diff --git a/doc/doc-support/lib-function-docs.nix b/doc/doc-support/lib-function-docs.nix
index eded81c5e3c9..e6c08dabb5b0 100644
--- a/doc/doc-support/lib-function-docs.nix
+++ b/doc/doc-support/lib-function-docs.nix
@@ -94,10 +94,7 @@
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
-  src = lib.fileset.toSource {
-    root = ../..;
-    fileset = ../../lib;
-  };
+  src = ../../lib;
 
   nativeBuildInputs = [
     nixdoc
@@ -105,6 +102,8 @@ stdenvNoCC.mkDerivation {
   ];
 
   installPhase = ''
+    cd ..
+
     export NIX_STATE_DIR=$(mktemp -d)
     nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
       --arg nixpkgsPath "./." \
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index c2bbdf09e533..bc5566f3cbd3 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -25,16 +25,22 @@ stdenvNoCC.mkDerivation (
 
     nativeBuildInputs = [ nixos-render-docs ];
 
-    src = lib.fileset.toSource {
-      root = ../.;
-      fileset = lib.fileset.unions [
-        (lib.fileset.fileFilter (file: file.hasExt "md" || file.hasExt "md.in") ../.)
-        ../style.css
-        ../anchor-use.js
-        ../anchor.min.js
-        ../manpage-urls.json
-        ../redirects.json
-      ];
+    src = lib.cleanSourceWith {
+      src = ../.;
+      filter =
+        path: type:
+        type == "directory"
+        || lib.hasSuffix ".md" path
+        || lib.hasSuffix ".md.in" path
+        || lib.elem path (
+          map toString [
+            ../style.css
+            ../anchor-use.js
+            ../anchor.min.js
+            ../manpage-urls.json
+            ../redirects.json
+          ]
+        );
     };
 
     postPatch = ''
diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 35471f74949c..f22744806d48 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -14,22 +14,12 @@
   extraPythonPackages ? (_: [ ]),
   nixosTests,
 }:
-let
-  fs = lib.fileset;
-in
 python3Packages.buildPythonApplication {
   pname = "nixos-test-driver";
   version = "1.1";
   pyproject = true;
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./pyproject.toml
-      ./test_driver
-      ./extract-docstrings.py
-    ];
-  };
+  src = ./src;
 
   build-system = with python3Packages; [
     setuptools
diff --git a/nixos/lib/test-driver/nixos-test-driver-docstrings.nix b/nixos/lib/test-driver/nixos-test-driver-docstrings.nix
index b76da9ac5fb2..b6450685e047 100644
--- a/nixos/lib/test-driver/nixos-test-driver-docstrings.nix
+++ b/nixos/lib/test-driver/nixos-test-driver-docstrings.nix
@@ -11,6 +11,6 @@ in
 
 runCommand "nixos-test-driver-docstrings" env ''
   mkdir $out
-  python3 ${./extract-docstrings.py} ${./test_driver/machine.py} \
+  python3 ${./src/extract-docstrings.py} ${./src/test_driver/machine.py} \
     > $out/machine-methods.md
 ''
diff --git a/nixos/lib/test-driver/extract-docstrings.py b/nixos/lib/test-driver/src/extract-docstrings.py
similarity index 100%
rename from nixos/lib/test-driver/extract-docstrings.py
rename to nixos/lib/test-driver/src/extract-docstrings.py
diff --git a/nixos/lib/test-driver/pyproject.toml b/nixos/lib/test-driver/src/pyproject.toml
similarity index 100%
rename from nixos/lib/test-driver/pyproject.toml
rename to nixos/lib/test-driver/src/pyproject.toml
diff --git a/nixos/lib/test-driver/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/__init__.py
rename to nixos/lib/test-driver/src/test_driver/__init__.py
diff --git a/nixos/lib/test-driver/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/driver.py
rename to nixos/lib/test-driver/src/test_driver/driver.py
diff --git a/nixos/lib/test-driver/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/logger.py
rename to nixos/lib/test-driver/src/test_driver/logger.py
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/src/test_driver/machine.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/machine.py
rename to nixos/lib/test-driver/src/test_driver/machine.py
diff --git a/nixos/lib/test-driver/test_driver/polling_condition.py b/nixos/lib/test-driver/src/test_driver/polling_condition.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/polling_condition.py
rename to nixos/lib/test-driver/src/test_driver/polling_condition.py
diff --git a/nixos/lib/test-driver/test_driver/py.typed b/nixos/lib/test-driver/src/test_driver/py.typed
similarity index 100%
rename from nixos/lib/test-driver/test_driver/py.typed
rename to nixos/lib/test-driver/src/test_driver/py.typed
diff --git a/nixos/lib/test-driver/test_driver/qmp.py b/nixos/lib/test-driver/src/test_driver/qmp.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/qmp.py
rename to nixos/lib/test-driver/src/test_driver/qmp.py
diff --git a/nixos/lib/test-driver/test_driver/vlan.py b/nixos/lib/test-driver/src/test_driver/vlan.py
similarity index 100%
rename from nixos/lib/test-driver/test_driver/vlan.py
rename to nixos/lib/test-driver/src/test_driver/vlan.py
diff --git a/pkgs/build-support/testers/shellcheck/example.sh b/pkgs/build-support/testers/shellcheck/src/example.sh
similarity index 100%
rename from pkgs/build-support/testers/shellcheck/example.sh
rename to pkgs/build-support/testers/shellcheck/src/example.sh
diff --git a/pkgs/build-support/testers/shellcheck/tester.nix b/pkgs/build-support/testers/shellcheck/tester.nix
index 131a64a85157..caa4f51f9927 100644
--- a/pkgs/build-support/testers/shellcheck/tester.nix
+++ b/pkgs/build-support/testers/shellcheck/tester.nix
@@ -2,6 +2,7 @@
 {
   lib,
   stdenv,
+  runCommand,
   shellcheck,
 }:
 
