diff --git a/pkgs/applications/audio/clerk/default.nix b/pkgs/applications/audio/clerk/default.nix
index a2e71b955ec..ebcd09ca6ad 100644
--- a/pkgs/applications/audio/clerk/default.nix
+++ b/pkgs/applications/audio/clerk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, rofi, mpc_cli, perl,
-util-linux, pythonPackages, libnotify }:
+util-linux, python3Packages, libnotify }:
 
 stdenv.mkDerivation {
   name = "clerk-2016-10-14";
@@ -12,10 +12,12 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pythonPackages.mpd2 ];
+  buildInputs = [ python3Packages.mpd2 ];
 
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     DESTDIR=$out PREFIX=/ make install
     wrapProgram $out/bin/clerk \
diff --git a/pkgs/applications/editors/bluefish/default.nix b/pkgs/applications/editors/bluefish/default.nix
index 2507cb13d7a..59d1f11312d 100644
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, intltool, wrapGAppsHook, pkg-config , gtk, libxml2
-, enchant, gucharmap, python, gnome3
+, enchant, gucharmap, python3, gnome3
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkg-config wrapGAppsHook ];
   buildInputs = [ gnome3.adwaita-icon-theme gtk libxml2
-    enchant gucharmap python ];
+    enchant gucharmap python3 ];
 
   meta = with lib; {
     description = "A powerful editor targeted towards programmers and webdevelopers";
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index d9de3eb7fc1..d07904c8597 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, autoconf, automake, libtool, gtk2, pkg-config, perlPackages,
-libxml2, gettext, python, libxml2Python, docbook5, docbook_xsl,
+libxml2, gettext, python2, libxml2Python, docbook5, docbook_xsl,
 libxslt, intltool, libart_lgpl, withGNOME ? false, libgnomeui,
 gtk-mac-integration-gtk2 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs =
-    [ gtk2 libxml2 gettext python libxml2Python docbook5
+    [ gtk2 libxml2 gettext python2 libxml2Python docbook5
       libxslt docbook_xsl libart_lgpl ]
       ++ lib.optional withGNOME libgnomeui
       ++ lib.optional stdenv.isDarwin gtk-mac-integration-gtk2;
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
index d50f3637988..52d56d5c8f5 100644
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -1,10 +1,10 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, curl, python, bind, iproute, bc, gitMinimal }:
+, curl, python3, bind, iproute, bc, gitMinimal }:
 let
   version = "1.23.0";
   deps = lib.makeBinPath [
     curl
-    python
+    python3
     bind.dnsutils
     iproute
     bc
@@ -24,11 +24,13 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs install.sh
     substituteInPlace install.sh --replace /usr/local "$out"
   '';
 
+  strictDeps = true;
+
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index c74ac5ffb30..0ce89afa6ce 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gettext }:
+{ lib, fetchFromGitHub, python2Packages, gettext }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "cherrytree";
   version = "0.39.4";
 
@@ -14,7 +14,7 @@ pythonPackages.buildPythonApplication rec {
 
   nativeBuildInputs = [ gettext ];
 
-  propagatedBuildInputs = with pythonPackages; [ pygtk dbus-python pygtksourceview ];
+  propagatedBuildInputs = with python2Packages; [ pygtk dbus-python pygtksourceview ];
 
   patches = [ ./subprocess.patch ];
 
diff --git a/pkgs/applications/misc/curabydagoma/default.nix b/pkgs/applications/misc/curabydagoma/default.nix
index 821b88f9b20..a8d041de107 100644
--- a/pkgs/applications/misc/curabydagoma/default.nix
+++ b/pkgs/applications/misc/curabydagoma/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runtimeShell, lib, fetchurl, python, pythonPackages, unzip }:
+{ stdenv, runtimeShell, lib, fetchurl, python2Packages, unzip }:
 
 # This package uses a precompiled "binary" distribution of CuraByDagoma,
 # distributed by the editor.
@@ -13,7 +13,9 @@
 # I guess people owning a 3D printer generally don't use i686.
 # If, however, someone needs it, we certainly can find a solution.
 
-stdenv.mkDerivation rec {
+let
+  pythonPackages = python2Packages;
+in stdenv.mkDerivation rec {
   pname = "curabydagoma";
   # Version is the date, UNIX format
   version = "1520506579";
@@ -26,7 +28,7 @@ stdenv.mkDerivation rec {
   };
   unpackCmd = "unzip $curSrc && tar zxf CuraByDagoma_amd64.tar.gz";
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
+  buildInputs = [ pythonPackages.python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
 
   # Compile all pyc files because the included pyc files may be older than the
   # py files. However, Python doesn't realize that because the packages
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/curabydago <<EOF
     #!${runtimeShell}
     export PYTHONPATH=$PYTHONPATH
-    ${python.out}/bin/python $out/curabydago/cura.py
+    ${pythonPackages.python.interpreter} $out/curabydago/cura.py
     EOF
     chmod a+x $out/bin/curabydago
 
diff --git a/pkgs/applications/misc/dockbarx/default.nix b/pkgs/applications/misc/dockbarx/default.nix
index b31c17cc319..5bc8de522de 100644
--- a/pkgs/applications/misc/dockbarx/default.nix
+++ b/pkgs/applications/misc/dockbarx/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gnome2, keybinder }:
+{ lib, fetchFromGitHub, python2Packages, gnome2, keybinder }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   ver = "0.93";
   name = "dockbarx-${ver}";
 
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
     substituteInPlace dockx_applets/volume-control.py         --replace /usr/share/             $out/share/
   '';
 
-  propagatedBuildInputs = (with pythonPackages; [ pygtk pyxdg dbus-python pillow xlib ])
+  propagatedBuildInputs = (with python2Packages; [ pygtk pyxdg dbus-python pillow xlib ])
     ++ (with gnome2; [ gnome_python gnome_python_desktop ])
     ++ [ keybinder ];
 
diff --git a/pkgs/applications/misc/dotfiles/default.nix b/pkgs/applications/misc/dotfiles/default.nix
index 911a319a963..b62d154feb1 100644
--- a/pkgs/applications/misc/dotfiles/default.nix
+++ b/pkgs/applications/misc/dotfiles/default.nix
@@ -1,10 +1,10 @@
-{ lib, pythonPackages }:
+{ lib, python3Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "dotfiles";
   version = "0.6.4";
 
-  src = pythonPackages.fetchPypi {
+  src = python3Packages.fetchPypi {
     inherit version pname;
     sha256 = "03qis6m9r2qh00sqbgwsm883s4bj1ibwpgk86yh4l235mdw8jywv";
   };
@@ -12,8 +12,8 @@ pythonPackages.buildPythonApplication rec {
   # No tests in archive
   doCheck = false;
 
