gnugrep_bin = lib.optionalString (!nativeTools) gnugrep;
+    gnugrep_bin = optionalString (!nativeTools) gnugrep;
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
     inherit bintools_bin libc_bin libc_dev libc_lib;
@@ -414,13 +429,13 @@ stdenv.mkDerivation {
   };
 
   meta =
-    let bintools_ = lib.optionalAttrs (bintools != null) bintools; in
-    (lib.optionalAttrs (bintools_ ? meta) (removeAttrs bintools.meta ["priority"])) //
+    let bintools_ = optionalAttrs (bintools != null) bintools; in
+    (optionalAttrs (bintools_ ? meta) (removeAttrs bintools.meta ["priority"])) //
     { description =
-        lib.attrByPath ["meta" "description"] "System binary utilities" bintools_
+        attrByPath ["meta" "description"] "System binary utilities" bintools_
         + " (wrapper script)";
       priority = 10;
   } // optionalAttrs useMacosReexportHack {
-    platforms = lib.platforms.darwin;
+    platforms = platforms.darwin;
   };
 }