@@ -10,7 +11,7 @@
 # Tests: ./tests.nix
 { src }:
 let
-  inherit (lib) fileset pathType isPath;
+  inherit (lib) pathType isPath;
 in
 stdenv.mkDerivation {
   name = "run-shellcheck";
@@ -18,10 +19,10 @@ stdenv.mkDerivation {
     if
       isPath src && pathType src == "regular" # note that for strings this would have been IFD, which we prefer to avoid
     then
-      fileset.toSource {
-        root = dirOf src;
-        fileset = src;
-      }
+      runCommand "testers-shellcheck-src" { } ''
+        mkdir $out
+        cp ${src} $out
+      ''
     else
       src;
   nativeBuildInputs = [ shellcheck ];
diff --git a/pkgs/build-support/testers/shellcheck/tests.nix b/pkgs/build-support/testers/shellcheck/tests.nix
index 0128670dbe70..4a9ebdf9ffb1 100644
--- a/pkgs/build-support/testers/shellcheck/tests.nix
+++ b/pkgs/build-support/testers/shellcheck/tests.nix
@@ -6,9 +6,6 @@
   testers,
   runCommand,
 }:
-let
-  inherit (lib) fileset;
-in
 lib.recurseIntoAttrs {
 
   example-dir =
@@ -16,12 +13,7 @@ lib.recurseIntoAttrs {
       {
         failure = testers.testBuildFailure (
           testers.shellcheck {
-            src = fileset.toSource {
-              root = ./.;
-              fileset = fileset.unions [
-                ./example.sh
-              ];
-            };
+            src = ./src;
           }
         );
       }
@@ -37,7 +29,7 @@ lib.recurseIntoAttrs {
       {
         failure = testers.testBuildFailure (
           testers.shellcheck {
-            src = ./example.sh;
+            src = ./src/example.sh;
           }
         );
       }
diff --git a/pkgs/by-name/fl/flattenReferencesGraph/package.nix b/pkgs/by-name/fl/flattenReferencesGraph/package.nix
index 9adb9a320e0c..c3c7edb17609 100644
--- a/pkgs/by-name/fl/flattenReferencesGraph/package.nix
+++ b/pkgs/by-name/fl/flattenReferencesGraph/package.nix
@@ -1,25 +1,19 @@
 {
   callPackage,
-  lib,
+  nix-gitignore,
   python3Packages,
 }:
 let
-  inherit (lib) fileset;
   helpers = callPackage ./helpers.nix { };
   pythonPackages = python3Packages;
+
 in
 pythonPackages.buildPythonApplication {
   version = "0.1.0";
   pname = "flatten-references-graph";
 
-  src = fileset.toSource {
-    root = ./src;
-    fileset = fileset.unions [
-      ./src/.flake8
-      ./src/flatten_references_graph
-      ./src/setup.py
-    ];
-  };
+  # Note: this uses only ./src/.gitignore
+  src = nix-gitignore.gitignoreSource [ ] ./src;
 
   propagatedBuildInputs = with pythonPackages; [
     igraph
diff --git a/pkgs/by-name/pu/purescm/README.rst b/pkgs/by-name/pu/purescm/README.rst
index 635d4b46d811..ff34f3913009 100644
--- a/pkgs/by-name/pu/purescm/README.rst
+++ b/pkgs/by-name/pu/purescm/README.rst
@@ -14,6 +14,6 @@ Suggested additional ``buildInputs``
 To update this package
 ======================
 
