diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index bc586e0b3ce..dae465edc0d 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -6,6 +6,8 @@
 , setuptools
 , unzip
 , ensureNewerSourcesHook
+# Prevent impurities by blocking setuptools/easy-install from downloading sdists
+, distutils-cfg
 }:
 
 { name
@@ -60,7 +62,7 @@ python.stdenv.mkDerivation (builtins.removeAttrs attrs ["disabled" "checkInputs"
 
   inherit pythonPath;
 
-  buildInputs = [ wrapPython ] ++ buildInputs ++ pythonPath
+  buildInputs = [ distutils-cfg wrapPython ] ++ buildInputs ++ pythonPath
     ++ [ (ensureNewerSourcesHook { year = "1980"; }) ]
     ++ (lib.optional (lib.hasSuffix "zip" attrs.src.name or "") unzip)
     ++ lib.optionals doCheck checkInputs;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6312fb25f4b..4a63203c551 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -34,6 +34,7 @@ let
   bootstrapped-pip = callPackage ../development/python-modules/bootstrapped-pip { };
 
   mkPythonDerivation = makeOverridable( callPackage ../development/interpreters/python/mk-python-derivation.nix {
+    distutils-cfg = callPackage ../development/python-modules/distutils-cfg { };
   });
 
   # Derivations built with `buildPythonPackage` can already be overriden with `override`, `overrideAttrs`, and `overrideDerivation`.