-  checkInputs = with pythonPackages; [ pytest ];
-  propagatedBuildInputs = with pythonPackages; [ click ];
+  checkInputs = with python3Packages; [ pytest ];
+  propagatedBuildInputs = with python3Packages; [ click ];
 
   meta = with lib; {
     description = "Easily manage your dotfiles";
diff --git a/pkgs/applications/misc/gammu/default.nix b/pkgs/applications/misc/gammu/default.nix
index 0a6796a9b07..736685f5eb1 100644
--- a/pkgs/applications/misc/gammu/default.nix
+++ b/pkgs/applications/misc/gammu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pkg-config, cmake, bluez, libusb1, curl
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, bluez, libusb1, curl
 , libiconv, gettext, sqlite
 , dbiSupport ? false, libdbi ? null, libdbiDrivers ? null
 , postgresSupport ? false, postgresql ? null
@@ -21,7 +21,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ];
 
-  buildInputs = [ python bluez libusb1 curl gettext sqlite libiconv ]
+  strictDeps = true;
+
+  buildInputs = [ bluez libusb1 curl gettext sqlite libiconv ]
   ++ optionals dbiSupport [ libdbi libdbiDrivers ]
   ++ optionals postgresSupport [ postgresql ];
 
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
index 1a83a04a1fa..c5a718c3a70 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python
+{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python2
 , enableLibPurple ? false, pidgin ? null
 , enablePam ? false, pam ? null
 }:
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ] ++ optional doCheck check;
 
-  buildInputs = [ gnutls libotr python ]
+  buildInputs = [ gnutls libotr python2 ]
     ++ optional enableLibPurple pidgin
     ++ optional enablePam pam;
 
diff --git a/pkgs/applications/networking/instant-messengers/blink/default.nix b/pkgs/applications/networking/instant-messengers/blink/default.nix
index 3ee835610f7..805278b4e45 100644
--- a/pkgs/applications/networking/instant-messengers/blink/default.nix
+++ b/pkgs/applications/networking/instant-messengers/blink/default.nix
@@ -1,7 +1,7 @@
-{ lib, fetchdarcs, pythonPackages, libvncserver, zlib
+{ lib, fetchdarcs, python2Packages, libvncserver, zlib
 , gnutls, libvpx, makeDesktopItem, mkDerivationWith }:
 
-mkDerivationWith pythonPackages.buildPythonApplication rec {
+mkDerivationWith python2Packages.buildPythonApplication rec {
 
   pname = "blink";
   version = "3.2.0";
@@ -17,7 +17,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
     sed -i 's|@out@|'"''${out}"'|g' blink/resources.py
   '';
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python2Packages; [
     pyqt5_with_qtwebkit
     cjson
     sipsimple
@@ -26,7 +26,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    pythonPackages.cython
+    python2Packages.cython
     zlib
     libvncserver
     libvpx
diff --git a/pkgs/applications/radio/direwolf/default.nix b/pkgs/applications/radio/direwolf/default.nix
index e7da78034cc..4f8ca550490 100644
--- a/pkgs/applications/radio/direwolf/default.nix
+++ b/pkgs/applications/radio/direwolf/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, alsaLib, espeak, glibc, gpsd
-, hamlib, perl, python, udev }:
+, hamlib, perl, python3, udev }:
 
 with lib;
 
@@ -16,8 +16,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   buildInputs = [
-    espeak gpsd hamlib perl python
+    espeak gpsd hamlib perl python3
   ] ++ (optionals stdenv.isLinux [alsaLib udev]);
 
   patches = [
diff --git a/pkgs/applications/science/biology/bcftools/default.nix b/pkgs/applications/science/biology/bcftools/default.nix
index e15cac60295..80506bb79b6 100644
--- a/pkgs/applications/science/biology/bcftools/default.nix
+++ b/pkgs/applications/science/biology/bcftools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, htslib, zlib, bzip2, lzma, curl, perl, python, bash }:
+{ lib, stdenv, fetchurl, htslib, zlib, bzip2, lzma, curl, perl, python3, bash }:
 
 stdenv.mkDerivation rec {
   pname = "bcftools";
@@ -9,7 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "0r508mp15pqzf8r1269kb4v5naw9zsvbwd3cz8s1yj7carsf9viw";
   };
 
-  buildInputs = [ htslib zlib bzip2 lzma curl perl python ];
+  nativeBuildInputs = [
+    perl
+    python3
+  ];
+
+  buildInputs = [ htslib zlib bzip2 lzma curl ];
+
+  strictDeps = true;
 
   makeFlags = [
     "HSTDIR=${htslib}"
diff --git a/pkgs/applications/science/biology/bedtools/default.nix b/pkgs/applications/science/biology/bedtools/default.nix
index d0553bb0649..f5aad5d0554 100644
--- a/pkgs/applications/science/biology/bedtools/default.nix
+++ b/pkgs/applications/science/biology/bedtools/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitHub, zlib, python, bzip2, lzma}:
+{lib, stdenv, fetchFromGitHub, zlib, python3, bzip2, lzma}:
 
 stdenv.mkDerivation rec {
   pname = "bedtools";
@@ -11,7 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NqKldF7ePJn3pT+AkESIQghBKSFFOEBBsTaKEbU+oaQ=";
   };
 
-  buildInputs = [ zlib python bzip2 lzma ];
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    python3
+  ];
+
+  buildInputs = [ zlib bzip2 lzma ];
   cxx = if stdenv.cc.isClang then "clang++" else "g++";
   cc = if stdenv.cc.isClang then "clang" else "gcc";
   buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
diff --git a/pkgs/applications/virtualization/seabios/default.nix b/pkgs/applications/virtualization/seabios/default.nix
index f97f13dab2a..42e1eaf56d4 100644
--- a/pkgs/applications/virtualization/seabios/default.nix
+++ b/pkgs/applications/virtualization/seabios/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, iasl, python }:
+{ lib, stdenv, fetchurl, iasl, python3 }:
 
 stdenv.mkDerivation rec {
 
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1zc1brgafbbf5hmdr1qc1p859cabpz73l8sklq83xa4sn9icqw7b";
   };
 
-  buildInputs = [ iasl python ];
+  nativeBuildInputs = [ python3 ];
+
+  buildInputs = [ iasl ];
+
+  strictDeps = true;
 
   hardeningDisable = [ "pic" "stackprotector" "fortify" ];
 
diff --git a/pkgs/data/misc/conway_polynomials/default.nix b/pkgs/data/misc/conway_polynomials/default.nix
index f7da9381e61..cabc28a89ce 100644
--- a/pkgs/data/misc/conway_polynomials/default.nix
+++ b/pkgs/data/misc/conway_polynomials/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv
 , fetchurl
-, python
+, python2
 }:
 
 stdenv.mkDerivation rec {
   pname = "conway_polynomials";
   version = "0.5";
 