-#. Bump the ``./package.json`` version pin
-#. Run ``nix-shell -p nodejs --command "npm i --package-lock-only"``
+#. Bump the ``./manifests/package.json`` version pin
+#. Run ``(cd manifests && nix-shell -p nodejs --command "npm i --package-lock-only")``
 #. Update ``npmDeps.hash`` in the ``package.nix``
diff --git a/pkgs/by-name/pu/purescm/.gitignore b/pkgs/by-name/pu/purescm/manifests/.gitignore
similarity index 100%
rename from pkgs/by-name/pu/purescm/.gitignore
rename to pkgs/by-name/pu/purescm/manifests/.gitignore
diff --git a/pkgs/by-name/pu/purescm/package-lock.json b/pkgs/by-name/pu/purescm/manifests/package-lock.json
similarity index 100%
rename from pkgs/by-name/pu/purescm/package-lock.json
rename to pkgs/by-name/pu/purescm/manifests/package-lock.json
diff --git a/pkgs/by-name/pu/purescm/package.json b/pkgs/by-name/pu/purescm/manifests/package.json
similarity index 100%
rename from pkgs/by-name/pu/purescm/package.json
rename to pkgs/by-name/pu/purescm/manifests/package.json
diff --git a/pkgs/by-name/pu/purescm/package.nix b/pkgs/by-name/pu/purescm/package.nix
index faee196e3eb9..9dd16d489a0c 100644
--- a/pkgs/by-name/pu/purescm/package.nix
+++ b/pkgs/by-name/pu/purescm/package.nix
@@ -8,7 +8,7 @@
 let
   inherit (lib) fileset;
 
-  packageLock = builtins.fromJSON (builtins.readFile ./package-lock.json);
+  packageLock = builtins.fromJSON (builtins.readFile ./manifests/package-lock.json);
 
   pname = "purescm";
   version = packageLock.packages."node_modules/${pname}".version;
@@ -16,24 +16,11 @@ let
   package = buildNpmPackage {
     inherit pname version;
 
-    src = fileset.toSource {
-      root = ./.;
-      fileset = fileset.unions [
-        ./package.json
-        ./package-lock.json
-        ./.gitignore
-      ];
-    };
+    src = ./manifests;
     dontNpmBuild = true;
 
     npmDeps = fetchNpmDeps {
-      src = fileset.toSource {
-        root = ./.;
-        fileset = fileset.unions [
-          ./package-lock.json
-          ./package.json
-        ];
-      };
+      src = ./manifests;
       hash = "sha256-ljeFcLvIET77Q0OR6O5Ok1fGnaxaKaoywpcy2aHq/6o=";
     };
 
diff --git a/pkgs/by-name/sh/shopify-cli/package-lock.json b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
similarity index 100%
rename from pkgs/by-name/sh/shopify-cli/package-lock.json
rename to pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
diff --git a/pkgs/by-name/sh/shopify-cli/package.json b/pkgs/by-name/sh/shopify-cli/manifests/package.json
similarity index 100%
rename from pkgs/by-name/sh/shopify-cli/package.json
rename to pkgs/by-name/sh/shopify-cli/manifests/package.json
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index b49e430de8be..a45f65ce7506 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -6,13 +6,7 @@ buildNpmPackage {
   pname = "shopify";
   version = version;
 
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = with lib.fileset; unions [
-      ./package.json
-      ./package-lock.json
-    ];
-  };
+  src = ./manifests;
 
   npmDepsHash = "sha256-QhbOKOs/0GEOeySG4uROzgtD4o7C+6tS/TAaPcmC3xk=";
   dontNpmBuild = true;
diff --git a/pkgs/by-name/sh/shopify-cli/update.sh b/pkgs/by-name/sh/shopify-cli/update.sh
index 6421f59a3a17..a63a81b59057 100755
--- a/pkgs/by-name/sh/shopify-cli/update.sh
+++ b/pkgs/by-name/sh/shopify-cli/update.sh
@@ -18,6 +18,8 @@ if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
     exit 0
 fi
 
+pushd manifests
+
 # Update the package.json
 sed -i "s|$UPDATE_NIX_OLD_VERSION|$version|g" package.json
 
@@ -25,6 +27,9 @@ sed -i "s|$UPDATE_NIX_OLD_VERSION|$version|g" package.json
 rm -f package-lock.json
 npm i --package-lock-only
 npm_hash=$(prefetch-npm-deps package-lock.json)
+
+popd
+
 sed -i "s|npmDepsHash = \".*\";|npmDepsHash = \"$npm_hash\";|" package.nix
 
 popd
diff --git a/pkgs/development/cuda-modules/saxpy/default.nix b/pkgs/development/cuda-modules/saxpy/default.nix
index 57b6120ccea9..c1d1711fc997 100644
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@@ -18,19 +18,12 @@ let
     libcublas
     ;
   inherit (lib) getDev getLib getOutput;
-  fs = lib.fileset;
 in
 backendStdenv.mkDerivation {
   pname = "saxpy";
   version = "unstable-2023-07-11";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./CMakeLists.txt
-      ./saxpy.cu
-    ];
-  };
+  src = ./src;
 
