diff --git a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index 66e24fe5877..86c241cd0f5 100644
--- a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -1,5 +1,5 @@
 linkSystemCoreFoundationFramework() {
-  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks $NIX_CFLAGS_COMPILE"
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
diff --git a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
index ed9bdbd912d..35cea773f98 100644
--- a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
@@ -2,7 +2,7 @@ noDeprecatedDeclarations() {
   # Security.framework has about 2000 deprecated constants, all of which the user will be
   # warned about at compilation time
   flag="-Wno-deprecated-declarations"
-  if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+  if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
     NIX_CFLAGS_COMPILE+=" $flag"
   fi
 }