-  pythonEnv = python.withPackages (ps: with ps; [ six ]);
+  pythonEnv = python2.withPackages (ps: with ps; [ six ]);
 
   src = fetchurl {
     url = "mirror://sageupstream/conway_polynomials/conway_polynomials-${version}.tar.bz2";
diff --git a/pkgs/data/misc/elliptic_curves/default.nix b/pkgs/data/misc/elliptic_curves/default.nix
index 988716f5429..98259400021 100644
--- a/pkgs/data/misc/elliptic_curves/default.nix
+++ b/pkgs/data/misc/elliptic_curves/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchurl
-, python
+, python2
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     export SAGE_SHARE="$out/share"
     export PYTHONPATH=$PWD
 
-    ${python.interpreter} ${spkg-install}
+    ${python2.interpreter} ${spkg-install}
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/libkkc-data/default.nix b/pkgs/data/misc/libkkc-data/default.nix
index 96130b2de5e..7fcd2fbf516 100644
--- a/pkgs/data/misc/libkkc-data/default.nix
+++ b/pkgs/data/misc/libkkc-data/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, marisa, libkkc }:
+{ lib, stdenv, fetchurl, python2, libkkc }:
 
 stdenv.mkDerivation rec {
   pname = "libkkc-data";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "16avb50jasq2f1n9xyziky39dhlnlad0991pisk3s11hl1aqfrwy";
   };
 
-  nativeBuildInputs = [ marisa ];
+  nativeBuildInputs = [ python2.pkgs.marisa ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Language model data package for libkkc";
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index df674b67db8..c52ffa0bafd 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, runtimeShell }:
+{ lib, stdenv, fetchurl, python3, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "cmdstan-2.17.1";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   doCheck = true;
-  checkInputs = [ python ];
+  checkInputs = [ python3 ];
   checkPhase = "python ./runCmdStanTests.py src/test/interface"; # see #5368
 
   installPhase = ''
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index c5d33590daa..245e5bf2f54 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -1,7 +1,9 @@
 { stdenv, lib, fetchgit, flex, bison, pkg-config, which
-, pythonSupport ? false, python, swig
+, pythonSupport ? false, python ? null, swig
 }:
 
+assert pythonSupport -> python != null;
+
 stdenv.mkDerivation rec {
   pname = "dtc";
   version = "1.6.0";
diff --git a/pkgs/development/interpreters/cling/default.nix b/pkgs/development/interpreters/cling/default.nix
index 8f80d2f4ee6..dbc2751e789 100644
--- a/pkgs/development/interpreters/cling/default.nix
+++ b/pkgs/development/interpreters/cling/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, python
+, python3
 , libffi
 , git
 , cmake
@@ -38,9 +38,11 @@ let
       chmod -R a+w ./tools/cling
     '';
 
-    nativeBuildInputs = [ python git cmake ];
+    nativeBuildInputs = [ python3 git cmake ];
     buildInputs = [ libffi llvmPackages_5.llvm zlib ];
 
+    strictDeps = true;
+
     cmakeFlags = [
       "-DLLVM_TARGETS_TO_BUILD=host;NVPTX"
       "-DLLVM_ENABLE_RTTI=ON"
diff --git a/pkgs/development/libraries/arrayfire/default.nix b/pkgs/development/libraries/arrayfire/default.nix
index c636d672332..a66db480017 100644
--- a/pkgs/development/libraries/arrayfire/default.nix
+++ b/pkgs/development/libraries/arrayfire/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, cmake, pkg-config
 , opencl-clhpp, ocl-icd, fftw, fftwFloat
 , blas, lapack, boost, mesa, libGLU, libGL
-, freeimage, python, clfft, clblas
+, freeimage, python3, clfft, clblas
 , doxygen, buildDocs ? false
 , cudaSupport ? false, cudatoolkit
 }:
@@ -39,9 +39,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    python
+    python3
   ];
 
+  strictDeps = true;
+
   buildInputs = [
     opencl-clhpp fftw fftwFloat
     blas lapack
diff --git a/pkgs/development/libraries/aubio/default.nix b/pkgs/development/libraries/aubio/default.nix
index 7aa4859ef0e..b1c6c6396c8 100644
--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, alsaLib, fftw, libjack2, libsamplerate
-, libsndfile, pkg-config, python, wafHook
+, libsndfile, pkg-config, python3, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -10,9 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
   };
 
-  nativeBuildInputs = [ pkg-config python wafHook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
   buildInputs = [ alsaLib fftw libjack2 libsamplerate libsndfile ];
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Library for audio labelling";
     homepage = "https://aubio.org/";
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 0369f603b8e..33f9daf7b50 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, bzip2, zlib, gmp, openssl, boost
+{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, openssl, boost
 # Passed by version specific builders
 , baseVersion, revision, sha256
 , sourceExtension ? "tar.xz"
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
   inherit postPatch;
 
-  buildInputs = [ python bzip2 zlib gmp openssl boost ]
+  buildInputs = [ python3 bzip2 zlib gmp openssl boost ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
diff --git a/pkgs/development/libraries/clearsilver/default.nix b/pkgs/development/libraries/clearsilver/default.nix
index 74d167144a9..73ffd6c12b2 100644
--- a/pkgs/development/libraries/clearsilver/default.nix
+++ b/pkgs/development/libraries/clearsilver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python }:
+{ lib, stdenv, fetchurl, fetchpatch, python2 }:
 
 stdenv.mkDerivation rec {
   name = "clearsilver-0.10.5";
@@ -8,10 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "1046m1dpq3nkgxbis2dr2x7hynmy51n64465q78d7pdgvqwa178y";
   };
 
-  PYTHON_SITE = "$(out)/site-packages";
+  PYTHON_SITE = "${placeholder "out"}/${python2.sitePackages}";
 
   configureFlags = [
-    "--with-python=${python}/bin/python"
+    "--with-python=${python2.interpreter}"
     "--disable-apache"
     "--disable-perl"
     "--disable-ruby"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   preInstall = ''
     mkdir -p $out
-    mkdir -p $out/site-packages
+    mkdir -p $out/${python2.sitePackages}
   '';
 
   patches = [
diff --git a/pkgs/development/libraries/cppcms/default.nix b/pkgs/development/libraries/cppcms/default.nix
index aceb2d61e38..e0f9ed59912 100644
--- a/pkgs/development/libraries/cppcms/default.nix
+++ b/pkgs/development/libraries/cppcms/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, pcre, zlib, python, openssl }:
+{ lib, stdenv, fetchurl, cmake, pcre, zlib, python2, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "cppcms";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ pcre zlib python openssl ];
+  buildInputs = [ pcre zlib python2 openssl ];
+
+  strictDeps = true;
 
   cmakeFlags = [
     "--no-warn-unused-cli"
diff --git a/pkgs/development/libraries/docopt_cpp/default.nix b/pkgs/development/libraries/docopt_cpp/default.nix
index f9456b8acac..3de84b684e5 100644
--- a/pkgs/development/libraries/docopt_cpp/default.nix
+++ b/pkgs/development/libraries/docopt_cpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "0cz3vv7g5snfbsqcf3q8bmd6kv5qp84gj3avwkn4vl00krw13bl7";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python2 ];
 
   cmakeFlags = ["-DWITH_TESTS=ON"];
 