   __structuredAttrs = true;
   strictDeps = true;
diff --git a/pkgs/development/cuda-modules/saxpy/CMakeLists.txt b/pkgs/development/cuda-modules/saxpy/src/CMakeLists.txt
similarity index 100%
rename from pkgs/development/cuda-modules/saxpy/CMakeLists.txt
rename to pkgs/development/cuda-modules/saxpy/src/CMakeLists.txt
diff --git a/pkgs/development/cuda-modules/saxpy/saxpy.cu b/pkgs/development/cuda-modules/saxpy/src/saxpy.cu
similarity index 100%
rename from pkgs/development/cuda-modules/saxpy/saxpy.cu
rename to pkgs/development/cuda-modules/saxpy/src/saxpy.cu
diff --git a/pkgs/development/python-modules/waitress-django/default.nix b/pkgs/development/python-modules/waitress-django/default.nix
index 9358f20e1a33..cb0c46abb611 100644
--- a/pkgs/development/python-modules/waitress-django/default.nix
+++ b/pkgs/development/python-modules/waitress-django/default.nix
@@ -6,22 +6,12 @@
   waitress,
 }:
 
-let
-  fs = lib.fileset;
-in
-
 buildPythonPackage {
   pname = "waitress-django";
   version = "1.0.0";
   pyproject = true;
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./setup.py
-      ./src
-    ];
-  };
+  src = ./src;
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/waitress-django/setup.py b/pkgs/development/python-modules/waitress-django/src/setup.py
similarity index 76%
rename from pkgs/development/python-modules/waitress-django/setup.py
rename to pkgs/development/python-modules/waitress-django/src/setup.py
index 16fde78f42a9..65f51237b589 100644
--- a/pkgs/development/python-modules/waitress-django/setup.py
+++ b/pkgs/development/python-modules/waitress-django/src/setup.py
@@ -7,6 +7,5 @@ setup( name         = "waitress-django"
      , description  = "A waitress WSGI server serving django"
      , author       = "Bas van Dijk"
      , author_email = "v.dijk.bas@gmail.com"
-     , package_dir  = {"" : "src"}
-     , scripts      = ["src/waitress-serve-django"]
+     , scripts      = ["waitress-serve-django"]
      )
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/default.nix
similarity index 98%
rename from pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
rename to pkgs/development/tools/yarn2nix-moretea/default.nix
index 3cc5e31c3c15..94048c28f88b 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/default.nix
@@ -398,15 +398,7 @@ in rec {
     });
 
   yarn2nix = mkYarnPackage {
-    src = lib.fileset.toSource {
-      root = ./.;
-      fileset = lib.fileset.unions [
-        ./bin
-        ./lib
-        ./package.json
-        ./yarn.lock
-      ];
-    };
+    src = ./yarn2nix;
 
     # yarn2nix is the only package that requires the yarnNix option.
     # All the other projects can auto-generate that file.
@@ -415,7 +407,7 @@ in rec {
     # Using the filter above and importing package.json from the filtered
     # source results in an error in restricted mode. To circumvent this,
     # we import package.json from the unfiltered source
-    packageJSON = ./package.json;
+    packageJSON = ./yarn2nix/package.json;
 
     yarnFlags = defaultYarnFlags ++ [ "--ignore-scripts" "--production=true" ];
 
@@ -446,7 +438,7 @@ in rec {
     mkdir -p $out/lib
     mkdir -p $out/bin
 
-    cp ${./lib/urlToName.js} $out/lib/urlToName.js
+    cp ${./yarn2nix/lib/urlToName.js} $out/lib/urlToName.js
     cp ${./internal/fixup_yarn_lock.js} $out/bin/fixup_yarn_lock
 
     patchShebangs $out
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/internal/fixup_bin.js b/pkgs/development/tools/yarn2nix-moretea/internal/fixup_bin.js
similarity index 100%
rename from pkgs/development/tools/yarn2nix-moretea/yarn2nix/internal/fixup_bin.js
rename to pkgs/development/tools/yarn2nix-moretea/internal/fixup_bin.js
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/internal/fixup_yarn_lock.js b/pkgs/development/tools/yarn2nix-moretea/internal/fixup_yarn_lock.js
similarity index 100%
rename from pkgs/development/tools/yarn2nix-moretea/yarn2nix/internal/fixup_yarn_lock.js
rename to pkgs/development/tools/yarn2nix-moretea/internal/fixup_yarn_lock.js
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/nix/expectShFunctions.sh b/pkgs/development/tools/yarn2nix-moretea/nix/expectShFunctions.sh
similarity index 100%
rename from pkgs/development/tools/yarn2nix-moretea/yarn2nix/nix/expectShFunctions.sh
rename to pkgs/development/tools/yarn2nix-moretea/nix/expectShFunctions.sh
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.nix b/pkgs/development/tools/yarn2nix-moretea/yarn.nix
similarity index 100%
rename from pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.nix
rename to pkgs/development/tools/yarn2nix-moretea/yarn.nix
diff --git a/pkgs/test/haskell/cabalSdist/default.nix b/pkgs/test/haskell/cabalSdist/default.nix
index d9dc2bada6e2..147602126ded 100644
--- a/pkgs/test/haskell/cabalSdist/default.nix
+++ b/pkgs/test/haskell/cabalSdist/default.nix
@@ -6,18 +6,7 @@
 }:
 
