diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index da16a23f9df..b79aac37a33 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -214,6 +214,7 @@ stdenv.mkDerivation {
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
+      export named_fc=${targetPrefix}gfortran
     ''
 
     + optionalString cc.langJava or false ''
@@ -232,8 +233,8 @@ stdenv.mkDerivation {
 
   setupHooks = [
     ../setup-hooks/role.bash
-    ./setup-hook.sh
-  ];
+  ] ++ stdenv.lib.optional (cc.langC or true) ./setup-hook.sh
+    ++ stdenv.lib.optional (cc.langFortran or false) ./fortran-hook.sh;
 
   postFixup =
     ''
diff --git a/pkgs/build-support/cc-wrapper/fortran-hook.sh b/pkgs/build-support/cc-wrapper/fortran-hook.sh
new file mode 100644
index 00000000000..d72f314c01c
--- /dev/null
+++ b/pkgs/build-support/cc-wrapper/fortran-hook.sh
@@ -0,0 +1,11 @@
+getTargetRole
+getTargetRoleWrapper
+
+export FC${role_post}=@named_fc@
+
+# If unset, assume the default hardening flags.
+# These are different for fortran.
+: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+export NIX_HARDENING_ENABLE
+
+unset -v role_post