+  strictDeps = true;
+
   doCheck = true;
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gaia/default.nix b/pkgs/development/libraries/gaia/default.nix
index 088354aecb2..47926e2ec0b 100644
--- a/pkgs/development/libraries/gaia/default.nix
+++ b/pkgs/development/libraries/gaia/default.nix
@@ -9,7 +9,7 @@
 , wafHook
 , makeWrapper
 , qt4
-, pythonPackages
+, pythonPackages ? null
 , pythonSupport ? false
 # Default to false since it breaks the build, see https://github.com/MTG/gaia/issues/11
 , stlfacadeSupport ? false
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 888f26f2da7..4e28f84bacd 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -5,7 +5,7 @@
 , fftw
 , fftwFloat
 , enablePython ? false
-, pythonPackages
+, pythonPackages ? null
 , llvmPackages
 }:
 let
diff --git a/pkgs/development/libraries/ganv/default.nix b/pkgs/development/libraries/ganv/default.nix
index bf6c030589b..d53206ca667 100644
--- a/pkgs/development/libraries/ganv/default.nix
+++ b/pkgs/development/libraries/ganv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python, wafHook }:
+{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "ganv";
@@ -11,8 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "01znnalirbqxpz62fbw2c14c8xn117jc92xv6dhb3hln92k9x37f";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook ];
-  buildInputs = [ graphviz gtk2 gtkmm2 python ];
+  nativeBuildInputs = [ pkg-config wafHook python3 gtk2 ];
+  buildInputs = [ graphviz gtkmm2 ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "An interactive Gtk canvas widget for graph-based interfaces";
diff --git a/pkgs/development/libraries/jxrlib/default.nix b/pkgs/development/libraries/jxrlib/default.nix
index 78cc48d8209..b2cc4ab08b4 100644
--- a/pkgs/development/libraries/jxrlib/default.nix
+++ b/pkgs/development/libraries/jxrlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "jxrlib";
@@ -19,7 +19,9 @@ stdenv.mkDerivation rec {
       --replace '.so' '.dylib'
   '';
 
-  nativeBuildInputs = [ python ];
+  nativeBuildInputs = [ python3 ];
+
+  strictDeps = true;
 
   makeFlags = [ "DIR_INSTALL=$(out)" "SHARED=1" ];
 
diff --git a/pkgs/development/libraries/opencl-clhpp/default.nix b/pkgs/development/libraries/opencl-clhpp/default.nix
index ec40bc393d5..b6aa7149168 100644
--- a/pkgs/development/libraries/opencl-clhpp/default.nix
+++ b/pkgs/development/libraries/opencl-clhpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python, opencl-headers }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, opencl-headers }:
 
 stdenv.mkDerivation rec {
   pname = "opencl-clhpp";
@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "04g3mg2cpbi048fxxkghra81bpxzqr4r3gspx5mvqipx1lzypsci";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python3 ];
 
   propagatedBuildInputs = [ opencl-headers ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     "-DBUILD_EXAMPLES=OFF"
     "-DBUILD_TESTS=OFF"
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 11872cd47cc..a65e978f981 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -18,7 +18,7 @@
 
 , enableUnfree    ? false
 , enableIpp       ? false
-, enablePython    ? false, pythonPackages
+, enablePython    ? false, pythonPackages ? null
 , enableGtk2      ? false, gtk2
 , enableGtk3      ? false, gtk3
 , enableVtk       ? false, vtk
@@ -36,6 +36,8 @@
 
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
+assert enablePython -> pythonPackages != null;
+
 let
   version = "3.4.8";
 
diff --git a/pkgs/development/libraries/partio/default.nix b/pkgs/development/libraries/partio/default.nix
index 0247d12715f..d4af69532b3 100644
--- a/pkgs/development/libraries/partio/default.nix
+++ b/pkgs/development/libraries/partio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, unzip, cmake, freeglut, libGLU, libGL, zlib, swig, python, doxygen, xorg }:
+{ lib, stdenv, fetchFromGitHub, unzip, cmake, freeglut, libGLU, libGL, zlib, swig, doxygen, xorg }:
 
 stdenv.mkDerivation {
   pname = "partio";
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   outputs = [ "dev" "out" "lib" ];
 
   nativeBuildInputs = [ unzip cmake doxygen ];
-  buildInputs = [ freeglut libGLU libGL zlib swig python xorg.libXi xorg.libXmu ];
+  buildInputs = [ freeglut libGLU libGL zlib swig xorg.libXi xorg.libXmu ];
 
   buildPhase = ''
     make partio
@@ -32,6 +32,8 @@ stdenv.mkDerivation {
     mv $dev/include/*.h $dev/include/partio
   '';
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "C++ (with python bindings) library for easily reading/writing/manipulating common animation particle formats such as PDB, BGEO, PTC";
     homepage = "https://www.disneyanimation.com/technology/partio.html";
diff --git a/pkgs/development/libraries/science/math/clblas/default.nix b/pkgs/development/libraries/science/math/clblas/default.nix
index aca395001f9..fcb49d70a3b 100644
--- a/pkgs/development/libraries/science/math/clblas/default.nix
+++ b/pkgs/development/libraries/science/math/clblas/default.nix
@@ -4,7 +4,7 @@
 , gfortran
 , blas
 , boost
-, python
+, python3
 , ocl-icd
 , opencl-headers
 , Accelerate, CoreGraphics, CoreVideo, OpenCL
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gfortran
     blas
-    python
+    python3
     boost
   ] ++ lib.optionals (!stdenv.isDarwin) [
     ocl-icd
@@ -53,6 +53,8 @@ stdenv.mkDerivation rec {
     OpenCL
   ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "https://github.com/clMathLibraries/clBLAS";
     description = "A software library containing BLAS functions written in OpenCL";
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 166d0f2911d..cd737a82a29 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, freetype, cmake, python }:
+{ lib, stdenv, fetchurl, pkg-config, freetype, cmake }:
 
 stdenv.mkDerivation rec {
   version = "1.3.14";
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
-  checkInputs = [ python ];
   doCheck = false; # fails, probably missing something
 
   meta = with lib; {
diff --git a/pkgs/development/tools/bazel-watcher/default.nix b/pkgs/development/tools/bazel-watcher/default.nix
index bc3a2828f6c..657704a653c 100644
--- a/pkgs/development/tools/bazel-watcher/default.nix
+++ b/pkgs/development/tools/bazel-watcher/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , git
 , go
-, python
+, python3
 , lib, stdenv
 }:
 