 let
-  src = lib.fileset.toSource {
-    root = ./local;
-    fileset = lib.fileset.unions [
-      ./local/app
-      ./local/CHANGELOG.md
-      ./local/local.cabal
-    ];
-  };
-  # This prevents the source from depending on the formatting of the ./local/generated.nix file
-  localRaw = haskell.lib.compose.overrideSrc {
-    inherit src;
-  } (haskellPackages.callPackage ./local/generated.nix { });
+  localRaw = haskellPackages.callPackage ./generated.nix { };
 in
 lib.recurseIntoAttrs rec {
 
@@ -28,7 +17,6 @@ lib.recurseIntoAttrs rec {
 
   localFromCabalSdist = haskellPackages.buildFromCabalSdist localRaw;
 
-  # NOTE: ./local refers to the "./." path in `./local/generated.nix`.
   # This test makes sure that localHasNoDirectReference can actually fail if
   # it doesn't do anything. If this test fails, either the test setup was broken,
   # or Haskell packaging has changed the way `src` is treated in such a way that
@@ -39,7 +27,7 @@ lib.recurseIntoAttrs rec {
         drvPath = builtins.unsafeDiscardOutputDependency localRaw.drvPath;
       }
       ''
-        grep ${src} $drvPath >/dev/null
+        grep ${localRaw.src} $drvPath >/dev/null
         touch $out
       '';
 
@@ -49,7 +37,7 @@ lib.recurseIntoAttrs rec {
         drvPath = builtins.unsafeDiscardOutputDependency localFromCabalSdist.drvPath;
       }
       ''
-        grep -v ${src} $drvPath >/dev/null
+        grep -v ${localRaw.src} $drvPath >/dev/null
         touch $out
       '';
 }
diff --git a/pkgs/test/haskell/cabalSdist/local/generated.nix b/pkgs/test/haskell/cabalSdist/generated.nix
similarity index 64%
rename from pkgs/test/haskell/cabalSdist/local/generated.nix
rename to pkgs/test/haskell/cabalSdist/generated.nix
index f0f52a03e0d0..0cf12d6d565d 100644
--- a/pkgs/test/haskell/cabalSdist/local/generated.nix
+++ b/pkgs/test/haskell/cabalSdist/generated.nix
@@ -1,4 +1,4 @@
-# nix run ../../../../..#cabal2nix -- ./.
+# nix run ../../../../..#cabal2nix -- ./local
 {
   mkDerivation,
   base,
@@ -7,10 +7,11 @@
 mkDerivation {
   pname = "local";
   version = "0.1.0.0";
-  src = ./.; # also referred to as ./local in the test; these are the same path constants
+  src = ./local;
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [ base ];
   description = "Nixpkgs test case";
   license = lib.licenses.mit;
+  mainProgram = "local";
 }
diff --git a/pkgs/test/haskell/setBuildTarget/default.nix b/pkgs/test/haskell/setBuildTarget/default.nix
index 012bce8541e6..68f9b25dba75 100644
--- a/pkgs/test/haskell/setBuildTarget/default.nix
+++ b/pkgs/test/haskell/setBuildTarget/default.nix
@@ -1,7 +1,7 @@
 { pkgs, haskellPackages }:
 
 let
-  # This can be regenerated by running `cabal2nix .` in the current directory.
+  # This can be regenerated by running `cabal2nix ./src` in the current directory.
   pkgDef =
     {
       mkDerivation,
@@ -11,19 +11,11 @@ let
     mkDerivation {
       pname = "haskell-setBuildTarget";
       version = "0.1.0.0";
-      src = lib.fileset.toSource {
-        root = ./.;
-        fileset = lib.fileset.unions [
-          ./haskell-setBuildTarget.cabal
-          ./Bar.hs
-          ./Foo.hs
-          ./Setup.hs
-        ];
-      };
+      src = ./src;
       isLibrary = false;
       isExecutable = true;
       executableHaskellDepends = [ base ];
-      license = lib.licenses.bsd3;
+      license = "unknown";
     };
 