@@ -22,7 +22,7 @@ buildBazelPackage rec {
     sha256 = "0gigl1lg8sb4bj5crvj54329ws4yirldbncs15f96db6vhp0ig7r";
   };
 
-  nativeBuildInputs = [ go git python ];
+  nativeBuildInputs = [ go git python3 ];
   removeRulesCC = false;
 
   bazelTarget = "//ibazel";
diff --git a/pkgs/development/tools/build-managers/bam/default.nix b/pkgs/development/tools/build-managers/bam/default.nix
index a828c57b8c0..556725cca6c 100644
--- a/pkgs/development/tools/build-managers/bam/default.nix
+++ b/pkgs/development/tools/build-managers/bam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, lua5_3, python }:
+{ lib, stdenv, fetchFromGitHub, lua5_3, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "bam";
@@ -11,11 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "13br735ig7lygvzyfd15fc2rdygrqm503j6xj5xkrl1r7w2wipq6";
   };
 
-  buildInputs = [ lua5_3 python ];
+  nativeBuildInputs = [ lua5_3 python3 ];
 
   buildPhase = "${stdenv.shell} make_unix.sh";
 
-  checkPhase = "${python.interpreter} scripts/test.py";
+  checkPhase = "${python3.interpreter} scripts/test.py";
+
+  strictDeps = true;
 
   installPhase = ''
     mkdir -p "$out/share/bam"
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
index 2ec244e502b..f03f42be389 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
@@ -1,6 +1,6 @@
 { stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
 , zip, unzip, bash, writeCBin, coreutils
-, which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
+, which, python3, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # Apple dependencies
 , cctools, llvmPackages_8, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@@ -210,8 +210,8 @@ stdenv'.mkDerivation rec {
       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
       # See also `postFixup` where python is added to $out/nix-support
       substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
-          --replace "/usr/bin/env python" "${python}/bin/python" \
-          --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
+          --replace "/usr/bin/env python" "${python3.interpreter}" \
+          --replace "NIX_STORE_PYTHON_PATH" "${python3.interpreter}" \
 
       # md5sum is part of coreutils
       sed -i 's|/sbin/md5|md5sum|' \
@@ -287,11 +287,13 @@ stdenv'.mkDerivation rec {
     buildJdk
   ];
 
+  strictDeps = true;
+
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
     zip
-    python
+    python3
     unzip
     makeWrapper
     which
@@ -380,7 +382,7 @@ stdenv'.mkDerivation rec {
     echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
     # The templates get tar’d up into a .jar,
     # so nix can’t detect python is needed in the runtime closure
-    echo "${python}" >> $out/nix-support/depends
+    echo "${python3}" >> $out/nix-support/depends
   '';
 
   dontStrip = true;
diff --git a/pkgs/development/tools/cask/default.nix b/pkgs/development/tools/cask/default.nix
index 886d435b811..1c5f316cea9 100644
--- a/pkgs/development/tools/cask/default.nix
+++ b/pkgs/development/tools/cask/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, emacs }:
+{ lib, stdenv, fetchurl, python3, emacs }:
 
 stdenv.mkDerivation rec {
   pname = "cask";
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
     s f dash ansi ecukes servant ert-runner el-mock
     noflet ert-async shell-split-string git package-build
   ] ++ [
-    python
+    python3
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     emacs --batch -L . -f batch-byte-compile cask.el cask-cli.el
   '';
diff --git a/pkgs/development/tools/fedpkg/default.nix b/pkgs/development/tools/fedpkg/default.nix
index d9633e88f34..2ba0f494c21 100644
--- a/pkgs/development/tools/fedpkg/default.nix
+++ b/pkgs/development/tools/fedpkg/default.nix
@@ -1,4 +1,6 @@
-{ lib, buildPythonApplication, buildPythonPackage, isPy3k, fetchurl, rpkg, offtrac, urlgrabber, pyopenssl, python_fedora }:
+{ lib, python2Packages, fetchurl }:
+
+with python2Packages;
 
 let
   fedora_cert = buildPythonPackage rec {
diff --git a/pkgs/development/tools/misc/blackmagic/default.nix b/pkgs/development/tools/misc/blackmagic/default.nix
index fc1af1a4d68..080bc7a7f74 100644
--- a/pkgs/development/tools/misc/blackmagic/default.nix
+++ b/pkgs/development/tools/misc/blackmagic/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub
 , gcc-arm-embedded, libftdi1, libusb-compat-0_1, pkg-config
-, python, pythonPackages
+, python3
 }:
 
 with lib;
@@ -21,15 +21,16 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gcc-arm-embedded pkg-config
+    python3
   ];
 
   buildInputs = [
     libftdi1
     libusb-compat-0_1
-    python
-    pythonPackages.intelhex
   ];
 
+  strictDeps = true;
+
   postPatch = ''
     # Prevent calling out to `git' to generate a version number:
     substituteInPlace src/Makefile \
diff --git a/pkgs/development/tools/misc/cli11/default.nix b/pkgs/development/tools/misc/cli11/default.nix
index 03c3e51cb89..d62ad413e1a 100644
--- a/pkgs/development/tools/misc/cli11/default.nix
+++ b/pkgs/development/tools/misc/cli11/default.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   cmake,
   gtest,
-  python,
+  python3,
   boost
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  checkInputs = [ boost python ];
+  checkInputs = [ boost python3 ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index cad9fe0960b..38ddc1ff431 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, popt, avahi, pkg-config, python, gtk2, runCommand
+{ lib, stdenv, fetchFromGitHub, popt, avahi, pkg-config, python3, gtk2, runCommand
 , gcc, autoconf, automake, which, procps, libiberty_static
 , runtimeShell
 , sysconfDir ? ""   # set this parameter to override the default value $out/etc
@@ -18,7 +18,7 @@ let
     };
 
   nativeBuildInputs = [ pkg-config ];
-    buildInputs = [popt avahi pkg-config python gtk2 autoconf automake which procps libiberty_static];
+    buildInputs = [popt avahi pkg-config python3 gtk2 autoconf automake which procps libiberty_static];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/misc/doclifter/default.nix b/pkgs/development/tools/misc/doclifter/default.nix
index 8b771788111..0692d84b454 100644
--- a/pkgs/development/tools/misc/doclifter/default.nix
+++ b/pkgs/development/tools/misc/doclifter/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, python}:
+{lib, stdenv, fetchurl, python3}:
 
 stdenv.mkDerivation {
   name = "doclifter-2.19";
@@ -6,7 +6,9 @@ stdenv.mkDerivation {
     url = "http://www.catb.org/~esr/doclifter/doclifter-2.19.tar.gz";
     sha256 = "1as6z7mdjrrkw2kism41q5ybvyzvwcmj9qzla2fz98v9f4jbj2s2";
   };
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/games/20kly/default.nix b/pkgs/games/20kly/default.nix
index 092e0e4eac2..7cc2ea6220e 100644
--- a/pkgs/games/20kly/default.nix
+++ b/pkgs/games/20kly/default.nix
@@ -1,12 +1,12 @@
 { lib
 , fetchurl
-, python }:
+, python2 }:
 