   drv = haskellPackages.callPackage pkgDef { };
diff --git a/pkgs/test/haskell/setBuildTarget/Bar.hs b/pkgs/test/haskell/setBuildTarget/src/Bar.hs
similarity index 100%
rename from pkgs/test/haskell/setBuildTarget/Bar.hs
rename to pkgs/test/haskell/setBuildTarget/src/Bar.hs
diff --git a/pkgs/test/haskell/setBuildTarget/Foo.hs b/pkgs/test/haskell/setBuildTarget/src/Foo.hs
similarity index 100%
rename from pkgs/test/haskell/setBuildTarget/Foo.hs
rename to pkgs/test/haskell/setBuildTarget/src/Foo.hs
diff --git a/pkgs/test/haskell/setBuildTarget/Setup.hs b/pkgs/test/haskell/setBuildTarget/src/Setup.hs
similarity index 100%
rename from pkgs/test/haskell/setBuildTarget/Setup.hs
rename to pkgs/test/haskell/setBuildTarget/src/Setup.hs
diff --git a/pkgs/test/haskell/setBuildTarget/haskell-setBuildTarget.cabal b/pkgs/test/haskell/setBuildTarget/src/haskell-setBuildTarget.cabal
similarity index 100%
rename from pkgs/test/haskell/setBuildTarget/haskell-setBuildTarget.cabal
rename to pkgs/test/haskell/setBuildTarget/src/haskell-setBuildTarget.cabal
diff --git a/pkgs/test/make-binary-wrapper/add-flags.c b/pkgs/test/make-binary-wrapper/add-flags/add-flags.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/add-flags.c
rename to pkgs/test/make-binary-wrapper/add-flags/add-flags.c
diff --git a/pkgs/test/make-binary-wrapper/add-flags.cmdline b/pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/add-flags.cmdline
rename to pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline
diff --git a/pkgs/test/make-binary-wrapper/add-flags.env b/pkgs/test/make-binary-wrapper/add-flags/add-flags.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/add-flags.env
rename to pkgs/test/make-binary-wrapper/add-flags/add-flags.env
diff --git a/pkgs/test/make-binary-wrapper/argv0.c b/pkgs/test/make-binary-wrapper/argv0/argv0.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/argv0.c
rename to pkgs/test/make-binary-wrapper/argv0/argv0.c
diff --git a/pkgs/test/make-binary-wrapper/argv0.cmdline b/pkgs/test/make-binary-wrapper/argv0/argv0.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/argv0.cmdline
rename to pkgs/test/make-binary-wrapper/argv0/argv0.cmdline
diff --git a/pkgs/test/make-binary-wrapper/argv0.env b/pkgs/test/make-binary-wrapper/argv0/argv0.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/argv0.env
rename to pkgs/test/make-binary-wrapper/argv0/argv0.env
diff --git a/pkgs/test/make-binary-wrapper/basic.c b/pkgs/test/make-binary-wrapper/basic/basic.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/basic.c
rename to pkgs/test/make-binary-wrapper/basic/basic.c
diff --git a/pkgs/test/make-binary-wrapper/basic.cmdline b/pkgs/test/make-binary-wrapper/basic/basic.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/basic.cmdline
rename to pkgs/test/make-binary-wrapper/basic/basic.cmdline
diff --git a/pkgs/test/make-binary-wrapper/basic.env b/pkgs/test/make-binary-wrapper/basic/basic.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/basic.env
rename to pkgs/test/make-binary-wrapper/basic/basic.env
diff --git a/pkgs/test/make-binary-wrapper/chdir.c b/pkgs/test/make-binary-wrapper/chdir/chdir.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/chdir.c
rename to pkgs/test/make-binary-wrapper/chdir/chdir.c
diff --git a/pkgs/test/make-binary-wrapper/chdir.cmdline b/pkgs/test/make-binary-wrapper/chdir/chdir.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/chdir.cmdline
rename to pkgs/test/make-binary-wrapper/chdir/chdir.cmdline
diff --git a/pkgs/test/make-binary-wrapper/chdir.env b/pkgs/test/make-binary-wrapper/chdir/chdir.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/chdir.env
rename to pkgs/test/make-binary-wrapper/chdir/chdir.env
diff --git a/pkgs/test/make-binary-wrapper/combination.c b/pkgs/test/make-binary-wrapper/combination/combination.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/combination.c
rename to pkgs/test/make-binary-wrapper/combination/combination.c
diff --git a/pkgs/test/make-binary-wrapper/combination.cmdline b/pkgs/test/make-binary-wrapper/combination/combination.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/combination.cmdline
rename to pkgs/test/make-binary-wrapper/combination/combination.cmdline
diff --git a/pkgs/test/make-binary-wrapper/combination.env b/pkgs/test/make-binary-wrapper/combination/combination.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/combination.env
rename to pkgs/test/make-binary-wrapper/combination/combination.env
diff --git a/pkgs/test/make-binary-wrapper/default.nix b/pkgs/test/make-binary-wrapper/default.nix
index 036b70f7594e..6f086de299a0 100644
--- a/pkgs/test/make-binary-wrapper/default.nix
+++ b/pkgs/test/make-binary-wrapper/default.nix
@@ -20,16 +20,7 @@ let
     runCommand "make-binary-wrapper-test-${testname}" env ''
       mkdir -p tmp/foo # for the chdir test
 
-      source=${
-        lib.fileset.toSource {
-          root = ./.;
-          fileset = lib.fileset.unions [
-            (./. + "/${testname}.cmdline")
-            (./. + "/${testname}.c")
-            (lib.fileset.maybeMissing (./. + "/${testname}.env"))
-          ];
-        }
-      }
+      source=${./${testname}}
 
       params=$(<"$source/${testname}.cmdline")
       eval "makeCWrapper /send/me/flags $params" > wrapper.c
diff --git a/pkgs/test/make-binary-wrapper/env.c b/pkgs/test/make-binary-wrapper/env/env.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/env.c
rename to pkgs/test/make-binary-wrapper/env/env.c
diff --git a/pkgs/test/make-binary-wrapper/env.cmdline b/pkgs/test/make-binary-wrapper/env/env.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/env.cmdline
rename to pkgs/test/make-binary-wrapper/env/env.cmdline
diff --git a/pkgs/test/make-binary-wrapper/env.env b/pkgs/test/make-binary-wrapper/env/env.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/env.env
rename to pkgs/test/make-binary-wrapper/env/env.env
diff --git a/pkgs/test/make-binary-wrapper/inherit-argv0.c b/pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/inherit-argv0.c
rename to pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.c
diff --git a/pkgs/test/make-binary-wrapper/inherit-argv0.cmdline b/pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/inherit-argv0.cmdline
rename to pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.cmdline
diff --git a/pkgs/test/make-binary-wrapper/inherit-argv0.env b/pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/inherit-argv0.env
rename to pkgs/test/make-binary-wrapper/inherit-argv0/inherit-argv0.env
diff --git a/pkgs/test/make-binary-wrapper/invalid-env.c b/pkgs/test/make-binary-wrapper/invalid-env/invalid-env.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/invalid-env.c
rename to pkgs/test/make-binary-wrapper/invalid-env/invalid-env.c
diff --git a/pkgs/test/make-binary-wrapper/invalid-env.cmdline b/pkgs/test/make-binary-wrapper/invalid-env/invalid-env.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/invalid-env.cmdline
rename to pkgs/test/make-binary-wrapper/invalid-env/invalid-env.cmdline
diff --git a/pkgs/test/make-binary-wrapper/overlength-strings.c b/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/overlength-strings.c
rename to pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c
diff --git a/pkgs/test/make-binary-wrapper/overlength-strings.cmdline b/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/overlength-strings.cmdline
rename to pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.cmdline
diff --git a/pkgs/test/make-binary-wrapper/overlength-strings.env b/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/overlength-strings.env
rename to pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.env
diff --git a/pkgs/test/make-binary-wrapper/prefix.c b/pkgs/test/make-binary-wrapper/prefix/prefix.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/prefix.c
rename to pkgs/test/make-binary-wrapper/prefix/prefix.c
diff --git a/pkgs/test/make-binary-wrapper/prefix.cmdline b/pkgs/test/make-binary-wrapper/prefix/prefix.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/prefix.cmdline
rename to pkgs/test/make-binary-wrapper/prefix/prefix.cmdline
diff --git a/pkgs/test/make-binary-wrapper/prefix.env b/pkgs/test/make-binary-wrapper/prefix/prefix.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/prefix.env
rename to pkgs/test/make-binary-wrapper/prefix/prefix.env
diff --git a/pkgs/test/make-binary-wrapper/suffix.c b/pkgs/test/make-binary-wrapper/suffix/suffix.c
similarity index 100%
rename from pkgs/test/make-binary-wrapper/suffix.c
rename to pkgs/test/make-binary-wrapper/suffix/suffix.c
diff --git a/pkgs/test/make-binary-wrapper/suffix.cmdline b/pkgs/test/make-binary-wrapper/suffix/suffix.cmdline
similarity index 100%
rename from pkgs/test/make-binary-wrapper/suffix.cmdline
rename to pkgs/test/make-binary-wrapper/suffix/suffix.cmdline
diff --git a/pkgs/test/make-binary-wrapper/suffix.env b/pkgs/test/make-binary-wrapper/suffix/suffix.env
similarity index 100%
rename from pkgs/test/make-binary-wrapper/suffix.env
rename to pkgs/test/make-binary-wrapper/suffix/suffix.env
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e171039a7c21..9508dce9689e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5667,7 +5667,7 @@ with pkgs;
 
   yarn-berry = callPackage ../development/tools/yarn-berry { };
 