-python.pkgs.buildPythonApplication rec {
+python2.pkgs.buildPythonApplication rec {
   pname = "20kly";
   version = "1.4";
   format = "other";
-  disabled = !(python.isPy2 or false);
+  disabled = !(python2.isPy2 or false);
 
   src = fetchurl {
     url = "http://jwhitham.org.uk/20kly/lightyears-${version}.tar.bz2";
@@ -20,7 +20,7 @@ python.pkgs.buildPythonApplication rec {
         "LIGHTYEARS_DIR = \"$out/share\""
   '';
 
-  propagatedBuildInputs = with python.pkgs; [ pygame ];
+  propagatedBuildInputs = with python2.pkgs; [ pygame ];
 
   buildPhase = "python -O -m compileall .";
 
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 432600e879f..3d46de725c7 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, python }:
+{ lib, stdenv, autoreconfHook, pkg-config, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
@@ -16,10 +16,12 @@ stdenv.mkDerivation rec {
     for script in $(grep -lr '^#!/usr/bin/env python$'); do patchShebangs $script; done
   '';
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python ];
+  nativeBuildInputs = [ autoreconfHook pkg-config python2 ];
   buildInputs = [ SDL2 SDL2_mixer SDL2_net ];
   enableParallelBuilding = true;
 
+  strictDeps = true;
+
   meta = {
     homepage = "http://fabiangreffrath.github.io/crispy-doom";
     description = "A limit-removing enhanced-resolution Doom source port based on Chocolate Doom";
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 21458daf966..5a472c73578 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, bash, perl, python }:
+{ lib, stdenv, fetchFromGitHub, bash, perl, python2 }:
+
+# There are fixes for python3 compatibility on master
 
 stdenv.mkDerivation rec {
   pname = "dmtcp";
@@ -28,7 +30,7 @@ stdenv.mkDerivation rec {
     substituteInPlace test/autotest.py \
       --replace /bin/bash ${bash}/bin/bash \
       --replace /usr/bin/perl ${perl}/bin/perl \
-      --replace /usr/bin/python ${python}/bin/python \
+      --replace /usr/bin/python ${python2}/bin/python \
       --replace "os.environ['USER']" "\"nixbld1\"" \
       --replace "os.getenv('USER')" "\"nixbld1\""
   '';
diff --git a/pkgs/servers/dico/default.nix b/pkgs/servers/dico/default.nix
index cf0417e332e..6a8c6541c2c 100644
--- a/pkgs/servers/dico/default.nix
+++ b/pkgs/servers/dico/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, libtool, gettext, zlib, readline, gsasl
-, guile, python, pcre, libffi, groff }:
+, guile, python2, pcre, libffi, groff }:
 
 stdenv.mkDerivation rec {
   pname = "dico";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   buildInputs =
-    [ libtool gettext zlib readline gsasl guile python pcre libffi groff ];
+    [ libtool gettext zlib readline gsasl guile python2 pcre libffi groff ];
 
   doCheck = true;
 
diff --git a/pkgs/servers/dict/dictd-wordnet.nix b/pkgs/servers/dict/dictd-wordnet.nix
index 3f76d60233c..8378102dac5 100644
--- a/pkgs/servers/dict/dictd-wordnet.nix
+++ b/pkgs/servers/dict/dictd-wordnet.nix
@@ -1,10 +1,10 @@
-{lib, stdenv, python, wordnet, writeScript}:
+{lib, stdenv, python2, wordnet, writeScript}:
 
 stdenv.mkDerivation rec {
   version = "542";
   pname = "dict-db-wordnet";
 
-  buildInputs = [python wordnet];
+  buildInputs = [python2 wordnet];
   convert = ./wordnet_structures.py;
 
   builder = writeScript "builder.sh" ''
diff --git a/pkgs/servers/dict/wiktionary/default.nix b/pkgs/servers/dict/wiktionary/default.nix
index cd0c9c6c24b..3a01120f3a6 100644
--- a/pkgs/servers/dict/wiktionary/default.nix
+++ b/pkgs/servers/dict/wiktionary/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, dict, glibcLocales }:
+{ lib, stdenv, fetchurl, python2, dict, glibcLocales }:
 
 stdenv.mkDerivation rec {
   version = "20210201";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   convert = ./wiktionary2dict.py;
-  buildInputs = [ python dict glibcLocales ];
+  buildInputs = [ python2 dict glibcLocales ];
   builder = ./builder.sh;
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
index 78addfc4aa2..b3a876546e7 100644
--- a/pkgs/servers/foundationdb/default.nix
+++ b/pkgs/servers/foundationdb/default.nix
@@ -2,7 +2,7 @@
 , lib, fetchurl, fetchpatch, fetchFromGitHub
 
 , cmake, ninja, which, findutils, m4, gawk
-, python, python3, openjdk, mono, libressl, boost
+, python2, python3, openjdk, mono, libressl, boost
 }@args:
 
 let
diff --git a/pkgs/servers/foundationdb/vsmake.nix b/pkgs/servers/foundationdb/vsmake.nix
index aac9ab07c0f..e171d714564 100644
--- a/pkgs/servers/foundationdb/vsmake.nix
+++ b/pkgs/servers/foundationdb/vsmake.nix
@@ -4,7 +4,7 @@
 { gcc6Stdenv, lib, fetchurl, fetchFromGitHub
 
 , which, findutils, m4, gawk
-, python, openjdk, mono, libressl
+, python2, openjdk, mono, libressl
 , ...
 }:
 
@@ -51,7 +51,7 @@ let
           inherit rev sha256;
         };
 