-  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea/yarn2nix { pkgs = pkgs.__splicedPackages; };
+  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea { pkgs = pkgs.__splicedPackages; };
 
   inherit (yarn2nix-moretea)
     yarn2nix
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 5c224802d5bf..fd443ac773ff 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -27,6 +27,10 @@
 , # Allow a configuration attribute set to be passed in as an argument.
   config ? {}
 
+, # Temporary hack to let Nixpkgs forbid internal use of `lib.fileset`
+  # until <https://github.com/NixOS/nix/issues/11503> is fixed.
+  __allowFileset ? true
+
 , # List of overlays layers used to extend Nixpkgs.
   overlays ? []
 
@@ -47,7 +51,24 @@ let # Rename the function arguments
   crossSystem0 = crossSystem;
 
 in let
-  lib = import ../../lib;
+  pristineLib = import ../../lib;
+
+  lib =
+    if __allowFileset then
+      pristineLib
+    else
+      pristineLib.extend (_: _: {
+        fileset = abort ''
+
+          The use of `lib.fileset` is currently forbidden in Nixpkgs due to the
+          upstream Nix bug <https://github.com/NixOS/nix/issues/11503>. This
+          causes difficult‐to‐debug errors when combined with chroot stores,
+          such as in the NixOS installer.
+
+          For packages that require source to be vendored inside Nixpkgs,
+          please use a subdirectory of the package instead.
+        '';
+      });
 
   inherit (lib) throwIfNot;
 
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 1ce8f8f709e2..492a7503a03d 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -17,7 +17,10 @@
 , # Strip most of attributes when evaluating to spare memory usage
   scrubJobs ? true
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-  nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
+  nixpkgsArgs ? {
+    config = { allowUnfree = false; inHydra = true; };
+    __allowFileset = false;
+  }
 }:
 
 let
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index 945f0e6d2954..a19bc6f8ecaa 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -43,6 +43,8 @@ in
       "${variant}Support" = true;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
   ...
 }@args:
diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index c7581c47d341..a2821386ce3e 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -3,7 +3,10 @@
 , packageSet ? (import ../..)
 , scrubJobs ? true
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-  nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
+  nixpkgsArgs ? {
+    config = { allowUnfree = false; inHydra = true; };
+    __allowFileset = false;
+  }
 }:
 
 let
diff --git a/pkgs/top-level/release-outpaths.nix b/pkgs/top-level/release-outpaths.nix
index 0b70ea631244..e6caabec04e9 100644
--- a/pkgs/top-level/release-outpaths.nix
+++ b/pkgs/top-level/release-outpaths.nix
@@ -57,6 +57,8 @@ let
 
             inHydra = true;
           };
+
+          __allowFileset = false;
         };
       };
   recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index a6222acaad53..161a6ddb68c3 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -15,6 +15,8 @@
       allowUnfree = false;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
 }:
 
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 42cf6e79b732..511cef6a0d8a 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -19,6 +19,8 @@
       allowUnfree = false;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
 }:
 
diff --git a/pkgs/top-level/release-unfree-redistributable.nix b/pkgs/top-level/release-unfree-redistributable.nix
index 96384e9fb020..45940c4d02cc 100644
--- a/pkgs/top-level/release-unfree-redistributable.nix
+++ b/pkgs/top-level/release-unfree-redistributable.nix
@@ -37,6 +37,8 @@
       cudaSupport = true;
       inHydra = true;
     };
+
+    __allowFileset = false;
   },
   # We only build the full package set on infrequently releasing channels.
   full ? false,
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 0140f0bd9d6a..78bdf1491125 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -28,16 +28,20 @@
   # Strip most of attributes when evaluating to spare memory usage
 , scrubJobs ? true
   # Attributes passed to nixpkgs. Don't build packages marked as unfree.
-, nixpkgsArgs ? { config = {
-    allowUnfree = false;
-    inHydra = true;
-    # Exceptional unsafe packages that we still build and distribute,
-    # so users choosing to allow don't have to rebuild them every time.
-    permittedInsecurePackages = [
-      "olm-3.2.16" # see PR #347899
-      "kanidm_1_3-1.3.3"
-    ];
-  }; }
+, nixpkgsArgs ? {
+    config = {
+      allowUnfree = false;
+      inHydra = true;
+      # Exceptional unsafe packages that we still build and distribute,
+      # so users choosing to allow don't have to rebuild them every time.
+      permittedInsecurePackages = [
+        "olm-3.2.16" # see PR #347899
+        "kanidm_1_3-1.3.3"
+      ];
+    };
+
+    __allowFileset = false;
+  }
 
   # This flag, if set to true, will inhibit the use of `mapTestOn`
   # and `release-lib.packagePlatforms`.  Generally, it causes the