-        nativeBuildInputs = [ python openjdk gawk which m4 findutils mono ];
+        nativeBuildInputs = [ python2 openjdk gawk which m4 findutils mono ];
         buildInputs = [ libressl boost ];
 
         inherit patches;
diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix
index bfa372ed069..90510d50252 100644
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkg-config, doxygen, perl, pam, nspr, nss, openldap
-, db, cyrus_sasl, svrcore, icu, net-snmp, kerberos, pcre, perlPackages, libevent, openssl, python
+, db, cyrus_sasl, svrcore, icu, net-snmp, kerberos, pcre, perlPackages, libevent, openssl, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
   buildInputs = [
     perl pam nspr nss openldap db cyrus_sasl svrcore icu
-    net-snmp kerberos pcre libevent openssl python
+    net-snmp kerberos pcre libevent openssl python3
   ] ++ (with perlPackages; [ MozillaLdap NetAddrIP DBFile ]);
 
   patches = [
diff --git a/pkgs/tools/admin/chkcrontab/default.nix b/pkgs/tools/admin/chkcrontab/default.nix
index bbf8d7eaeb1..d91894f0006 100644
--- a/pkgs/tools/admin/chkcrontab/default.nix
+++ b/pkgs/tools/admin/chkcrontab/default.nix
@@ -1,6 +1,6 @@
-{ python, lib }:
+{ python3, lib }:
 
-with python.pkgs;
+with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "chkcrontab";
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 91d59a4de0f..6c4f2f6e854 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, pythonPackages
+{ lib, fetchurl, python2Packages
 , gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, p7zip, cabextract, unrar, unshield
 , bzip2, xz, lzip
 # unzip is handled by p7zip
@@ -11,7 +11,7 @@ let
   ++ lib.optional (unrarSupport) unrar
   ++ [ bzip2 xz lzip ]);
 
-in pythonPackages.buildPythonApplication rec {
+in python2Packages.buildPythonApplication rec {
   pname = "dtrx";
   version = "7.1";
 
@@ -24,6 +24,17 @@ in pythonPackages.buildPythonApplication rec {
     wrapProgram "$out/bin/dtrx" --prefix PATH : "${archivers}"
   '';
 
+  checkPhase = ''
+    python2 tests/compare.py
+  '';
+
+  checkInputs = with python2Packages; [
+    pyyaml
+  ];
+
+  # custom test suite fails
+  doCheck = false;
+
   meta = with lib; {
     description = "Do The Right Extraction: A tool for taking the hassle out of extracting archives";
     homepage = "https://brettcsmith.org/2007/dtrx/";
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
index 3777c4e7cb1..eec257c44b7 100644
--- a/pkgs/tools/filesystems/cryfs/default.nix
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
-, cmake, pkg-config, python, gtest
+, cmake, pkg-config, python3, gtest
 , boost, cryptopp, curl, fuse, openssl
 }:
 
@@ -44,9 +44,11 @@ stdenv.mkDerivation rec {
       --replace "(4.5L*1024*1024*1024)" "(0.5L*1024*1024*1024)"
   '';
 
-  nativeBuildInputs = [ cmake gtest pkg-config python ];
+  nativeBuildInputs = [ cmake pkg-config python3 ];
 
-  buildInputs = [ boost cryptopp curl fuse openssl ];
+  strictDeps = true;
+
+  buildInputs = [ boost cryptopp curl fuse openssl gtest ];
 
   cmakeFlags = [
     "-DCRYFS_UPDATE_CHECKS:BOOL=FALSE"
diff --git a/pkgs/tools/graphics/blockhash/default.nix b/pkgs/tools/graphics/blockhash/default.nix
index a0ecdde3826..b3426722f79 100644
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pkg-config, imagemagick, wafHook }:
+{ lib, stdenv, fetchFromGitHub, python2, pkg-config, imagemagick, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "blockhash";
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0m7ikppl42iicgmwsb7baajmag7v0p1ab06xckifvrr0zm21bq9p";
   };
 
-  nativeBuildInputs = [ python pkg-config wafHook ];
+  nativeBuildInputs = [ python2 pkg-config wafHook ];
   buildInputs = [ imagemagick ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "http://blockhash.io/";
     description = ''
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
index 4a887688c4f..decb92615f9 100644
--- a/pkgs/tools/graphics/escrotum/default.nix
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -1,9 +1,7 @@
-{ lib, fetchFromGitHub, buildPythonApplication
-, pygtk
-, numpy ? null
+{ lib, python2Packages, fetchFromGitHub
 }:
 
-buildPythonApplication {
+with python2Packages; buildPythonApplication {
   name = "escrotum-2019-06-10";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/misc/disper/default.nix b/pkgs/tools/misc/disper/default.nix
index ecbf298132f..3e78bc97732 100644
--- a/pkgs/tools/misc/disper/default.nix
+++ b/pkgs/tools/misc/disper/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, xorg, makeWrapper }:
+{ lib, stdenv, fetchFromGitHub, python2, xorg, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "disper";
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [ python ];
+  strictDeps = true;
+
+  buildInputs = [ python2 ];
 
   preConfigure = ''
     export makeFlags="PREFIX=$out"
diff --git a/pkgs/tools/networking/bud/default.nix b/pkgs/tools/networking/bud/default.nix
index 724d25d49f9..7a4bd5adcba 100644
--- a/pkgs/tools/networking/bud/default.nix
+++ b/pkgs/tools/networking/bud/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchgit, python, gyp, util-linux }:
+{ stdenv, lib, fetchgit, python2, util-linux }:
 
 stdenv.mkDerivation {
   pname = "bud";
@@ -11,10 +11,12 @@ stdenv.mkDerivation {
     sha256 = "08yr6l4lc2m6rng06253fcaznf6sq0v053wfr8bbym42c32z0xdh";
   };
 
-  buildInputs = [
-    python gyp
+  nativeBuildInputs = [
+    python2 python2.pkgs.gyp
   ] ++ lib.optional stdenv.isLinux util-linux;
 
+  strictDeps = true;
+
   buildPhase = ''
     python ./gyp_bud -f make
     make -C out
diff --git a/pkgs/tools/networking/carddav-util/default.nix b/pkgs/tools/networking/carddav-util/default.nix
index 112a95eccc6..300e03761a6 100644
--- a/pkgs/tools/networking/carddav-util/default.nix
+++ b/pkgs/tools/networking/carddav-util/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, python, pythonPackages, makeWrapper }:
+{ lib, stdenv, fetchgit, python3Packages, makeWrapper }:
 
 stdenv.mkDerivation {
 
@@ -12,7 +12,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  propagatedBuildInputs = with pythonPackages; [ requests vobject lxml ];
+  propagatedBuildInputs = with python3Packages; [ requests vobject lxml ];
+
+  strictDeps = true;
 
   doCheck = false; # no test
 
@@ -20,7 +22,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     cp $src/carddav-util.py $out/bin
 
-    pythondir="$out/lib/${python.libPrefix}/site-packages"
+    pythondir="$out/lib/${python3Packages.python.sitePackages}"
     mkdir -p "$pythondir"
     cp $src/carddav.py "$pythondir"
   '';
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
index b8fd0679892..3293ebe25c8 100644
--- a/pkgs/tools/networking/ccnet/default.nix
+++ b/pkgs/tools/networking/ccnet/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, which, autoreconfHook, pkg-config, vala, python, libsearpc, libzdb, libuuid, libevent, sqlite, openssl}:
+{lib, stdenv, fetchurl, which, autoreconfHook, pkg-config, vala, python3, libsearpc, libzdb, libuuid, libevent, sqlite, openssl}:
 
 stdenv.mkDerivation rec {
   version = "6.1.8";
@@ -10,11 +10,13 @@ stdenv.mkDerivation rec {
     sha256 = "0qlpnrz30ldrqnvbj59d54qdghxpxc5lsq6kf3dw2b93jnzkcmmm";
   };
 
-  nativeBuildInputs = [ pkg-config which autoreconfHook vala python ];
+  nativeBuildInputs = [ pkg-config which autoreconfHook vala python3 libsearpc ];
   propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
 
   configureFlags = [ "--enable-server" ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "https://github.com/haiwen/ccnet";
     description = "A framework for writing networked applications in C";
diff --git a/pkgs/tools/networking/dd-agent/5.nix b/pkgs/tools/networking/dd-agent/5.nix
index af4ae7ed769..f40ef295d13 100644
--- a/pkgs/tools/networking/dd-agent/5.nix
+++ b/pkgs/tools/networking/dd-agent/5.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, python
+{ lib, stdenv, fetchFromGitHub, python2
 , unzip, makeWrapper }:
 let
-  python' = python.override {
+  python' = python2.override {
     packageOverrides = self: super: {
       docker = self.buildPythonPackage rec {
         name = "docker-${version}";
@@ -82,7 +82,7 @@ in stdenv.mkDerivation rec {
 
     cat > $out/bin/dd-jmxfetch <<EOF
     #!/usr/bin/env bash
-    exec ${python}/bin/python $out/agent/jmxfetch.py $@
+    exec ${python'.interpreter} $out/agent/jmxfetch.py $@
     EOF
     chmod a+x $out/bin/dd-jmxfetch
 
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 45d6349af40..7e00c0b07cf 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, pythonPackages, nasm, libelf
+{ stdenv, lib, fetchFromGitHub, python2Packages, nasm, libelf
 , kernel ? null, withDriver ? false }:
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "chipsec";
   version = "1.5.1";
 
diff --git a/pkgs/tools/security/cipherscan/default.nix b/pkgs/tools/security/cipherscan/default.nix
index eae5a5256df..23022f92b6a 100644
--- a/pkgs/tools/security/cipherscan/default.nix
+++ b/pkgs/tools/security/cipherscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python, coreutils }:
+{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python3, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "cipherscan";
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   buildPhase = ''
     substituteInPlace cipherscan --replace '$0' 'cipherscan'
diff --git a/pkgs/tools/system/evemu/default.nix b/pkgs/tools/system/evemu/default.nix
index 5b3a584bd24..c01a909668e 100644
--- a/pkgs/tools/system/evemu/default.nix
+++ b/pkgs/tools/system/evemu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, pythonPackages
+{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, python3Packages
 , libevdev
 }:
 
@@ -14,9 +14,11 @@ stdenv.mkDerivation rec {
     sha256 = "1m38fxwy2s82vb2qm9aqxinws12akmqqq7q66is931lc3awqkbah";
   };
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook python3Packages.python ];
 
-  buildInputs = [ pythonPackages.python pythonPackages.evdev libevdev ];
+  buildInputs = [ python3Packages.evdev libevdev ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Records and replays device descriptions and events to emulate input devices through the kernel's input system";
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index d34f0d4b737..fc4ea8d6b33 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
-, libaio, python, zlib
+, libaio, python3, zlib
 , withGnuplot ? false, gnuplot ? null }:
 
 stdenv.mkDerivation rec {
@@ -13,11 +13,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/Si0McndJ6Xp3ifDr+BStv89LmZyAgof95QkHGT8MGQ=";
   };
 
-  buildInputs = [ python zlib ]
+  buildInputs = [ python3 zlib ]
     ++ lib.optional (!stdenv.isDarwin) libaio;
 
   nativeBuildInputs = [ makeWrapper ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postPatch = ''
diff --git a/pkgs/tools/typesetting/biblatex-check/default.nix b/pkgs/tools/typesetting/biblatex-check/default.nix
index 606e07730e4..63bf7cf1d71 100644
--- a/pkgs/tools/typesetting/biblatex-check/default.nix
+++ b/pkgs/tools/typesetting/biblatex-check/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation {
   pname = "biblatex-check";
@@ -11,7 +11,9 @@ stdenv.mkDerivation {
     sha256 = "1bq0yqckhssazwkivipdjmn1jpsf301i4ppyl88qhc5igx39wg25";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   installPhase = ''
     install -Dm755 biblatex_check.py $out/bin/biblatex-check
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 459206d37bb..3a7d1d60c6a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1609,7 +1609,7 @@ in
 
   b3sum = callPackage ../tools/security/b3sum {};
 
-  backblaze-b2 = python.pkgs.callPackage ../development/tools/backblaze-b2 { };
+  backblaze-b2 = callPackage ../development/tools/backblaze-b2 { };
 
   bandwhich = callPackage ../tools/networking/bandwhich {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -3138,9 +3138,7 @@ in
     librsync = librsync_0_9;
   };
 
-  bud = callPackage ../tools/networking/bud {
-    inherit (pythonPackages) gyp;
-  };
+  bud = callPackage ../tools/networking/bud { };
 
   bump2version = python37Packages.callPackage ../applications/version-management/git-and-tools/bump2version { };
 
@@ -3390,9 +3388,7 @@ in
   skktools = callPackage ../tools/inputmethods/skk/skktools { };
   skk-dicts = callPackage ../tools/inputmethods/skk/skk-dicts { };
 
-  libkkc-data = callPackage ../data/misc/libkkc-data {
-    inherit (pythonPackages) marisa;
-  };
+  libkkc-data = callPackage ../data/misc/libkkc-data { };
 
   libkkc = callPackage ../tools/inputmethods/libkkc { };
 
@@ -4158,9 +4154,7 @@ in
 
   epsxe = callPackage ../misc/emulators/epsxe { };
 
-  escrotum = callPackage ../tools/graphics/escrotum {
-    inherit (pythonPackages) buildPythonApplication pygtk numpy;
-  };
+  escrotum = callPackage ../tools/graphics/escrotum { };
 
   etcher = callPackage ../tools/misc/etcher { };
 
@@ -12552,7 +12546,7 @@ in
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
-  fedpkg = pythonPackages.callPackage ../development/tools/fedpkg { };
+  fedpkg = callPackage ../development/tools/fedpkg { };
 
   flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { };
   flex = callPackage ../development/tools/parsing/flex { };